Data protection

Privacy Policy

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1 We are pleased that you are interested in our website. Below we inform you about the handling of personal data when using our website. Personal data means any information relating to an identified or identifiable natural person.

1.2 The controller within the meaning of the GDPR is:
Touda Artisans
Lot el Maarij No 4
23000 Beni Mellal
Morocco

WhatsApp Business: +212 639-278143
Phone: +212 (0)648-729686

1.3 For security reasons, this website uses SSL/TLS encryption. You can recognize an encrypted connection by “https://” and the lock symbol in your browser bar.

2) Data Collection When Visiting Our Website (Server Log Files)

When you use our website for informational purposes only, we collect only the data that your browser transmits to our server (server log files): visited page, date/time, transferred data volume, referrer URL, browser type, operating system, IP address (possibly anonymized).
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stability and security of the website). Data will only be shared if legally required or for enforcement purposes.

3) Cookies & Consent Management

We use cookies. Essential cookies are necessary for the operation of the site (Art. 6(1)(f) GDPR). For all non-essential cookies (e.g., analytics/marketing), we obtain your consent via a consent banner (Art. 6(1)(a) GDPR).

You can change or withdraw your consent at any time through the banner with effect for the future. You may also manage/delete cookies in your browser settings. If cookies are declined, some site functions may be limited.

Links to browser guides:

  • Edge/IE: support.microsoft.com

  • Firefox: support.mozilla.org

  • Chrome: support.google.com/chrome

  • Safari: support.apple.com

  • Opera: help.opera.com

(Note: The consent banner specifies the tools, providers, retention periods, and purposes in detail.)

4) Contact

If you contact us by e-mail, WhatsApp, or contact form, we process the data you provide to handle your inquiry (Art. 6(1)(f) GDPR; if related to contract performance, Art. 6(1)(b) GDPR). Data will be deleted once your request is fully resolved unless legal retention obligations apply.

5) Customer Accounts & Contract Fulfillment

When placing orders or creating a customer account, we process the necessary data to fulfill the contract (Art. 6(1)(b) GDPR). After contract fulfillment, data is restricted until the end of statutory retention periods and deleted thereafter, unless further consent has been given.

6) Shipping, Payment Processing & Processors

Shipping providers: To deliver orders, we transmit name, delivery address, and contact details (email/phone) to the respective carrier (e.g., DHL Express, Aramex) as necessary (Art. 6(1)(b) GDPR).

Payment services: When using a payment service, we process the required payment data; each provider acts as its own controller.

  • PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg: processing according to PayPal’s terms; in some cases, credit checks may be carried out (Art. 6(1)(f) GDPR by PayPal).

(Additional providers such as credit card or Shop Pay will be listed once reactivated.)

Transfers to third countries: Shipping and support may involve transfers outside the EU/EEA (e.g., Morocco). Where necessary, we use safeguards under Art. 46 GDPR (Standard Contractual Clauses) or rely on Art. 49 GDPR (e.g., contract performance), limited to what is strictly necessary.

7) Personalization / Image Files (if offered)

Uploaded images are processed solely to fulfill custom orders (Art. 6(1)(b) GDPR) and deleted once the order is completed. Sharing with artisan families (e.g., weavers) occurs only if necessary for performance of the contract.

8) Direct Marketing (optional)

8.1 Newsletter – Sent only after double opt-in (Art. 6(1)(a) GDPR). Subscription details (opt-in, IP, timestamp) are logged (Art. 6(1)(c/f) GDPR). Unsubscribe at any time.

8.2 Stock availability notifications – One-time email after prior consent (Art. 6(1)(a) GDPR); revocable at any time.

9) Web Analytics & Marketing (with Consent Only)

9.1 Google Analytics (GA4)
Provider: Google Ireland Limited. Used only with consent (Art. 6(1)(a) GDPR). IP anonymization is enabled; we have signed a data processing agreement. Data may be transferred to Google LLC (USA). Safeguards: Standard Contractual Clauses and, where applicable, EU-US Data Privacy Framework. Consent can be withdrawn at any time via the banner.

9.2 Meta (Facebook) Pixel (if activated)
Provider: Meta Platforms Ireland Ltd. Used only with consent (Art. 6(1)(a) GDPR) for reach and conversion tracking. Data may be transferred to Meta Platforms, Inc. (USA). Safeguards as above; consent may be withdrawn at any time.

10) Live Chat (optional)

Provider: CuteSoft Components Inc., Canada (“mylivechat”), if enabled. Processing for support/customer care (Art. 6(1)(f) GDPR) or with consent if cookies/tracking are required (Art. 6(1)(a) GDPR). Canada has an adequacy decision for commercial providers. Opt-out possible at any time.

11) Google reCAPTCHA (Abuse Prevention)

We use reCAPTCHA (Google Ireland Limited) to protect forms from automated misuse (Art. 6(1)(f) GDPR). Data may be transferred to Google LLC (USA). Details can be found in Google’s privacy policy. Use only as necessary; consent obtained where technically integrated via banner.

12) Google Customer Reviews (optional)

If we participate in the program, you may be asked for consent (Art. 6(1)(a) GDPR) to receive a follow-up rating email from Google. Data may be transferred to Google LLC (USA) under appropriate safeguards. Consent may be withdrawn at any time.

13) Rights of Data Subjects

You have the following rights under GDPR (where conditions apply):

  • Right of access (Art. 15 GDPR)

  • Rectification (Art. 16 GDPR)

  • Erasure (Art. 17 GDPR)

  • Restriction of processing (Art. 18 GDPR)

  • Data portability (Art. 20 GDPR)

  • Withdrawal of consent (Art. 7(3) GDPR)

  • Complaint with a supervisory authority (Art. 77 GDPR) in your country of residence, workplace, or alleged violation in the EU.

Right to Object (Art. 21 GDPR): You may object at any time to processing based on Art. 6(1)(f) GDPR for reasons relating to your particular situation. For direct marketing, you have an unconditional right to object; in such case, your data will no longer be used for that purpose.

14) Data Retention

We store personal data only as long as necessary for the purposes or where legal obligations exist. For consent-based processing, data is stored until withdrawal; for contractual/tax obligations, until the relevant retention periods expire; thereafter, deletion or restriction applies.

15) International Data Transfers

As our company is based in Morocco and we use international service providers, data transfers to third countries may occur. Where no adequacy decision by the EU Commission exists, we use Standard Contractual Clauses (Art. 46 GDPR) and apply additional safeguards. In exceptional cases, transfers may rely on Art. 49 GDPR (e.g., contract performance for overseas delivery). Details of recipients, countries, and safeguards are available in the consent banner or upon request via info@touda.de

Hier Widerruf starten und Formular ausfüllen

Bitte prüft eure Angaben einmal sorgsam, bevor ihr sie absendet!

EU Widerrufsbutton logo EU Withdrawal Button