Privacy and Data Protection

Privacy Policy

Last updated: 25 July 2026

Protecting your personal data matters to us. Below we explain which personal data we process when you visit naintrading.ie and place orders in our online shop, on which legal basis this happens, and which rights you have.

Controller

The controller within the meaning of the GDPR is:
Nain Trading GmbH
Brook 7
20457 Hamburg
Germany
Phone: +44 20 7664 4565
Email: [email protected]

Contact for data protection enquiries: Dr. Ali Naeini (address as above).

General Information

Unless stated otherwise below, providing your personal data is neither legally nor contractually required and is not necessary for concluding a contract. You are not obliged to provide your data; not providing it generally has no consequences unless indicated otherwise for individual processing operations. Personal data means any information relating to an identified or identifiable natural person.

Hosting and Server Log Files

Our website is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany; the servers are located in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

You can generally visit our website without providing personal data. On every visit, your browser automatically transmits usage information that is stored in server log files – such as the page accessed, time of access, IP address, data volume transferred and the requesting internet provider. This processing is based on Art. 6(1)(f) GDPR and our legitimate interest in the stable and secure operation of our website.

Contact by Email

If you contact us by email, we process the details you provide (e.g. name, email address, message) to handle your enquiry. Where your enquiry relates to the initiation or performance of a contract, processing is based on Art. 6(1)(b) GDPR; otherwise on our legitimate interest in answering your enquiry under Art. 6(1)(f) GDPR. After the matter is concluded and statutory retention periods have expired, we delete your data unless you have consented to further use.

Contact Form

When you use our contact form, we process the data you enter (name, email address, message) to handle your request. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual matters, otherwise Art. 6(1)(f) GDPR. Once communication is complete and statutory periods have expired, the data is deleted.

Orders

For orders we process your personal data (e.g. name, address, email address, order and payment data) to the extent necessary to perform the purchase contract and handle related enquiries. Providing this data is required for concluding the contract. The legal basis is Art. 6(1)(b) GDPR. Data is shared only with service providers necessary for fulfilment – in particular shipping companies, payment service providers and IT and logistics providers – and only to the extent required.

Payment Provider Stripe

For card payments and further payment methods we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland (“Stripe”). The data required for payment processing (e.g. name, payment details, order amount) is transmitted to Stripe. Processing is based on Art. 6(1)(b) GDPR for the performance of the contract. Stripe may transfer data to Stripe, Inc. in the USA. The provider or its US parent company is certified under the EU-US Data Privacy Framework (DPF). Any transfer of personal data to the USA is therefore based on the adequacy decision of the European Commission of 10 July 2023 (Implementing Decision (EU) 2023/1795); in addition, EU standard contractual clauses are in place as appropriate safeguards within the meaning of Art. 46 GDPR. Further information: stripe.com/privacy

Payment Provider PayPal

If you pay via PayPal, payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The data required for payment processing is transmitted to PayPal. Processing is based on Art. 6(1)(b) GDPR. Further information: PayPal privacy statement

Payment Provider Klarna and Credit Assessment

If you choose a Klarna payment method, we transmit personal data (e.g. contact and order data) to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. The transfer serves payment processing as well as identity and credit checks, on the basis of which Klarna decides whether to offer you its payment options. The legal basis is Art. 6(1)(b) GDPR. Klarna processes your data under its own responsibility; details: Klarna privacy notice

Passing Your Email Address to Shipping Companies

If you have expressly consented during checkout, we pass your email address to the commissioned shipping company so that it can inform you about the delivery status. The legal basis is your consent under Art. 6(1)(a) GDPR; you may withdraw it at any time with effect for the future.

Comments and Reviews

If you submit a review or comment, we process the data you enter (name, email address, review text) to publish your opinion. The legal basis is your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time. Only the name you provide is displayed.

Newsletter

If you subscribe to our newsletter, we use your email address exclusively to send our own information and offers. The legal basis is your consent under Art. 6(1)(a) GDPR. You can unsubscribe at any time via the link in the newsletter or by contacting us.

Advertising Partners

To increase the reach of our marketing, we work with advertising partners, including social networks such as Facebook, Instagram, Pinterest, TikTok and YouTube as well as advertising platforms such as Google Ads and the Google Marketing Platform. These partners use information collected via cookies or similar technologies to show you interest-based advertising (including retargeting). Pseudonymized data (e.g. hashed email addresses or device identifiers) may also be processed to recognize you on external platforms; if no match is found, the transmitted data is deleted. The hashing methods used convert your data into a non-reversible form. Where partners transfer data outside the EEA, this takes place on the basis of an adequacy decision (in particular the EU-US Data Privacy Framework) or appropriate safeguards under Art. 46 GDPR. These technologies are used only with your consent under Article 5(3) of the ePrivacy Directive as implemented in the national law applicable to you (in Germany: Section 25(1) TDDDG) in conjunction with Art. 6(1)(a) GDPR, which you can withdraw at any time via our cookie settings.

