Privacy Policy

Last updated: [23.06.2026]

We take the protection of your personal data seriously. This Privacy Policy explains what data we collect when you visit or shop at our online store, why we collect it, and what rights you have regarding your data.

1. Controller (Data Responsible)

The entity responsible for data processing on this website is:

LPH Tec.
Tobias Siferlinger
Kautseestr. 10
83093 Bad Endorf, Germany
Email: info@musa-vaporizer.com

2. What Data We Process

When you use our website and shop, we may collect and process the following personal data:

Name, billing address, and delivery address
Email address
Order details (products, quantities, order date)
Payment data (processed securely via payment service providers)
IP address and technical access data (via server/hosting logs)
Optional: newsletter subscription data

We only collect data that is strictly necessary to process your order, comply with legal obligations, and provide customer service.

3. Purposes of Processing

We process your personal data for the following purposes:

Processing and fulfilling your orders (including invoicing and shipping documentation)
Providing customer support
Compliance with legal obligations (e.g. tax and commercial law record-keeping)
Sending newsletters — only if you have explicitly subscribed (opt-in)
Website security and fraud prevention

4. Legal Basis

The processing of your data is based on the following legal grounds under the GDPR:

Art. 6(1)(b) GDPR – Performance of a contract: processing is necessary to fulfil your order or to take pre-contractual steps at your request.
Art. 6(1)(c) GDPR – Legal obligation: processing is required to comply with applicable laws (e.g. tax retention obligations under German commercial and tax law).
Art. 6(1)(a) GDPR – Consent: where you have expressly given your consent, e.g. for newsletter subscription.
Art. 6(1)(f) GDPR – Legitimate interests: e.g. for website security and fraud prevention (Wordfence).

5. Shop System – WooCommerce & Germanized

Our online shop is built on WooCommerce, a plugin for WordPress. We additionally use Germanized for WooCommerce (by vendidero) to ensure legal compliance with German e-commerce law.

Germanized provides legally required features including:

Display of legally required product information (e.g. unit prices, delivery times, total prices)
Generation of legal documents (cancellation policy, terms & conditions, imprint) within the order process
PDF invoice and delivery note generation
DHL integration for shipping labels (via Shiptastic)
One-Stop-Shop (OSS) tax compliance for cross-border EU sales
Legally compliant email footer content (via Germanized email integration)

The data processed through WooCommerce and Germanized (name, address, order data) is used exclusively to process and fulfil your order. The legal basis is Art. 6(1)(b) GDPR.

6. Right of Withdrawal / Withdrawal Function (§ 356a BGB)

As a consumer within the European Union, you have the right to withdraw from your purchase within 14 days without giving any reason.

Withdrawal function (§ 356a BGB): In accordance with § 356a BGB and EU Directive 2023/2673, we provide a withdrawal function (“Withdraw from contract”) accessible at the bottom of every page on our website (https://musa-vaporizer.com/de/withdraw-from-contract/). By using this function, you can initiate and confirm your withdrawal digitally in two steps without contacting us separately. You will receive an automatic email confirmation immediately upon submission, including the date and time of receipt.

When you exercise your right of withdrawal via the withdrawal function or any other means, we process the following personal data associated with your order: name, order number, delivery address, and email address.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (compliance with a legal obligation).

Retention period: Withdrawal-related data is retained for 10 years in accordance with German commercial and tax law (§ 147 AO, § 257 HGB), unless a shorter retention period applies.

The full Withdrawal Policy (Widerrufsbelehrung) is available separately on our website: https://www.musa-vaporizer.com/withdrawal-policy

7. Payment Processing

We currently offer the following payment methods in our shop:

Bank Transfer / SEPA

If you choose to pay by bank transfer or SEPA direct debit, your bank account details (IBAN, account holder name) will be transmitted to your bank to process the payment. No data is passed to third-party payment processors by us in this case.

Google Pay

If Google Pay is available and selected, payment is processed via Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may process and store your payment data according to their Privacy Policy: https://policies.google.com/privacy. A data processing agreement and applicable Standard Contractual Clauses are in place.

Amazon Pay

If Amazon Pay is available and selected, payment is processed via Amazon Payments Europe S.C.A., 5 Rue Plaetis, L-2338 Luxembourg. Amazon may process and store payment data according to their Privacy Policy: https://pay.amazon.com/help/201212430. Standard Contractual Clauses apply for any data transfers outside the EU.

We do not store full payment data ourselves. All payment processing is handled securely by the respective payment providers. The legal basis for payment data processing is Art. 6(1)(b) GDPR.

8. Shipping & Delivery

DHL

We ship our products via DHL (Deutsche Post DHL Group, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany). To fulfill your delivery, we transmit your name, delivery address, and where applicable your email address and phone number to DHL. DHL uses this data exclusively to deliver your parcel and may send you shipping notifications.

