Privacy policy

1. Controller

The party responsible for processing personal data in the Sleekly online store at https://sleekly.shop is:

Kwefi Ecom LLC
5830 E 2nd St, Ste 7000 #18399
Casper, WY 82609
USA
Email: info@sleekly.shop

You can also reach us through our contact form.

2. Store platform and hosting (Shopify)

Our store runs on the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify Inc. (Canada/USA) is also involved in the processing. Shopify stores and processes the data that arises in our store (visit, order, customer account, contact form, newsletter). As a rule, Shopify processes this data on our behalf (Art. 28 of the EU General Data Protection Regulation, GDPR). Shopify itself is responsible for Shop Pay (see section 5, Payment).

3. Visiting the website

When you open our website, Shopify automatically processes technical data that your browser sends, for example your IP address, the date and time of access, the page you open, the page you visited before, your browser type and operating system. This is needed to show you the website and to run it in a stable and secure way.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is providing the store securely and in working order. The data is deleted as soon as it is no longer needed for this purpose.

Necessary cookies

For basic functions such as the cart, checkout, customer account and saving your cookie choice, the store uses technically necessary cookies and similar technologies. The legal basis is Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(b) and (f) GDPR (carrying out your purchase, legitimate interest in a working store).

4. Cookie banner and consent

On your first visit, our cookie banner (from Shopify) asks whether you consent to cookies and similar technologies that are not necessary. We do not use them without your consent. Your choice is saved in a cookie so that the banner does not appear on every page view and so that we can prove your consent (Section 25(2) No. 2 TDDDG, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR).

You can withdraw your consent at any time with effect for the future. To do so, delete this website’s cookies in your browser. On your next visit, the banner appears again and you can choose again.

5. Orders

When you order, we process the details from the checkout: your name, shipping and billing address, email address, your phone number if you choose to give it, the products ordered and their prices, and payment details. We use them to conclude and perform the contract, that is, for the order confirmation, shipping, payment, customer service, withdrawal and the guarantee. Shopify sends the order confirmation and other emails about your order for us.

The legal basis is Art. 6(1)(b) GDPR. We need the details marked as required fields in the checkout for the contract. Without them, we cannot accept your order.

Payment

You can pay by credit card (Visa, Mastercard, American Express, Discover, Diners Club), Shop Pay, Apple Pay, Google Pay or PayPal. Card payments run through Shopify Payments; the card data is processed by Shopify’s payment partners. With Shop Pay, Apple Pay, Google Pay and PayPal, the provider concerned receives the data needed for the payment, for example the amount and payment details, and also processes it under its own responsibility in line with its privacy policy. The legal basis is Art. 6(1)(b) GDPR.

Shipping through TeemDrop

We have orders packed and shipped by the fulfillment service TeemDrop, which we use through the Shopify app “TeemDrop-Dropshipping.” For this, TeemDrop receives your order and delivery details (for example your name, shipping address and the products ordered). The shipping company that delivers your package also receives your name and shipping address. The legal basis is Art. 6(1)(b) GDPR.

Withdrawal using “Cancel your order”

If you withdraw using the “Cancel your order” button, we process your name, your order number, your email address and the date and time of receipt, and we send you a confirmation of receipt by email. This function is provided by the app “EU Widerrufsbutton Pro” from Visionz GmbH, Richthofenstr. 29, 31137 Hildesheim, Germany, which processes the data on our behalf and also sends the confirmation of receipt by email. If you withdraw by email or letter, we process the details from your message. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code (BGB), and Art. 6(1)(b) GDPR.

60-day guarantee

If you use our 60-day guarantee, we store your name, your delivery address, the order number and the fact that the guarantee was used, so that we can check the “once per person and delivery address” condition (Art. 6(1)(b) GDPR).

6. Customer account

At checkout, you can use a customer account. It stores your name, your email address, your addresses and your orders, so that you can view your orders and order faster. The legal basis is Art. 6(1)(b) GDPR. The account remains until you ask us to delete it; a simple message to us is enough. Data we are required to keep remains stored until the end of the retention period (see section 12).

7. Contact form and email

If you write to us through the contact form or by email, we process your details to answer your request. In the contact form, these are your name, email address, topic, message and, if you give it, your order number. Messages from the form reach us by email through Shopify.

The legal basis is Art. 6(1)(b) GDPR if your request concerns an order, the guarantee or a contract, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering requests). We delete the data once your request has been dealt with, unless there is a legal obligation to keep it.

Spam protection (hCaptcha)

Shopify protects the contact form, the newsletter sign-up and the customer account forms against spam and automated access with the hCaptcha service of Intuition Machines, Inc. (USA). When you submit a form, technical data such as your IP address, browser data and your behavior on the page is sent to hCaptcha and analyzed there to tell humans from bots. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting the store and its forms against misuse.