Cookies

Our website uses cookies – small text files stored by your browser on your device that allow your browser to be recognized on subsequent visits. You control their use via our cookie settings and your browser, where you can allow cookies case by case, block them generally or delete stored cookies. Please note that website functionality may be limited without cookies.

Strictly Necessary Cookies

Unless stated otherwise in this privacy policy, we only use technically necessary cookies to provide our website in a functional and secure manner – for example so that the shopping cart and login work across pages. Their use is based on Article 5(3) of the ePrivacy Directive as implemented in the applicable national law (in Germany: Section 25(2) TDDDG); the associated data processing is based on Art. 6(1)(f) GDPR and our legitimate interest in the proper provision of our services. You have the right to object to this processing at any time on grounds relating to your particular situation.

Google Analytics

We use the web analytics service Google Analytics provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) to analyse the use of our website and improve our services. Data collected may include IP address, date and time of access, click path, browser and device properties, pages visited, referrer URL and approximate location. IP anonymization is enabled; your IP address is truncated within the EU/EEA.

Cookies and similar technologies are used, and the associated data is processed, only with your consent under Article 5(3) of the ePrivacy Directive as implemented in the national law applicable to you (in Germany: Section 25(1) TDDDG) in conjunction with Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future via our cookie settings. Data may be transferred to Google LLC in the USA. The provider or its US parent company is certified under the EU-US Data Privacy Framework (DPF). Any transfer of personal data to the USA is therefore based on the adequacy decision of the European Commission of 10 July 2023 (Implementing Decision (EU) 2023/1795); in addition, EU standard contractual clauses are in place as appropriate safeguards within the meaning of Art. 46 GDPR. Further information: Google privacy policy

Meta Pixel (Custom Audiences)

We use the “Custom Audiences” remarketing function of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”) to show visitors of our website interest-based advertising on Facebook and Instagram. When you visit our pages, the Meta pixel establishes a connection to Meta servers and transmits which pages you visited; Meta may match this information to your profile. For the collection and transmission of this data, we and Meta act as joint controllers within the meaning of Art. 26 GDPR; the agreement is available at facebook.com/legal/controller_addendum. The pixel is used only with your consent under Article 5(3) of the ePrivacy Directive as implemented in the national law applicable to you (in Germany: Section 25(1) TDDDG) in conjunction with Art. 6(1)(a) GDPR, withdrawable at any time via our cookie settings. Data may be transferred to Meta Platforms, Inc. in the USA. The provider or its US parent company is certified under the EU-US Data Privacy Framework (DPF). Any transfer of personal data to the USA is therefore based on the adequacy decision of the European Commission of 10 July 2023 (Implementing Decision (EU) 2023/1795); in addition, EU standard contractual clauses are in place as appropriate safeguards within the meaning of Art. 46 GDPR. Further information: Meta privacy policy

Google Ads Conversion Tracking

We use the Google Ads advertising programme with conversion tracking (Google Ireland Limited). If you click on a Google ad, a conversion cookie with a limited lifetime is stored, allowing Google and us to recognize that you reached our site via an ad. We only learn the total number of users who clicked on an ad; no personal identification takes place. Used only with your consent under Article 5(3) of the ePrivacy Directive as implemented in the national law applicable to you (in Germany: Section 25(1) TDDDG) in conjunction with Art. 6(1)(a) GDPR, withdrawable at any time. Data may be transferred to Google LLC in the USA. The provider or its US parent company is certified under the EU-US Data Privacy Framework (DPF). Any transfer of personal data to the USA is therefore based on the adequacy decision of the European Commission of 10 July 2023 (Implementing Decision (EU) 2023/1795); in addition, EU standard contractual clauses are in place as appropriate safeguards within the meaning of Art. 46 GDPR.

Google Remarketing / Similar Audiences

We use the Google remarketing and “similar audiences” functions to show visitors of our website interest-based ads within the Google advertising network. Google uses cookies to record visits to our website. Used only with your consent under Article 5(3) of the ePrivacy Directive as implemented in the national law applicable to you (in Germany: Section 25(1) TDDDG) in conjunction with Art. 6(1)(a) GDPR, withdrawable at any time. Data may be transferred to Google LLC in the USA. The provider or its US parent company is certified under the EU-US Data Privacy Framework (DPF). Any transfer of personal data to the USA is therefore based on the adequacy decision of the European Commission of 10 July 2023 (Implementing Decision (EU) 2023/1795); in addition, EU standard contractual clauses are in place as appropriate safeguards within the meaning of Art. 46 GDPR.

