Paying with Klarna
If you select Klarna at checkout, we share your name, email address, billing and delivery address, order items, prices and order reference with Klarna through Mollie. Klarna uses this data in particular to assess whether it can offer you the payment method and processes it under its own rules. Klarna payment is separate from optional Sign in with Klarna. Klarna's privacy notice: Klarna privacy notice.
1. Controller
Marah Zahed, Hobackestraße 12, 45899 Gelsenkirchen, Deutschland
Email: info@lensesworld.de
2. Hosting and security
Cloudflare provides the website, its database and uploaded images. When you visit, data such as your IP address, time, requested page, browser and device information and technical errors is processed. This supports secure operation, troubleshooting and abuse prevention. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure and functional store. Cloudflare Workers logs are kept for no more than seven days, depending on the plan.
3. Technically necessary browser storage
The functional storage described here is needed for features you request. The separate, optional source attribution described in section 13 starts only after your consent. We do not use advertising cookies for it.
- Sign-in: a secure session cookie keeps you signed in. The session generally expires after 30 days and is invalidated when you sign out.
- Language: your preference is stored in a cookie and local browser storage for up to twelve months.
- Cart: products and selected options are stored locally in your browser. A session backup preserves the cart during sign-in. A backup cookie lasting up to 30 days may also be used for carts without individual prescription powers; prescription powers are not stored in that cookie.
- Checkout draft and product comparison: entries or selections remain in browser session storage and are removed when that session ends.
4. Customer account and sign-in
You can sign in voluntarily using a one-time email code, Google or Klarna. For email sign-in, we process your address, a short-lived code stored only as a hash in our database and technical sign-in data. Resend sends the code to you. For Google sign-in, we receive your name, email address, profile picture and a technical account ID, to the extent provided by Google. Connection tokens may be stored. We do not receive your Google password. Klarna sign-in is described in section 7. The legal basis for creating and accessing your account is Article 6(1)(b) GDPR.
You can save delivery addresses, including an optional phone number, and a wishlist in your account. We process these details to provide your account features; you can change or delete individual entries. Existing orders associated with your verified email address may be shown in your account.
5. Contact, complaints and reminders
If you contact us by email, we process your message and contact details to respond. Our business mailbox is operated by IONOS SE. For returns and complaints in your account, we store the information you enter, such as order reference, reason, description and replies. Please provide health information only if needed for your request. The legal basis is Article 6(1)(b) or (f) GDPR, depending on the request.
You can voluntarily set up lens reminders in your account and enter a first-use date for a purchased lens. The preference and date are linked to your account. You can change or disable your reminder preference in your account.
If you request a back-in-stock alert, we store your email address, selected lens, language, and the times of request, confirmation and dispatch. We first send a confirmation link and, after confirmation, at most one product-specific email once the lens can be ordered. Consent is voluntary (Article 6(1)(a) GDPR) and can be withdrawn using the cancellation link or by email. Unconfirmed requests expire after seven days; confirmed requests and consent records are retained after notification or withdrawal only as long as needed to document consent.
6. Orders and payments
For an order, we process your name, email address, optional phone number, delivery address, ordered items and selected prescription powers, prices, shipping costs, payment status and order reference. This is necessary to perform the purchase contract (Article 6(1)(b) GDPR). We also process payment records and other tax-relevant data to comply with legal duties (Article 6(1)(c) GDPR).
Mollie processes payments. We send Mollie the amount, currency, order reference and technical return and notification URLs. Mollie processes payment details you enter on its page under its own privacy notice; we do not store full card details. We store the payment ID and status confirmed by Mollie to manage the order.
Selected prescription powers may reveal health information. We use them only for the requested customisation and, where necessary, share them with the supplier carrying out that work. For prescription orders we ask for separate explicit consent under Article 9(2)(a) GDPR and record the time. You may withdraw consent for the future using our contact address; earlier lawful processing is unaffected. We will assess individually whether a customisation already underway can then be completed.