8. Sleekly Nail Challenge

If you enter the "Sleekly Nail Challenge" (sleekly.shop/pages/challenge), we process the details from the entry form: first name, email address, your video, optionally your Instagram name and order number, your confirmations in the form, and the time of your entry. First name, email address, and video are needed to enter. We use your Instagram name to name or tag you if you agreed to us showing your video and your name; the order number only to match questions about your order. Neither affects the choice of winner. We use these details to run the challenge under its official rules: to check and choose entries, contact you, and send prizes and codes.

We only show your video on our website, on social media, and in ads if you agreed to this in the form, and always with a note that it comes from the challenge. Agreeing is not required to enter, to get a code, or to win. Videos we publish can be seen by anyone and are also processed by the platforms where we show them (for example Meta). We only name you if you agree. You can withdraw your consent at any time for the future; we then stop using the video and delete it.

The form is provided by Google Forms. To upload your video, you sign in with your Google account; Google records the name, email address and profile photo of that account with your entry. The video is stored in our Google Drive and the other details in a Google Sheets spreadsheet. The provider is Google LLC, USA, which processes the data for us as part of Google Workspace.

We delete the details of entries that did not win no later than three months after the round ends. Videos you allowed us to show are kept until you withdraw your consent or we stop using them. We keep the record of your consent while we use the video and for three years after. Details about prizes and codes are kept as long as the law requires.

9. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about our products and offers. Sign-up uses the double opt-in process: you receive an email with a confirmation link and are added only after you confirm. We store the time of your sign-up and of your confirmation so that we can prove your consent. Sending and management are handled through Shopify (the “Messaging” app).

The legal basis is your consent (Art. 6(1)(a) GDPR) and, for proving the consent, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. You can unsubscribe from the newsletter at any time, using the unsubscribe link in every newsletter email or by sending us a message. After that, we no longer use your email address for the newsletter and keep only what we need to prove your earlier consent.

10. Meta Pixel and Conversions API (only with consent)

If you consent in the cookie banner, we use the Meta Pixel and the Conversions API from Meta (Facebook and Instagram), connected through the Shopify app “Facebook & Instagram.” With them, we measure how well our advertising on Facebook and Instagram works, and we can show you relevant ads there.

The pixel stores cookies on your device and sends data from your browser to Meta, for example your IP address, browser data, the pages you view and actions in the store such as product views, add-to-cart and purchases with the order value. Through the Conversions API, such events are also sent to Meta directly from server to server. In the process, contact details from your order, such as your email address, can also be sent as a hash value (pseudonymized). Meta matches this value against the data of its users. Meta can link the data sent to your Facebook or Instagram account.

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Without your consent, we use neither the pixel nor the Conversions API. You can withdraw your consent at any time with effect for the future (see section 4). If you visit us from the United States, there is no cookie banner: the pixel and the Conversions API run when you visit, and you can opt out at any time with the “Your privacy choices” link at the bottom of every page.

We are jointly responsible with Meta for collecting the data and sending it to Meta (Art. 26 GDPR). Meta alone is responsible for the further processing. You can exercise your rights with both us and Meta (Art. 26(3) GDPR).

11. Transfers to third countries

We are a company based in the USA and have no establishment in the EU. Your data is therefore also processed by us in the USA. The GDPR applies to this processing because we sell goods to consumers in Germany (Art. 3(2)(a) GDPR).

Some of the providers named above also process data outside the EU, in particular Shopify (Canada and USA), hCaptcha (USA) and Google (USA, spreadsheet of the challenge entries). For Canada, there is an adequacy decision of the European Commission. Where the recipient is certified under the EU-US Data Privacy Framework, transfers to the USA are based on the European Commission’s adequacy decision of July 10, 2023 (Art. 45 GDPR).

12. Storage period

We store personal data only as long as it is needed for the purpose concerned or as long as your consent is in place. We store data that we must keep under commercial and tax law, for example orders, invoices, accounting records and business letters, for the statutory retention periods of up to ten years (Art. 6(1)(c) GDPR). During this time, we use it only to meet this obligation.

13. Your rights

You have the right to:

• information about your stored data (Art. 15 GDPR)
• correction of incorrect data (Art. 16 GDPR)
• deletion (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR, see below)
• withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of the processing carried out until then

To do so, write to us at info@sleekly.shop.

Right to object

Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you can object to this at any time on grounds relating to your particular situation. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. You can object to the processing of your data for direct marketing at any time without giving reasons.

Right to complain

You have the right to complain to a data protection supervisory authority, in particular in the EU member state where you usually live, where you work or where the alleged violation took place (Art. 77 GDPR).

Last updated: November 2026