Privacy Policy
As of: August 16, 2026
Protecting your personal data is important to us. This Privacy Policy informs you which personal data are processed when using rosylabdiamonds.com, the purposes for which this is done, the legal basis for the processing, and the rights to which you are entitled under applicable data protection regulations.
1. Controller
The controller responsible for processing personal data on this website is:
Birgie GmbH
Sonnige Höhe 11
44894 Bochum
Germany
Telephone: +49 162 516 65 34
Email: info@rosylabdiamonds.com
2. General principles and legal bases
Personal data means any information relating to an identified or identifiable natural person.
We process personal data only where there is a legal basis for doing so. Depending on the processing, we rely in particular on the following legal bases:
- Article 6(1)(a) GDPR – your consent,
- Article 6(1)(b) GDPR – performance of a contract or pre-contractual measures,
- Article 6(1)(c) GDPR – compliance with legal obligations,
- Article 6(1)(f) GDPR – our legitimate interests or the legitimate interests of third parties.
Where information is stored on or read from your device, we also comply with the statutory requirements of the Telecommunications and Digital Services Data Protection Act (TDDDG).
3. What data we process
Depending on how you use our website and services, the following categories of personal data in particular may be processed:
- Contact and master data: Name, address, email address, and telephone number.
- Order and contract data: Products ordered, billing and delivery addresses, order history, returns, exchanges, complaints, and other contract-related information.
- Payment data: Information required to process your chosen payment method.
- Customer account data: Information required to set up and manage your customer account.
- Rosy Club data: Rosy Points, points activity, redeemed benefits, referrals, bonus activities, and—if voluntarily provided by you—information for birthday rewards.
- Communication data: Contents of inquiries, emails, messages, complaints, and other communications with us.
- Usage and device data: for example, IP address, browser type, operating system, device information, date and time of access, and pages visited.
- Marketing data: Newsletter subscriptions, marketing consents, and information about interactions with our marketing activities, insofar as legally permissible.
4. Visiting Our Website
When you access our website, technically necessary data is processed so that the website can be provided securely, stably, and properly. This may include, in particular, your IP address, the date and time of access, browser and device information, and technical log data.
The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the secure and technically error-free provision of our online store.
5. Shopify
Our online store is operated using the Shopify e-commerce platform. Shopify supports us, among other things, with the technical provision of the store, order processing, management of customer accounts, and other store functions.
Where Shopify processes personal customer data on our behalf, this is carried out within the scope of the agreed data processing arrangement. For certain independent or advanced Shopify services, Shopify may also process personal data under its own responsibility for data protection purposes.
Further information about Shopify's processing of personal data can be found in the Shopify Consumer Privacy Policy:
Shopify Consumer Privacy Policy
If Shopify Network Intelligence or comparable advanced Shopify services are enabled in our store, Shopify may also process information about your interactions with our store, for example to personalize services, measure advertising performance, or provide relevant content. Where consent is required for this, such processing will only take place after you have given your consent.
Further privacy options from Shopify can be found at:
6. Orders and Contract Fulfillment
When you place an order with us, we process the personal data required to process and fulfill your order. This includes, in particular, contact, delivery, billing, order, and payment information.
The processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR for the performance of the contract concluded with you.
Where we are legally required to retain certain business and tax records, further storage is carried out on the basis of Art. 6 para. 1 lit. c GDPR.
7. Payment Processing
To process your payment, personal data may be transmitted to the payment service provider you select at checkout.
The payment methods currently available will be shown to you during the ordering process. The processing of the data required to process the payment is carried out on the basis of Art. 6 para. 1 lit. b GDPR.
The privacy policies of the respective payment service provider also apply to its independent processing of personal data.
8. Shipping and Delivery
To fulfill your order, we transmit the data required for delivery to the shipping or logistics company used in each case. This includes, in particular, your name and delivery address and, where applicable, other contact details required for delivery.
Processing is based on Art. 6(1)(b) GDPR.
9. Customer Account
When you create or use a customer account, we process the personal data required to set up, manage, and use the account.
Processing is based on Art. 6(1)(b) GDPR insofar as it serves the use of your customer account and the performance of our contractual relationship.
You may request the deletion of your customer account unless statutory retention obligations or other legitimate reasons prevent deletion.
10. Rosy Club and Smile.io
For our customer loyalty program “Rosy Club,” we use Smile.io. The program enables you, in particular, to collect and redeem Rosy Points, referral rewards, and other loyalty benefits.
As part of the Rosy Club, the following data in particular may be processed:
- First and last name,
- Email address,
- Customer and account ID,
- IP address,
- Date the customer account was created,
- Order and transaction information,
- Point balance and activities in the loyalty program,
- Referral information,
- Month and day of birth, if you voluntarily provide these details for the birthday bonus.
Smile.io processes this data on our behalf to provide and manage the loyalty program.
Processing is based on Art. 6(1)(b) GDPR insofar as it serves the use of the customer and loyalty program you use. Where optional additional functions are based on consent, processing is based on Art. 6(1)(a) GDPR.
Further information can be found in Smile.io’s privacy notice:
11. Contact and Customer Service
If you contact us by email, contact form, or other means, we process the information you provide in order to handle your inquiry.