7. Sign in with Klarna
You can choose to sign in with Klarna. With your approval there, we receive your email address and name for your customer account. Further details such as shipping address or date of birth may be included depending on the permissions configured with Klarna; we do not turn these into a marketing profile merely because you sign in. Approving data sharing with Klarna is not consent to promotional emails. We do not receive your Klarna password, and signing in does not initiate a payment.
The Klarna library loads when the sign-in page opens so the sign-in button is directly available. For security and functionality, it may set __klarna_sdk_klarna-shopping-session in local storage for up to 48 hours and __klarna_sdk_config in session storage until you close your browser. Klarna may process browser data, IP address, time zone and language even if you do not choose Klarna sign-in. Klarna's own privacy notice also applies to its processing.
8. Marketing and birthdays
We do not automatically use a date of birth shared through Klarna for marketing. Birthday greetings and discount codes require separate, voluntary consent; permission given at Klarna is not enough. You may withdraw marketing consent at any time for the future, and every promotional email must offer an unsubscribe option. The legal basis is Article 6(1)(a) GDPR.
9. Recipients and transfers outside the EEA
Cloudflare processes data for hosting, database, image storage and security; Resend sends sign-in and order emails; IONOS SE runs our business mailbox. Google or Klarna is involved if you choose that sign-in method, Mollie processes payments, and DHL or another carrier receives the details needed to deliver an order. For a wallet payment, Apple or Google may additionally process payment and device data under their own privacy notices. Order and prescription details may be shared with the supplier carrying out individual customisation where needed. We share only data required for each purpose.
Cloudflare and Resend may process data outside the EEA. Where a transfer mechanism is needed, this may be an adequacy decision or appropriate safeguards such as EU standard contractual clauses. You can request further information using our contact address.
10. Retention
We generally keep account details, addresses and wishlist entries until your account or the entry is deleted, unless legal duties or outstanding claims require longer retention. Sessions generally end after 30 days; one-time codes expire after ten minutes. We keep requests and technical payment attempts only for as long as needed for handling, evidence and security. Order, payment and invoice records are kept under applicable tax and commercial retention rules; depending on the record type, periods may be six, eight or ten years.
11. Electronic withdrawal
If you use the “Withdraw from contract” function, we save your name, order or contract reference, confirmation email address, stated scope and the times of receipt and email dispatch. We use this information to receive and acknowledge your statement and handle potential claims (Article 6(1)(c) and (f) GDPR). We email the receipt to the address you provide and send a copy to our business mailbox.
12. Your rights
For questions or to exercise your rights, email info@lensesworld.de. We do not make solely automated decisions with legal or similarly significant effects.
- Access, correction, erasure and restriction of processing, subject to legal requirements
- Data portability and objection to processing based on legitimate interests
- Withdrawal of consent at any time for the future, without affecting earlier lawful processing
- Complaint to a data protection authority, in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
13. Optional source attribution and your privacy choice
Optional source attribution is available. It starts off and begins only if you explicitly accept it in the separate privacy dialog. Accepting and refusing are equal choices; you can shop and read this policy without consenting.
If you consent, we associate a later purchase with the first known and latest known non-direct arrival in this browser tab. We use campaign identifiers and limited indications of the referring service. Missing evidence stays unknown. Classification is not a verified identity or complete browsing history. It does not measure unique visitors or a visit conversion rate.
The optional source record contains only channel, random campaign/creator identifiers and observation times. Full URLs, referrer paths, click identifiers, IP addresses, browser identifiers, names, email addresses, delivery addresses, cart contents and prescription powers are not added to that record. A source record attached to a checkout is still personal data while it can be linked to an order or person; it is not anonymous.
Optional source attribution relies on your consent under GDPR Article 6(1)(a), and the corresponding browser access on TDDDG section 25(1). Ordering, accepting terms, prescription-data processing, signing in or consenting to email marketing do not provide this source consent. An older choice version is not carried over as a new grant.
