← Back to home

Privacy policy

Last updated: September 2026

Courtesy translation — the German version is legally binding.

1. Data protection at a glance

The protection of your personal data is of great importance to us. We treat your personal data confidentially and in accordance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR), the Bundesdatenschutzgesetz (BDSG, German Federal Data Protection Act) and other applicable data protection provisions.

With this privacy policy, we inform you which personal data is processed when you visit our website, use our online shop, or contact us or place an order, for what purposes this processing takes place, and what rights you have as a data subject.

Personal data is processed exclusively to the extent necessary and only on a legal basis or on the basis of your consent.

2. Controller

The controller responsible for the processing of personal data within the meaning of the GDPR is:

Meriem Lemouchi, trading under the brand “MCHI”
Ludwigshafener Straße 12
40229 Düsseldorf
Germany
Email: info@mchibrand.com

3. General information on data processing

Personal data is any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR). This includes, for example, name, address, email address, telephone number, IP address or order data.

We process personal data only to the extent permitted under data protection law. Processing takes place only in the following cases:

  • to provide our website on the basis of our legitimate interest in a secure, functional and user-friendly online presence (Art. 6 (1)(f) GDPR),
  • to carry out and process orders and to fulfil contractual obligations or to carry out pre-contractual measures (Art. 6 (1)(b) GDPR),
  • to process enquiries, depending on their content, to carry out pre-contractual measures or to safeguard our legitimate interest in responding to enquiries (Art. 6 (1)(b) or (f) GDPR),
  • to fulfil legal obligations, in particular tax and commercial law retention obligations (Art. 6 (1)(c) GDPR),
  • to safeguard legitimate interests, provided that your interests or fundamental rights and freedoms do not override them (Art. 6 (1)(f) GDPR), or
  • on the basis of your consent (Art. 6 (1)(a) GDPR).

Personal data is transferred to third parties only insofar as this is necessary for the performance of the contract, required by law, or permitted under data protection law.

4. Hosting

Our website is hosted by one.com.

For the purpose of providing and securely operating our website, the hosting provider processes personal data on our behalf. This includes, in particular:

  • IP address
  • date and time of access
  • browser type and version
  • operating system
  • referrer URL
  • pages accessed
  • server log files
  • other technically necessary connection data

Processing takes place on the basis of Art. 6 (1)(f) GDPR. Our legitimate interest lies in the secure, stable and efficient provision of our online offering.

Where legally required, we have concluded a data processing on behalf agreement (Art. 28 GDPR) with our hosting provider.

Further information on the processing of personal data by one.com can be found at: https://www.one.com/de/info/datenschutz

5. Server log files

When you access our website, the hosting provider automatically collects information and stores it in what are known as server log files.

In particular, the following information may be processed:

  • IP address
  • date and time of access
  • browser type and version
  • operating system used
  • referrer URL
  • host name of the accessing device
  • pages and files accessed

Processing takes place exclusively to ensure technical operation, to guarantee system security, for error analysis, and to defend against abusive access.

This data is not merged with other data sources.

The legal basis is Art. 6 (1)(f) GDPR.

6. Contacting us

You can contact us at any time by email at info@mchibrand.com.

When you contact us, we process the personal data you provide exclusively to handle your request and to communicate with you.

This may in particular include the following data:

  • name
  • email address
  • the content of your message
  • date and time of contact
  • any further information voluntarily provided

Processing takes place on the basis of Art. 6 (1)(b) GDPR, insofar as your enquiry serves to initiate or perform a contract. In all other cases, processing takes place on the basis of our legitimate interest in the appropriate and efficient handling of your enquiry pursuant to Art. 6 (1)(f) GDPR.

The data you provide is used exclusively to process your enquiry and is not disclosed to unauthorised third parties without your consent.

7. SSL/TLS encryption

To protect the transmission of confidential content and personal data, our website uses SSL or TLS encryption in accordance with the current state of the art.

You can recognise an encrypted connection by the “https://” prefix in your browser's address bar and by the lock icon in your browser.

Encryption ensures that transmitted data cannot be read or manipulated by unauthorised third parties.

8. Orders and Shopify checkout

Our website serves to present our products. Orders are placed and payments are processed via the e-commerce platform Shopify.

When you place an order or access the checkout, personal data required to conclude and process the sales contract is processed.

