Privacy Policy

Status: July 2026

Privacy Policy

1. Controller

The controller responsible for processing personal data in this online shop is:

METESSO EOOD
Trade name: Marsely
бул. Асеновградско шосе № 4K
р-н Тракия
4000 Plovdiv
Bulgaria
Email: hello@marsely.com
UIC/EIK: 208891896

2. Principles of Data Processing

We process personal data only insofar as this is necessary for the operation of the shop, the initiation and execution of contracts, communication with you, compliance with legal obligations, or based on consent or a legitimate interest.

Depending on the processing, we rely in particular on Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. b GDPR (contract and pre-contractual measures), Art. 6 para. 1 lit. c GDPR (legal obligation), and Art. 6 para. 1 lit. f GDPR (legitimate interests).

3. Website Access and Technical Data

When you visit our shop, technically necessary data may be processed, such as IP address, date and time of access, pages accessed, referrer URL, browser type, operating system, device information, as well as log and error data. The processing serves to provide the shop securely, stably, and user-friendly, for error analysis, and to prevent misuse. The legal basis is our legitimate interest in a secure and functional online offering in accordance with Art. 6 para. 1 lit. f GDPR.

4. Shopify as Shop Platform

Our online shop is operated via the Shopify platform. Shopify processes technical data, shop, customer, and order data, insofar as this is necessary for hosting, checkout, security, fraud prevention, shop functions, and the provision of platform services. Data may also be processed by companies affiliated with Shopify or by commissioned service providers.

Further information is provided by Shopify in its privacy policy: Shopify Privacy Policy.

5. Orders, Customer Account, and Contract Processing

If you place an order, create a customer account, or make a contract-related inquiry, we process, in particular, your name, billing and delivery address, email address, telephone number, ordered products, prices, payment and shipping status, communication, and, if applicable, account data. The processing is carried out for order processing, payment, delivery, returns, complaints, and customer service on the basis of Art. 6 para. 1 lit. b GDPR. We also process and store data required by commercial and tax law on the basis of Art. 6 para. 1 lit. c GDPR.

6. Payment Processing

Payment services available at checkout are used for payments. Depending on the chosen payment method, the data required for payment will be transmitted to the respective provider. This may include name, billing address, email address, order value, currency, payment reference, and technical data. Full card or account details are generally processed directly by the payment service provider and are not fully stored by us.

The processing is carried out for the execution of the contract in accordance with Art. 6 para. 1 lit. b GDPR and, where necessary, for fraud prevention and payment security on the basis of legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR. For processing by the selected payment service provider, their additional data protection regulations apply.

7. Shipping and Forwarding

To deliver your order, we transmit the necessary data to shipping companies, freight forwarders, and logistics partners. This includes, in particular, name, delivery address, telephone number, email address, order and delivery information. The legal basis is Art. 6 para. 1 lit. b GDPR.

8. Contact and Customer Service

If you contact us by email, contact form, or other means, we process your contact details and the content of your message to handle your request. For contract-related inquiries, the legal basis is Art. 6 para. 1 lit. b GDPR; otherwise, it is our legitimate interest in appropriate communication in accordance with Art. 6 para. 1 lit. f GDPR.

9. Newsletter and Marketing Communication

If you subscribe to our newsletter or other electronic marketing communications, we process your email address and any other voluntarily provided information on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future via the unsubscribe link in the message or by email to hello@marsely.com. The legality of the processing until the revocation remains unaffected.

10. Cookies and Similar Technologies

We use technically necessary cookies and similar technologies so that the shop, shopping cart, checkout, language settings, and security functions work. Insofar as analysis, personalization, or marketing technologies are used and consent is required for this, they will only be activated after your consent. You can change or revoke your selection via the cookie or privacy settings of the shop.

Necessary technologies are used on the basis of Art. 6 para. 1 lit. b or lit. f GDPR; technologies requiring consent are used on the basis of Art. 6 para. 1 lit. a GDPR.

11. Security and Fraud Prevention

We and our platform/payment service providers may evaluate order, payment, device, and usage data to detect abusive or fraudulent activities and to ensure the security of the shop. The legal basis is our legitimate interest in preventing fraud and protecting our systems and customers in accordance with Art. 6 para. 1 lit. f GDPR, and, if applicable, the performance of the contract in accordance with Art. 6 para. 1 lit. b GDPR.

12. Recipients of Data

Personal data may be transmitted, if necessary, to the following categories of recipients: Shopify and technical service providers, payment service providers, shipping companies and freight forwarders, communication and email service providers, IT and security service providers, tax advisors, legal advisors, banks, and authorities and courts if legally obligated.

Service providers only receive the data they need for the respective task and are contractually obligated to data protection – insofar as legally required.

13. Data Transfer to Third Countries

Some service providers may process data outside the European Economic Area. In these cases, we ensure, where necessary, an recognized adequate level of data protection or suitable safeguards, in particular adequacy decisions or standard contractual clauses. Regardless, there may be risks of government access in individual third countries.

14. Storage Period

We store personal data only as long as necessary for the respective purpose. Order, contract, invoice, and payment data are stored in accordance with applicable commercial and tax law retention obligations. Customer service and communication data are deleted once the matter is concluded and no legal or legitimate reasons for further storage exist. Newsletter data are stored until consent is revoked or until unsubscribed. Technical log data are kept only as long as necessary for security, error analysis, and prevention of misuse.

15. Your Rights

Under the legal conditions, you have the right to information about your personal data, rectification of inaccurate data, erasure, restriction of processing, and data portability. You can object to processing based on Art. 6 para. 1 lit. e or f GDPR. You can revoke any given consent at any time with effect for the future.

To exercise your rights, simply send a message to hello@marsely.com. To prevent unauthorized access to information, we may require appropriate proof of your identity.

16. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the state of your habitual residence, your place of work, or the place of the alleged infringement.

17. Automated Decisions

Marsely generally does not make exclusively automated decisions that produce legal effects concerning you or similarly significantly affect you. However, payment and platform service providers may carry out automated checks for payment and fraud prevention; their privacy policies apply to this.

18. Changes to this Privacy Policy

We may adapt this Privacy Policy if our shop, services used, or legal requirements change. The version published on this page at the time of access applies.