Controller and purposes
The controller is Enis Namli, handelnd unter Enam Market (ENAMMARKT), Adalbert-Stifter-Straße 101, 70437 Stuttgart, reachable at enammarkt@gmail.com and +49 1520 2029530. We process personal data to provide the website, respond to enquiries and fulfil orders.
Website, contact and account
IP address, request time and page, and browser details may be processed in server logs for secure operation (Article 6(1)(f) GDPR). Orders and related enquiries are processed under Article 6(1)(b), and other enquiries under (f). Customer accounts use name, phone, email, language and delivery addresses. Passwords are not stored as plain text. Ordering requires a customer account with a verified email address and your own delivery address.
Storage and external services
Essential storage supports language, basket, cookie choice and sign-in. The customer session cookie expires after at most seven days. Analytics and marketing services are not used. Instagram is an external link; opening it allows the provider to process data under its own terms. Necessary device storage is used under section 25(2) TDDDG.
The website is hosted with Hostinger. Enquiries to enammarkt@gmail.com are handled through Gmail. These services process the data needed for hosting or communication. External services may process data outside the European Economic Area.
Payments and address checking
For PayPal payments, the order reference, euro amount, language and delivery address are sent to PayPal to process the payment (Article 6(1)(b) GDPR). For PayPal card payments, card number and CVV are processed in PayPal fields and are not stored on our server. PayPal also processes data for its own payment, security and legal purposes. Its privacy notice additionally applies: https://www.paypal.com/de/legalhub/paypal/privacy-full .
We use Stripe for independent card payments. Order reference, euro amount and language are sent to Stripe to process the payment (Article 6(1)(b) GDPR). We do not send your saved email, phone or shipping address to Stripe. On its secure checkout page, Stripe processes the card, contact and billing details required for payment, fraud checks and legal obligations; card number and CVV are not stored on our server. Stripe also processes data for its own payment, security and legal purposes. Further information: https://stripe.com/privacy .
To check local delivery eligibility, street, house number, postcode, city and country are sent to Google Geocoding and Routes (Article 6(1)(b) GDPR). Name, email and phone are not sent for this check. We store the eligibility decision and check time, not raw route geometry. No Google map is embedded. Further information: https://business.safety.google/controllerterms/ .
Account security and withdrawal statements
Single-use links are used for email verification and password reset. Verification links last 24 hours and reset links 30 minutes. Resetting a password ends existing sessions. Withdrawal statements contain name, order reference or goods description, confirmation address and receipt time. These data are processed to meet statutory obligations (Article 6(1)(c) GDPR). A receipt does not determine the legal validity of withdrawal.
Retention and rights
Data is retained only as long as needed for its purpose, subject to statutory retention duties. Subject to legal conditions, you have rights of access, correction, erasure, restriction, portability and objection. Consent can be withdrawn for the future. You may complain, in particular, to the Baden-Württemberg data protection authority: https://www.baden-wuerttemberg.datenschutz.de .