Privacy policy

Last updated: November 17, 2025

This Privacy Policy describes how KyraGalactica (the “Site”, “we”, “us” or “our”) collects, uses, and shares personal data when you visit kyragalactica.com, use our services, make purchases, or communicate with us.

Please read this Privacy Policy carefully.


1. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processes or legal requirements. Any changes will be published on this page.

-----------------------------------------------------------

2. What personal data we collect

We collect personal data in three categories:


2.1 Data you provide to us directly

Examples:

● Contact details (name, address, phone number, email)

● Order information (billing and shipping address, payment details, email)

● Account information (username, password)

● Customer support information (contents of your messages to us)


2.2 Data we collect automatically (usage data)

When visiting the website, we automatically collect:

● IP address

● Browser and device information

● Network connection data

● Click and interaction data

● Information about cookies used


Services used for this:

● Shopify Analytics: anonymous usage statistics

● imgix: image optimization and delivery

● Cloudflare: security and loading time optimization

These services automatically receive technical data such as IP addresses, browser data, and device data.


2.3 Data received from third parties

We receive data from:

● Shopify, to operate the shop

● Payment service providers such as

■ PayPal

■ Klarna & Klarna Checkout

■ Shopify Payments

■ Apple Pay

■ Google Pay

■ Shipping and fulfillment service providers

■ Review tools such as Judge.me


All data we receive from third parties is handled in accordance with this policy.
-----------------------------------------------------------
3. How we use your data

We use personal data for the following purposes:


3.1 Providing our products and services

This includes:

● Payment processing via PayPal, Klarna, Shopify Payments, Apple Pay, Google Pay

● Fulfilling your order, shipping, returns

● Account management

● Notifications regarding purchases, shipping, and transactions

● Technical provision of the website (Shopify, Cloudflare, imgix)
Legal basis:
Art. 6 (1) lit. b GDPR (performance of contract),
Art. 6 (1) lit. c GDPR (legal obligations, e.g. retention periods),
Art. 6 (1) lit. f GDPR (legitimate interest in operating a functioning online shop).


3.2 Marketing & Advertising

We may use data for marketing purposes (newsletter, product updates).
Legal basis in the EEA:
Art. 6 (1) lit. f GDPR (legitimate interest) or Art. 6 (1) lit. a GDPR (consent, e.g. for newsletters).


3.3 Fraud prevention & security

This includes:

● IP monitoring via Shopify

● Security filters via Cloudflare

● Checks during payment selection (e.g. Klarna identity verification)
Legal basis:
Art. 6 (1) lit. f GDPR (legitimate interest in security and fraud prevention).


3.4 Communication & service improvement

We use your data to provide customer support and to optimize our online shop.
Legal basis:
Art. 6 (1) lit. f GDPR.

-----------------------------------------------------------

4. Cookies & consent

We use cookies for:

● Functionality (necessary)

● Analytics (Shopify Analytics)

● Image optimization (imgix)

● Security (Cloudflare)

Upon your first visit, a cookie consent banner will appear.
Technically non-essential cookies are only set with your consent.

Further information on Shopify cookies:
https://www.shopify.com/legal/cookies

-----------------------------------------------------------

5. Sharing personal data

We only share data when necessary, for example with:
5.1 Service providers

● Shopify (hosting, shop infrastructure)

● Cloudflare (security)

● imgix (image optimization)

● Shipping providers

● Data analysis providers

● Customer support tools

● Judge.me (product reviews)


5.2 Payment providers

● PayPal

● Klarna & Klarna Checkout (including identity/credit verification)

● Apple Pay

● Google Pay

● Shopify Payments


These providers process data such as:

● Name

● Billing/shipping address

● Payment information

● IP address

● Device data


5.3 Marketing partners

We may transmit anonymized data to advertising partners.

5.4 Legal or contractual obligations

(e.g. taxes, fraud prevention, court requests)
-----------------------------------------------------------

6. Third-party websites

If you use external links, their own privacy policies apply.

-----------------------------------------------------------

7. Data of children

Our services are not intended for children under 16 years of age.
We delete accidentally collected data upon notification by parents.

-----------------------------------------------------------

8. Security & data retention

We take standard technical and organizational measures (Shopify, Cloudflare, SSL, secure payment processing).
Data is stored only as long as legally or operationally required.
Retention periods: We retain personal data only as long as necessary for the processing purposes or as required by law (e.g. 10 years for tax-relevant documents).

-----------------------------------------------------------

9. Your rights

You may have the following rights:

● Right of access

● Right to deletion

● Right to rectification

● Right to restriction

● Right to data portability

● Right to object

● Right to withdraw consent

● Right to lodge a complaint with a data protection authority


To exercise your rights, contact us at:

Email: kyra.galactica@outlook.com

-----------------------------------------------------------

10. International data transfers

Data may be transferred to countries outside the EU (Shopify, Cloudflare, imgix, payment services).
This is done using Standard Contractual Clauses or comparable safeguards.

-----------------------------------------------------------

11. Contact

If you have questions about this Privacy Policy or wish to exercise your rights:

Dajana Schücker
Westoverledingen, Germany
Email: kyra.galactica@outlook.com
Responsible for data processing within the meaning of the General Data Protection Regulation (GDPR)