If your inquiry relates to an existing or future contract, processing is based on Art. 6(1)(b) GDPR. In other cases, it is based on Art. 6(1)(f) GDPR due to our legitimate interest in processing your inquiry efficiently.
12. Newsletter and Electronic Advertising
If you subscribe to our newsletter or other electronic promotional communications, we use your email address and, where applicable, other data you voluntarily provide to send you news, offers, and information about Rosy Lab Diamonds.
Processing is generally based on your consent pursuant to Art. 6(1)(a) GDPR.
You can withdraw your consent at any time with effect for the future, particularly via the unsubscribe link in our marketing emails.
Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
13. Cookies and Similar Technologies
Our website uses cookies and similar technologies. Some of these are technically necessary for the shop and its basic functions to work properly.
Technically necessary technologies may be used without consent if the statutory requirements are met.
As a general rule, we use non-essential cookies and similar technologies, particularly for analytics, personalization, or marketing purposes, only if you have previously given your consent.
The storage of information on your device or access to information already stored is governed by Section 25 TDDDG. The subsequent processing of personal data is based on Art. 6(1)(a) GDPR insofar as it relies on consent.
You can manage your choices via the privacy settings offered on our website or the cookie banner and change or withdraw consent you have given at any time with effect for the future.
14. Analytics, Marketing, and Advertising
If we use analytics, marketing, or advertising technologies, information about your use of our shop may be processed, such as pages viewed, product interactions, device information, technical identifiers, or information about the source of a website visit.
As a general rule, such non-essential technologies are activated for visitors for whom consent is legally required only after the corresponding consent has been given.
In these cases, processing is based on Art. 6(1)(a) GDPR. You can withdraw your consent at any time via our privacy settings.
15. Recipients and Service Providers
We only disclose personal data when this is legally permissible or necessary to provide our services.
Recipients may include:
- Shopify and service providers affiliated with Shopify,
- Smile.io for the Rosy Club,
- Payment service providers,
- Shipping and logistics companies,
- IT, hosting, and security service providers,
- Communication and email service providers,
- Analytics and marketing service providers, where their use is permitted and, where applicable, you have provided your consent,
- Authorities or other public bodies, where we are legally required to disclose the data.
Where service providers process personal data exclusively on our behalf, they are engaged as processors in accordance with data protection requirements.
16. Transfers to third countries
Some companies used by us or our service providers operate internationally. Therefore, personal data may be processed outside the European Economic Area.
Where the European Commission has not issued an adequacy decision for a recipient country, we ensure an adequate level of data protection, where required, through appropriate safeguards pursuant to Art. 44 et seq. GDPR, such as standard contractual clauses approved by the European Commission or other legally recognized protection mechanisms.
17. Retention period
We store personal data only for as long as necessary for the respective processing purpose or as required by statutory retention obligations.
Contract and order data may continue to be stored after the contract has been completed, in particular due to statutory retention obligations under commercial and tax law.
Data processed solely on the basis of your consent will generally be processed until you withdraw your consent or the respective purpose no longer applies, unless another legal basis permits further storage.
After the applicable retention period has expired, personal data will be deleted or anonymized unless another legal basis for its processing exists.
18. Data security
We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration, and unauthorized disclosure.
Please note, however, that no transfer or storage of data can be completely protected against all risks.
19. Your data protection rights
Subject to the statutory requirements, you have, in particular, the following rights:
- Access to the personal data we process pursuant to Art. 15 GDPR,
- Rectification of inaccurate or incomplete personal data pursuant to Art. 16 GDPR,
- Erasure of your personal data in accordance with Article 17 GDPR, unless there are legal grounds for further processing,
- Restriction of processing in accordance with Article 18 GDPR,
- Data portability in accordance with Article 20 GDPR, where the statutory requirements are met,
- Objection to processing based on Article 6(1)(e) or (f) GDPR in accordance with Article 21 GDPR,
- Objection to direct marketing at any time and without providing reasons,
- Withdrawal of consent at any time with effect for the future in accordance with Article 7(3) GDPR.
To exercise your rights, you can contact us at the following address:
We may request additional information if we have reasonable doubts about your identity, as necessary to confirm your identity.
20. Right to Lodge a Complaint with a Data Protection Supervisory Authority
Under Article 77 of the GDPR, you have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.
In particular, you may contact the data protection supervisory authority at your usual place of residence, your workplace, or the place of the alleged data protection violation.
21. Children's Data
Our services are not specifically aimed at children. We do not intend to knowingly process children's personal data where the consent of a legal guardian would be required under applicable data protection regulations.
If, as a parent or legal guardian, you believe that such data was transmitted to us without the required consent, please contact us at info@rosylabdiamonds.com.
22. Third-Party Websites and Links
Our website may contain links to third-party websites, services, or platforms. We are generally not responsible for the privacy practices of these external providers.
If you use external links, we recommend that you read the applicable privacy information provided by the respective provider.
23. Changes to this Privacy Policy
We may amend this Privacy Policy if our data processing activities, the services we use, or legal requirements change.
The current version is published on this website. The update date stated above indicates when this Privacy Policy was last revised.
24. Contact
If you have any questions about this Privacy Policy or the processing of your personal data, please contact us:
Birgie GmbH
Sonnige Höhe 11
44894 Bochum
Germany
Telephone: +49 162 516 65 34
Email: info@rosylabdiamonds.com