This includes, in particular:

  • first and last name
  • billing and delivery address
  • email address
  • telephone number (if provided)
  • order information
  • payment information
  • IP address
  • device and browser information
  • date and time of the order

Processing takes place on the basis of Art. 6 (1)(b) GDPR to carry out pre-contractual measures and to fulfil the sales contract concluded between you and us.

As part of the use of Shopify, personal data may also be transferred to companies of the Shopify corporate group outside the European Economic Area (EEA), in particular to Canada. This international data transfer is based on the European Commission's adequacy decision of 20 December 2001 within the meaning of Art. 45 GDPR. It is available at: https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32002D0002.

Further information on data processing by Shopify can be found at: https://www.shopify.com/legal/privacy

9. Payment service providers

We work with external payment service providers to process payments. Depending on the payment method chosen, the personal data required for payment processing is transmitted directly to the respective payment service provider.

In particular, the following data may be processed:

  • first and last name
  • billing address
  • delivery address
  • email address
  • payment amount
  • order number
  • payment information
  • IP address

Processing takes place exclusively for the purpose of payment processing pursuant to Art. 6 (1)(b) GDPR.

We offer the following payment methods:

  • Shop Pay
  • Visa
  • Mastercard
  • American Express
  • Maestro
  • UnionPay
  • Apple Pay
  • Google Pay
  • USDC
  • Klarna

In addition, the data protection provisions of the respective payment service provider selected apply to the processing of personal data.

10. Provision of personal data

The provision of certain personal data is necessary for the conclusion and performance of a sales contract. This applies in particular to your name, billing and delivery address, email address, order information and the details required for payment processing.

Without the provision of this data, we cannot process your order or perform a sales contract with you.

The provision of further personal data, such as a telephone number, is generally voluntary, provided it is not required in the individual case for delivery, payment processing or communication in connection with your order.

11. Shipping

We work with the shipping service provider DHL to deliver your order. Insofar as this is necessary for the performance of the contract, we transmit the personal data required for delivery to DHL.

This may in particular include the following data:

  • first and last name
  • delivery address
  • email address (where required for shipping information or tracking)
  • telephone number (if provided and required for delivery)
  • order and shipment information

Data transmission takes place exclusively to perform the sales contract on the basis of Art. 6 (1)(b) GDPR.

Delivery is currently only available within Germany.

Further information on data processing by DHL can be found at: https://group.dhl.com/de/datenschutz.html

12. Newsletter

If you sign up for our newsletter, we use your email address exclusively to inform you regularly about new collections, products, exclusive offers and news about MCHI.

Our newsletter is sent via Shopify Email.

Sign-up takes place using the so-called double opt-in procedure. After signing up, you will receive an email with a confirmation link. Your email address will only be added to our newsletter list once you have successfully confirmed.

You can withdraw your consent at any time with effect for the future. To do so, use the unsubscribe link in the respective newsletter or contact us at: info@mchibrand.com

The legal basis for processing is your consent pursuant to Art. 6 (1)(a) GDPR.

Further information on data processing by Shopify can be found at: https://www.shopify.com/legal/privacy

13. Cookies

Our website uses cookies and comparable technologies. Cookies are small text files that are stored on your device. Comparable technologies may in particular include local storage technologies, pixels or similar methods.

These cookies serve, in particular, to

  • ensure the technical functionality of the website,
  • enable the ordering process,
  • save user settings,
  • improve user-friendliness,
  • carry out statistical analyses, and
  • support marketing measures, provided you have consented to this.

Technically necessary cookies and comparable technologies may be used without consent pursuant to § 25 (2) TDDDG (German Telecommunications Digital Services Data Protection Act), insofar as they are strictly necessary to provide the digital service expressly requested by you. The associated processing of personal data regularly takes place on the basis of Art. 6 (1)(f) GDPR or, insofar as it is required to carry out the ordering process, on the basis of Art. 6 (1)(b) GDPR.

Cookies and comparable technologies that are not technically necessary are only used with your prior consent pursuant to § 25 (1) TDDDG. The subsequent processing of personal data takes place on the basis of Art. 6 (1)(a) GDPR.

You can withdraw your consent at any time with effect for the future via our cookie banner or adjust your cookie settings.

The cookies and comparable technologies used, their respective storage periods, providers and processing purposes depend on the services actually used on our website and are transparently disclosed in the consent management system.