We also use Germanized for WooCommerce – Shiptastic with DHL integration to generate shipping labels. Your order data is transmitted to DHL’s API for this purpose.

International Shipping

We also ship internationally, including to countries outside the European Union (e.g. Switzerland, United Kingdom, USA, and others). For international shipments, your delivery data will be transferred to the relevant postal or customs authorities as required by law, and to DHL’s international partner networks. Such transfers are necessary for the performance of your order contract (Art. 6(1)(b) GDPR). Where applicable, Standard Contractual Clauses or other recognised safeguards apply.

Shipment Tracking

We use Advanced Shipment Tracking for WooCommerce to provide you with tracking information for your orders. Your order data and tracking number are used to display shipment status in your customer account and in automated email notifications. The legal basis is Art. 6(1)(b) GDPR.

9. Automatic Account Creation

When you place an order as a guest, our system automatically creates a customer account in the background. This account stores your order details, facilitates future purchases, and allows you to view your order history.

For this purpose, we process the personal data you provide during checkout (name, billing/shipping address, email address). The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

You can log in to your account using your email address and set a password via the “Forgot Password” function. You may also delete your account at any time via your profile settings or by contacting us. Please note that certain data must be retained due to statutory obligations (e.g. tax or commercial law).

10. PDF Invoices & Packing Slips

We use the plugin WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels (by WebToffee) and/or PDF Invoices & Packing Slips for WooCommerce (by WP Overnight) to automatically generate PDF invoices and packing slips for your orders.

Your order data (name, address, ordered items, price) is used to generate these documents. PDFs are attached to your order confirmation email and stored on our server for the legally required retention period. The legal basis is Art. 6(1)(b) and Art. 6(1)(c) GDPR.

11. Newsletter

You will only receive our newsletter if you have actively subscribed (double opt-in). You can unsubscribe at any time by clicking the unsubscribe link in any newsletter email or by contacting us at info@musa-vaporizer.com.

We use the Newsletter Plugin by Stefano Lissa to manage and send email newsletters. A data processing agreement in accordance with Art. 28 GDPR has been concluded with this provider. Your email address and subscription preferences are stored for this purpose. The legal basis is Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time.

12. Hosting & Technical Platform

Our website is hosted by Hostinger (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus). We use WordPress as our content management system and WooCommerce as our shop platform.

The hosting provider may automatically store server log files, including IP addresses, browser type, access time, and accessed pages, for security and operational reasons. A data processing agreement in accordance with Art. 28 GDPR has been concluded with Hostinger. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of our website).

LiteSpeed Cache

We use the LiteSpeed Cache plugin to improve website performance. It may process and store cached versions of web pages and associated technical data (including IP addresses for rate-limiting purposes) on our server. No data is transmitted to third parties. The legal basis is Art. 6(1)(f) GDPR.

13. Website Security – Wordfence

We use the Wordfence Security plugin (provider: Defiant Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA) to protect our website against cyberattacks, malware, and unauthorised access.

Data processed:

IP addresses of visitors
Details of login attempts and suspicious activities
Security log entries

Security data may be compared against Defiant’s databases, which may involve a transfer of data (e.g. IP addresses) to servers in the USA. Defiant relies on EU Standard Contractual Clauses (SCCs) to ensure an adequate level of data protection. The legal basis for Wordfence is Art. 6(1)(f) GDPR (legitimate interest in website security). Further information: https://www.wordfence.com/help/general-data-protection-regulation/

WPS Hide Login

We use the WPS Hide Login plugin to change the default WordPress login URL as an additional security measure. This plugin does not process or transmit any personal data.

14. Website Analytics – Independent Analytics

We use Independent Analytics, a privacy-friendly analytics tool that runs entirely on our own server without relying on external services. This tool helps us understand how visitors interact with our website, such as which pages are most visited and where traffic originates.

Independent Analytics does not use cookies, does not store any personally identifiable information, and does not transmit data to third parties. All statistical data is collected anonymously and stored exclusively on our own server. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding website usage to improve our services).

15. Cookies & Consent Management – Complianz

Our website uses cookies. We use Complianz GDPR/CCPA Cookie Consent (by Complianz B.V., Kalmarweg 14-5, 9723 JG Groningen, Netherlands) as our cookie consent management tool.

Complianz records and manages your cookie consent preferences. It stores a cookie on your device to remember your consent choice. No sensitive personal data is transmitted to external servers beyond what is technically necessary. A data processing agreement in accordance with Art. 28 GDPR is in place. The legal basis for consent management is Art. 6(1)(c) GDPR (legal obligation to document consent) and Art. 6(1)(f) GDPR.

Full details about the cookies we use and how to manage your preferences are set out in our separate Cookie Policy, which is accessible via the cookie banner and footer of our website.