To manage your choice we use separate functional browser data and a protected receipt cookie (__Host-lw-campaign-consent). It is not an advertising visitor profile: it lets this browser demonstrate its choice and withdraw it. The cookie is restricted to this host, sent only over HTTPS and inaccessible to JavaScript. The server stores the secret token only as a hash. The receipt records consent purpose and version, language, decision and server times; no IP address, user-agent value or full URL is added to it. Functional management implements your privacy choice; necessary consent evidence serves our obligations under GDPR Article 7(1), relying on Article 6(1)(c). These data must not be reused for advertising or a visitor profile.
Acceptance and refusal are valid for at most 180 days; a new choice is needed after that or a relevant purpose/version change. Optional source context is valid for at most 30 days in this tab; navigation does not extend it. Browsers may restore sessions or initially copy tab data. Expired context is no longer used and is removed when next accessed.
An unpaid checkout source link is used for at most 30 days from server-side creation. For a confirmed payment, the maximum is 90 days from the first server-side payment confirmation. Both end no later than expiry or withdrawal of the associated consent. The minimal consent/withdrawal receipt may be used for another 30 days after expiry or withdrawal for handling and documentation; after that it is blocked from further use and due for removal at the next designated cleanup. These are our purpose limits, not blanket statutory retention periods. Expired links are excluded from source reports; physical removal is not promised to the second.
Our operating target is physical removal of due optional data within 24 hours, supported by a planned hourly cleanup. This requires cleanup to be enabled and working and is not a guaranteed deletion deadline. An outage may delay removal; blocked or expired data remains excluded from source processing regardless.
You can withdraw source consent at any time through Privacy settings as easily as you granted it. Withdrawal stops browser source processing immediately and requests server-side blocking and removal of optional links associated with this browser's receipt. Success is confirmed only after the server responds. If the connection fails, local measurement remains off; server confirmation is still pending and withdrawal can be retried. This does not delete your cart, checkout draft or financial order records.
To retry an unconfirmed withdrawal, this browser may retain a functional pending request until server confirmation, at most until 30 days after the known receipt expiry. If that expiry is unavailable, the limit is 211 days from the original consent-request time. The deadline is checked when next accessed; we cannot remotely remove these local data while the browser is closed. Expiry does not confirm that an earlier failed server withdrawal was completed. The privacy-request contact route remains available in that case.
On another browser or after losing the receipt, we cannot identify earlier orders from the browser alone. You can submit a privacy request through our contact form or the controller's contact details in section 1. We ask only for the information and proportionate proof needed to identify the records and verify your authority. Email is not the only withdrawal method. Withdrawal does not change the lawfulness of processing before it.
Applying and accounting for a coupon actually used is separate from optional source attribution. Existing coupon redemptions may remain for payment/order accounting and a separate paid code-use report; they do not prove a visit source. Source withdrawal does not delete coupon redemptions, orders, payments or refunds, or mean that every association with a creator disappears. Other parts of this policy cover those separate order and accounting purposes.
After a technical recovery, we may conservatively erase optional source history and invalidate earlier consent receipts so withdrawn links cannot be reused. New source attribution then requires a fresh explicit choice. This source cleanup does not delete order, payment, refund or coupon-accounting records.
This feature sends no data to Google Analytics 4 or Meta Pixel. Source consent does not authorize later analytics, advertising, remarketing or cross-provider purposes; these would need their own information and separate choices. Merely following a shortlink is not a measured person or consent. A separate shortlink request counter remains off until its purpose and legal basis receive separate approval.
Hosting, technical security and the payment/sign-in services already described remain separate processing activities (sections 2, 6, 7 and 9). This source feature does not reuse security or rate-limit data to construct campaigns. The absence of IP addresses in the new source record does not mean that operating the website involves no technical connection data. Sections 2 and 9 cover hosting and possible transfers outside the EEA.
14. Policy date
Last updated: 21 October 2026.