14. Analytics and tracking services

Provided you have expressly consented, analytics and marketing services may be used on our website to evaluate the use of our online offering, improve user-friendliness and optimise marketing measures.

In particular, the following personal data may be processed:

  • IP address
  • device information
  • browser information
  • usage behaviour
  • pages visited
  • interactions within our website

The use of analytics and tracking technologies that are not technically necessary only takes place with your prior consent pursuant to § 25 (1) TDDDG. The subsequent processing of personal data takes place on the basis of your consent pursuant to Art. 6 (1)(a) GDPR.

You can withdraw your consent at any time with effect for the future via our cookie banner or adjust your cookie settings.

The specific analytics and tracking services used, their respective providers, purposes, data categories, storage periods and any transfers to third countries are disclosed in the cookie banner and in the cookie settings of our website.

15. Social media presences

On our website you will find links to our presences on the social networks Instagram and TikTok.

By clicking on a corresponding link, you leave our website and are redirected to the website of the respective provider.

Personal data is only transmitted to the respective platform operators after you have actively selected the respective link.

The respective operators are exclusively responsible for the processing of personal data on the platforms. The data protection provisions of the respective provider apply.

Further information can be found at:

16. Storage period

We store personal data only for as long as this is necessary to fulfil the respective processing purposes or as we are obliged to do so under statutory provisions.

Server log files are stored only for as long as this is necessary to ensure technical operation, for error analysis, to guarantee system security and to defend against abusive access.

We store data from contact enquiries for as long as this is necessary to process your enquiry. Where a contractual relationship arises from the enquiry, or statutory retention obligations apply, longer storage may occur.

We store order, contract, payment and invoice data for the duration of the statutory retention obligations under commercial and tax law.

We store newsletter data until you withdraw your consent or unsubscribe from the newsletter, unless statutory proof or retention obligations preclude this.

Cookie and consent data is stored for as long as this is necessary to manage and document your consents or cookie settings.

As soon as the respective purpose of processing no longer applies and no statutory retention obligations remain, the personal data is deleted or, where deletion is not possible or not permitted by law, its processing is restricted.

17. Rights of data subjects

Provided the statutory requirements are met, you have the following rights with regard to the processing of your personal data:

  • Right of access pursuant to Art. 15 GDPR
  • Right to rectification of inaccurate data or completion of incomplete data pursuant to Art. 16 GDPR
  • Right to erasure of your personal data pursuant to Art. 17 GDPR
  • Right to restriction of processing pursuant to Art. 18 GDPR
  • Right to data portability pursuant to Art. 20 GDPR
  • Right to object to the processing of personal data pursuant to Art. 21 GDPR

Where processing is based on your consent, you may withdraw this consent at any time with effect for the future pursuant to Art. 7 (3) GDPR. The lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal remains unaffected.

If you wish to exercise any of your rights or have questions about the processing of your personal data, you can contact us at any time:

Meriem Lemouchi, trading under the brand “MCHI”
Ludwigshafener Straße 12
40229 Düsseldorf
Germany
Email: info@mchibrand.com

18. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the provisions of the GDPR.

You may, in particular, contact the data protection supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement.

19. Data security

We take appropriate technical and organisational measures to protect your personal data against loss, destruction, unauthorised access, manipulation or other unlawful processing.

Our security measures are continuously reviewed in line with technological developments and statutory requirements and adjusted where necessary.

Please note that, despite all security measures, data transmission over the internet may have security vulnerabilities. Complete protection of the data from access by third parties is therefore not technically possible.

20. Automated decision-making

Decision-making based solely on automated processing – including profiling – within the meaning of Art. 22 GDPR does not take place.

Should we use procedures in the future that require automated decision-making or profiling within the meaning of the GDPR, we will inform you separately about this.

21. Changes to this privacy policy

We reserve the right to amend this privacy policy where this becomes necessary due to changes in statutory requirements, technical developments, changes to our online offering, or the introduction of new services.

The version of the privacy policy published at the time of your visit to our website shall apply in each case.

Insofar as an amendment to this privacy policy requires consent, or other parts of the privacy policy require the involvement of data subjects, such amendments will only be made in compliance with the applicable statutory provisions.

Version of this privacy policy: September 2026

Last updated: September 2026