Microsoft Advertising

We use Microsoft Advertising of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”) for marketing purposes and to measure ad performance (conversion tracking). Data collected may include IP address, identifiers assigned by Microsoft, browser, device type and referrer URL; no personal identification takes place. Used only with your consent under Article 5(3) of the ePrivacy Directive as implemented in the national law applicable to you (in Germany: Section 25(1) TDDDG) in conjunction with Art. 6(1)(a) GDPR, withdrawable at any time. The provider or its US parent company is certified under the EU-US Data Privacy Framework (DPF). Any transfer of personal data to the USA is therefore based on the adequacy decision of the European Commission of 10 July 2023 (Implementing Decision (EU) 2023/1795); in addition, EU standard contractual clauses are in place as appropriate safeguards within the meaning of Art. 46 GDPR. Further information: Microsoft privacy statement

Pinterest Tag

We use the Pinterest Tag of Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland to show visitors of our website personalized advertising on Pinterest and to measure the success of our campaigns. This involves transmitting which pages you visited (e.g. product pages, cart, transactions); if you are logged in to Pinterest, Pinterest may match this data to your profile. Used only with your consent under Article 5(3) of the ePrivacy Directive as implemented in the national law applicable to you (in Germany: Section 25(1) TDDDG) in conjunction with Art. 6(1)(a) GDPR, withdrawable at any time. Data may be transferred to Pinterest, Inc. in the USA. The provider or its US parent company is certified under the EU-US Data Privacy Framework (DPF). Any transfer of personal data to the USA is therefore based on the adequacy decision of the European Commission of 10 July 2023 (Implementing Decision (EU) 2023/1795); in addition, EU standard contractual clauses are in place as appropriate safeguards within the meaning of Art. 46 GDPR. Further information: Pinterest privacy policy

Google Tag Manager

We use the Google Tag Manager (Google Ireland Limited) to manage website tags centrally. The Tag Manager itself does not set cookies and does not process personal data; it merely triggers other tags which may in turn collect data as described in this policy.

Google Maps

We embed Google Maps (Google Ireland Limited) to display interactive maps. When you access pages with embedded maps, usage information (e.g. IP address) is transmitted to Google. Processing is based on Art. 6(1)(f) GDPR and our legitimate interest in an appealing presentation of our locations; where your device is accessed, we obtain your consent under Article 5(3) of the ePrivacy Directive as implemented in the national law applicable to you (in Germany: Section 25(1) TDDDG). Data may be transferred to Google LLC in the USA. The provider or its US parent company is certified under the EU-US Data Privacy Framework (DPF). Any transfer of personal data to the USA is therefore based on the adequacy decision of the European Commission of 10 July 2023 (Implementing Decision (EU) 2023/1795); in addition, EU standard contractual clauses are in place as appropriate safeguards within the meaning of Art. 46 GDPR.

YouTube

We embed videos via YouTube (Google Ireland Limited) in extended privacy mode. Simply opening a page with an embedded video does not transmit any data to YouTube; only when you actively play a video is a connection to YouTube servers established and data such as your IP address and device information transmitted. The legal basis is your consent under Article 5(3) of the ePrivacy Directive as implemented in the national law applicable to you (in Germany: Section 25(1) TDDDG) in conjunction with Art. 6(1)(a) GDPR, which you give by starting the video. Data may be transferred to the USA. The provider or its US parent company is certified under the EU-US Data Privacy Framework (DPF). Any transfer of personal data to the USA is therefore based on the adequacy decision of the European Commission of 10 July 2023 (Implementing Decision (EU) 2023/1795); in addition, EU standard contractual clauses are in place as appropriate safeguards within the meaning of Art. 46 GDPR. Further information: YouTube privacy policy

Google Fonts

For a consistent display of fonts we use Google Fonts (Google Ireland Limited). When you access our pages, your browser loads the required fonts from Google servers; your IP address and browser information may be transmitted to Google. No link to any Google account is established. Processing is based on Art. 6(1)(f) GDPR and our legitimate interest in a consistent, user-friendly presentation. Data may be transferred to Google LLC in the USA. The provider or its US parent company is certified under the EU-US Data Privacy Framework (DPF). Any transfer of personal data to the USA is therefore based on the adequacy decision of the European Commission of 10 July 2023 (Implementing Decision (EU) 2023/1795); in addition, EU standard contractual clauses are in place as appropriate safeguards within the meaning of Art. 46 GDPR. Further information: Google Fonts FAQ

Retention Period

We store personal data only as long as necessary to fulfil contractual or statutory obligations. After the contract has been fully performed, we initially retain the data for the duration of the statutory warranty periods and subsequently in accordance with statutory retention periods under tax and commercial law. After these periods expire, the data is deleted unless you have consented to further processing.

Your Rights

Where the legal requirements are met, you have the following rights: right of access (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR) and right to data portability (Art. 20 GDPR). You may withdraw any consent you have given at any time with effect for the future without affecting the lawfulness of processing carried out before the withdrawal – for cookies and tracking most easily via the cookie settings in the footer of our website.

Right to Object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing; the data will then no longer be processed for these purposes.

After an objection we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to Lodge a Complaint

Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, datenschutz-hamburg.de.