16. Embedded Videos

YouTube

Our website may integrate videos from YouTube (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you visit a page containing a YouTube video, a connection to YouTube’s servers may be established, which can transmit your IP address and the page you visited to YouTube/Google. If you are logged into a Google account, this data may be linked to your profile.

We use YouTube in privacy-enhanced mode where possible. Videos are only loaded after you grant consent via our cookie consent tool. The legal basis is Art. 6(1)(a) GDPR (consent). For more information: https://policies.google.com/privacy

Vimeo

Our website may also integrate videos from Vimeo (Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA). When a page with a Vimeo video is visited, data such as your IP address, browser information, and the accessed page may be transmitted to Vimeo’s servers in the USA.

Videos are only loaded after you grant consent via our cookie consent tool. The legal basis is Art. 6(1)(a) GDPR (consent). For international data transfers, Standard Contractual Clauses or the EU-U.S. Data Privacy Framework apply. For more information: https://vimeo.com/privacy

17. SEO & Multilingual Tools

Yoast SEO

We use the Yoast SEO plugin (provider: Yoast BV, Don Emanuelstraat 3, 6602 GX Wijchen, Netherlands) to optimise our website for search engines. Yoast SEO processes page content and metadata to generate SEO-relevant output (e.g. title tags, meta descriptions, structured data). It does not collect personal data from visitors. The legal basis is Art. 6(1)(f) GDPR.

TranslatePress

Our website is available in multiple languages (English and German). We use TranslatePress – Multilingual to manage translations. Language preferences may be stored in a cookie on your device. No personal data is transmitted to external servers for translation purposes. The legal basis is Art. 6(1)(f) GDPR.

18. Customer Reviews

After completing a purchase, we may send you an email inviting you to leave a review of the products you ordered. We use the plugin Customer Reviews for WooCommerce for this purpose. The email invitation is sent to the email address associated with your order.

Receiving such a review request is part of our customer service and is based on Art. 6(1)(f) GDPR (legitimate interest in improving our services and helping other customers make informed decisions). You are never obligated to submit a review. You may object to receiving review requests at any time by contacting us at info@musa-vaporizer.com.

19. Backups – UpdraftPlus

We use the UpdraftPlus Backup/Restore plugin to create regular backups of our website and database. Backups may be stored on our server or in a remote storage location (e.g. cloud service). Backup files may contain personal data (such as customer order data) that is stored within our WooCommerce database.

Backups are only used for the purpose of website recovery and are protected with appropriate technical security measures. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in data integrity and business continuity).

20. Data Sharing with Third Parties

We only share your personal data with third parties when necessary. The following categories of recipients may receive your data:

Shipping providers (DHL) – for delivery of your order
Payment providers (Bank/SEPA, Google Pay, Amazon Pay) – for payment processing
Tax consultants or public authorities – where legally required
Hosting provider (Hostinger) – for website operation
Backup storage providers – for website recovery (UpdraftPlus)

We do not sell, rent, or share your personal data for marketing purposes. All third-party processors are bound by data processing agreements and applicable data protection law.

21. International Data Transfers

Some of the services we use may transfer personal data to countries outside the European Economic Area (EEA), including the USA. In such cases, we ensure appropriate safeguards are in place in accordance with Chapter V GDPR, including:

EU Standard Contractual Clauses (SCCs) approved by the European Commission
The EU-U.S. Data Privacy Framework (where the provider is certified)
Other legally recognised transfer mechanisms

Affected service providers include: Google (YouTube / Google Pay), Vimeo, Defiant Inc. (Wordfence), and potentially UpdraftPlus remote storage.

22. Data Retention

We store your data only for as long as necessary:

Order and tax-related data: 6–10 years (mandatory statutory retention periods under German tax and commercial law)
Newsletter subscription data: until you unsubscribe
Customer account data: until account deletion, subject to statutory retention obligations
Server logs and technical data: as required for security and operational purposes (typically up to 30 days)

23. Your Rights Under the GDPR

As a data subject, you have the following rights under the GDPR:

Right of access (Art. 15 GDPR) – You have the right to obtain a copy of the personal data we hold about you.
Right to rectification (Art. 16 GDPR) – You can request correction of inaccurate data.
Right to erasure (Art. 17 GDPR) – You can request deletion of your data, subject to legal retention obligations.
Right to restriction of processing (Art. 18 GDPR) – You can request that we limit the processing of your data.
Right to data portability (Art. 20 GDPR) – You can request your data in a structured, machine-readable format.
Right to object (Art. 21 GDPR) – You can object to processing based on legitimate interests (Art. 6(1)(f) GDPR).
Right to withdraw consent (Art. 7(3) GDPR) – Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right to lodge a complaint – You have the right to lodge a complaint with your national supervisory authority. In Germany: the data protection authority of the state in which you reside.

To exercise your rights, please contact us at: info@musa-vaporizer.com

24. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or the tools and services we use. The current version is always available on our website. We recommend checking this page periodically.

25. Contact

If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us: