Privacy Policy

We appreciate your interest in our website. The protection of your privacy is very important to us. Below, we provide detailed information about how we handle your personal data.

The Green Edge UG (limited liability)
Schliemannstr. 25A
10437 Berlin
Germany
Email: support@affairsofchemistry.com
Phone: +49 (0)30 91488839

Our website is hosted on the Shopify platform. The provider is:

Shopify International Ltd.
2nd Floor, 1-2 Victoria Buildings,
Haddington Road, Dublin 4,
D04 XN32, Ireland

Shopify provides the infrastructure for our online shop. In doing so, Shopify processes the following personal data, among others:

• Name

• Address

• Email address

• Phone number (optional)

• IP address

• Payment information

• Order information

• Technical browser and device data

Shopify also processes data outside the EU/EEA, in particular at its parent company Shopify Inc. in Canada and in other countries where Shopify, its affiliates or service providers are located (e.g. Singapore, USA). Shopify bases transfers within the Shopify group on its Binding Corporate Rules approved by the European data protection authorities (Art. 47 GDPR) and, for Canada, also on the European Commission's adequacy decision (Art. 45 GDPR). Transfers to service providers in countries without an adequate level of data protection are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We have concluded a Data Processing Agreement (DPA) with Shopify in accordance with Art. 28 GDPR.

Required cookies
To operate the shop, the following cookies are set on our domain (affairsofchemistry.com); they are required for the functions you use:

• _shopify_essential (Shopify): basic shop functions such as session, checkout and protection against tampering; duration: 1 year

• _tracking_consent (Shopify): stores your choice in the cookie banner; duration: 1 year

• cart: identifies your shopping cart; duration: 14 days

• __Host-session: keeps you signed in to your customer account and is only set when you sign in; duration: 30 days

Legal basis: Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) and Art. 6(1)(b) GDPR (cart, order, customer account) or Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning shop).

For more information, please visit:
https://www.shopify.de/legal/datenschutz

Operation and development
The technical operation and further development of our shop as well as our internal sales reporting are handled for us by visual IMG cross media design, Michael Hildenbrand, Wilhelmstr. 7, 10963 Berlin, Germany, as a processor (Art. 28 GDPR). Its sub-processors include Hetzner Online GmbH (server in the Falkenstein data center, Germany). For AI features in our internal tools (e.g. the assistant in our document storage), visual IMG also uses Anthropic Ireland, Limited, Dublin, Ireland, as a sub-processor under Anthropic's terms for business customers, which include a data processing agreement.
Data transfer to the USA: Anthropic processes the data on servers in the USA; the transfer is based on the EU Standard Contractual Clauses agreed in Anthropic's data processing agreement (Art. 46(2)(c) GDPR).

For payment processing, we use the service Shopify Payments. The provider is:

Shopify Payments (Ireland) Ltd.
1 Grand Canal Street Lower
Grand Canal Dock, Dublin
Ireland

Shopify Payments processes payment data such as:

• Credit card numbers

• Account details

• Payment information

• Transaction IDs

Depending on the selected payment method, you may be redirected to external payment service providers (e.g., PayPal). Further information will be provided during the payment process.

a) Google Tag Manager (GTM)

This website uses Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use GTM to manage the analytics and marketing tags on this website; it does not set any cookies itself. GTM is loaded each time you visit our website; in Google Consent Mode, all consent types are initially set to “denied”. When GTM loads, your browser transmits your IP address and browser information to Google for technical reasons. The tags in GTM are configured to fire only once you have consented to the respective category (Google Analytics with “Analytics”, Google Ads and Meta with “Marketing”); before that, they send no data to Google or Meta.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient management of website tags).

b) Google Analytics 4 (GA4)

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited. GA4 uses cookies and processes:

• IP address: for visitors from the EU, Google only uses it to derive an approximate location (e.g. country, region, city); it is neither logged nor stored
• Page views, session duration, scroll depth
• Device and browser information
• Purchase events (cart actions, orders)

Purchases that were not captured by browser-side measurement are transmitted to Google afterwards, server-side, via the Google Analytics Measurement Protocol to enable comprehensive e-commerce analysis; they are sent from our internal sales reporting in Germany. This is done only for orders for which you had consented to “Analytics”; such orders can be recognized by the Google Analytics client ID stored with them (for both, see g). The data transmitted are this client ID, order ID, ordered items, order value, currency, tax and shipping amounts, and your consent status for “Marketing”.

In checkout and on the order confirmation page, Shopify also loads a Shopify Custom Pixel that sends the events “payment info added” (add_payment_info) and “purchase” with the order and cart data directly to GA4. This pixel is only loaded if you have consented to “Analytics”.

Cookies: _ga (duration: 2 years), _ga_* (duration: 2 years)
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent via cookie banner)
Data transfer to the USA: Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, Google uses the EU Standard Contractual Clauses
Opt-out: Browser add-on for deactivation
Privacy policy: https://policies.google.com/privacy

c) Google Ads

We run ads via Google Ads, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We measure the success of our ads via Google Analytics 4 (see b): our Google Analytics account is linked to our Google Ads account, and Google Ads imports purchases as well as the events “add to cart” and “begin checkout” from Google Analytics as conversions. We do not send any data to Google Ads server-side ourselves.

With your consent to “Marketing”, Google Tag Manager also loads:

• the Conversion Linker, which stores click information from Google ads (e.g. gclid) in cookies on our domain so that a later purchase can be attributed to the ad;
• Google Ads Remarketing, which sends your visit, including the products viewed and cart values, to Google so that we can show you relevant ads on other websites (remarketing lists).

Through Google Consent Mode, both are only triggered if you have consented to “Marketing”.

Cookies: _gcl_au, _gcl_aw and other _gcl_* cookies on our domain (duration: 90 days); cookies set by Google on its own domains, e.g. IDE on doubleclick.net (duration: 13 months)
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent via cookie banner)
Data transfer to the USA: Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, Google uses the EU Standard Contractual Clauses
Privacy policy: https://policies.google.com/privacy
Google cookies: https://business.safety.google/adscookies/

d) Meta Pixel (Facebook/Instagram)

This website uses the Meta Pixel by Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland. The Meta Pixel collects:

• Page views and interactions
• Cart actions (add to cart, checkout)
• Purchase events
• Device and browser information

This data is used for remarketing, custom audiences, and optimization of advertising campaigns on Facebook and Instagram.

The pixel is only loaded with your consent to “Marketing”. If you are signed in to your customer account, we also pass your email address, phone number and customer ID to the pixel in hashed form (SHA-256) so that Meta can match events to your Meta account. In checkout, Shopify loads a separate Meta Pixel with your consent to “Marketing”; when you submit your payment information, it sends the event “AddPaymentInfo” with order value, currency and products as well as your email address (hashed by the pixel before transmission) to Meta.

Cookies: _fbp (duration: 90 days)
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent via cookie banner)
Data transfer to the USA: Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR)
Privacy policy: https://www.facebook.com/privacy/policy

e) Meta Conversion API (CAPI, server-side)

In addition to the Meta Pixel, we transmit events server-side to Meta via the Meta Conversion API to improve measurement accuracy, particularly when ad blockers or browser restrictions are in place. This happens only with your consent to “Marketing”.

Shop events (e.g. page views, product views, search, cart, wishlist, start of checkout, newsletter sign-up) are forwarded to Meta via our shop's server. The data transmitted are the event name and time, the web address of the page viewed, event data (e.g. product IDs, values, search term), your IP address, your browser's user agent and the Meta identifiers _fbp and _fbc; no hashed customer data is transmitted here.

Purchases are reported to Meta from the order data once payment has been received, and only for online orders for which the Meta identifiers _fbp or _fbc were stored with your consent (see g). The data transmitted are order ID, order value, currency, ordered items (product ID, quantity, price), our shop's web address, _fbp and _fbc, and, in hashed form (SHA-256), email address, phone number, customer ID, city, state or region, postal code and country. IP address and user agent are not transmitted for purchases.

Joint controllership with Meta
Using the Meta Pixel (see d) and the Conversion API (see above), both Meta Business Tools, we collect events on our website and transmit them to Meta in order to measure and optimize our ads on Facebook and Instagram, including remarketing and custom audiences. We are joint controllers with Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland, for this collection and transmission (Art. 26 GDPR; CJEU, judgment of July 29, 2019, C-40/17, Fashion ID). We have concluded a joint controller agreement with Meta Platforms Ireland Limited for this purpose (Controller Addendum: https://www.facebook.com/legal/controller_addendum), which allocates the obligations under the GDPR. Under this agreement, we are responsible for providing you with this information. Meta Platforms Ireland Limited is responsible for enabling you to exercise your rights under Art. 15 to 20 GDPR regarding the data stored by Meta after the joint processing. You can also contact us; we forward any requests we receive to Meta. The joint controllership covers only the collection and the transmission; Meta Platforms Ireland Limited alone is responsible for the subsequent processing of the data. Information about Meta as a controller (Art. 13(1)(a) and (b) GDPR), Meta's legal bases and how to exercise your rights with Meta can be found in Meta's privacy policy: https://www.facebook.com/about/privacy.

Legal basis: Art. 6(1)(a) GDPR; for the Meta cookies _fbp and _fbc also Section 25(1) TDDDG (consent via cookie banner)
Data transfer to the USA: Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR)

f) Shopify cookies for analytics and marketing

With your consent, further cookies from Shopify (see section 3) are set on our domain. They allow Shopify to link your visits to the shop with the checkout and the order and to provide us with statistics on visits, their sources and purchases.

Cookies with consent to “Analytics”: _shopify_analytics (duration: 1 year), _shopify_y (visitor identifier, duration: 360 days), _shopify_s (identifier of the current visit, duration: 30 minutes)
Cookie with consent to “Marketing”: _shopify_marketing (duration: 1 year)
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent via cookie banner)

g) Campaign attribution of orders

With your consent, we store the following information with your order at Shopify so that we can see which campaigns and channels lead to orders:

• with consent to “Analytics”: the campaign parameters in the web address visited (utm_source, utm_medium, utm_campaign, utm_content, utm_term), whether you came from a Google product listing (srsltid parameter, stored only as yes/no), the landing page (path only, without parameters), only the host name of the referring website, and the Google Analytics client ID (from the _ga cookie)
• with consent to “Marketing”: the click identifiers of Google ads (gclid, gbraid, wbraid; gclid possibly from Google's _gcl_aw cookie) and Meta ads (fbclid), as well as the Meta cookies _fbp and _fbc

Until checkout, the information from the web address is kept in your browser's session storage (sessionStorage aoc-campaign and aoc-click-ids), which is cleared when you close the tab; if you withdraw your consent, we remove these entries. When you proceed to checkout, we pass the information to Shopify as cart attributes. Email addresses in the campaign information are masked, and the length of the values is limited. Without the respective consent, the information is neither stored in your browser nor passed to Shopify.

The information is analyzed in our internal sales reporting, which visual IMG cross media design (see section 3) operates for us as a processor on a server rented from Hetzner Online GmbH in the Falkenstein data center (Germany); Hetzner is involved as a sub-processor, and data processing agreements under Art. 28 GDPR are in place for both. There we keep only the campaign information and whether a click identifier or client ID was present, not the identifiers themselves. We also add the traffic source of a purchase determined by Google Analytics (source/medium, campaign) to this reporting, matched by order ID. In addition, the client ID is used to send missed purchases to Google Analytics afterwards (see b), and the Meta identifiers are used to report the purchase to Meta (see e).

Storage period: in session storage until the tab is closed; in internal sales reporting 24 months, after which the information is deleted automatically. At Shopify, the information remains part of the order and is subject to the retention periods that apply to orders (in particular under commercial and tax law; see section 7).
Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent via cookie banner)

h) Google Customer Reviews

If you have consented to “Marketing”, Shopify loads a Google Customer Reviews dialog on the order confirmation page after you place your order. The service is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. In the dialog, you decide whether Google may invite you by email to a survey about your purchase from us. For the dialog, we pass the order ID, your email address, the delivery country and an estimated delivery date to Google. Google only sends a survey email if you agree in the dialog. Google processes this data as an independent controller under its privacy policy.

Legal basis: for loading the dialog, Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent to “Marketing” via cookie banner); for the survey invitation, your consent in Google's dialog (Art. 6(1)(a) GDPR)
Data transfer to the USA: Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, Google uses the EU Standard Contractual Clauses
Privacy policy: https://policies.google.com/privacy

i) Ahrefs Web Analytics

With your consent to “Analytics”, we use Ahrefs Web Analytics by Ahrefs Pte. Ltd., 16 Raffles Quay #33-03, Hong Leong Building, Singapore 048581, for statistical analysis of how our website is used. According to Ahrefs, the service sets no cookies and stores no IP addresses. It records the page viewed (including URL parameters), the referring page, the user agent (browser, operating system, device), language settings, screen size and your location down to city level, derived from your IP address, as well as shop events such as product views, search terms, cart, start of checkout, sign-in to the customer account and newsletter sign-up. To count unique visitors, Ahrefs derives a pseudonymous identifier that changes daily from the IP address and user agent.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent via cookie banner)
Data transfer: Ahrefs is based in Singapore and stores the data in the USA; the transfer is based on the EU Standard Contractual Clauses agreed in our data processing agreement with Ahrefs (Art. 46(2)(c) GDPR)
Privacy policy: https://ahrefs.com/legal/privacy-policy

When you contact us by email, phone or via our contact form, we store your information to process your inquiry. We do not share this data with third parties without your consent. Service providers we use as processors (such as Resend for sending emails, see below) process it only on our behalf.

Emails sent via Resend
We send our website's emails via the service Resend provided by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, which acts as our processor (Art. 28 GDPR). These include messages from our contact form and our withdrawal form (for a withdrawal, also the confirmation to you), the confirmation email for newsletter sign-ups, notifications to us about newsletter sign-ups and submitted product reviews, review requests after an order (see below) and technical error messages to us in which personal data is masked. Resend processes the data mainly in the USA.
Data transfer to the USA: Resend is listed as certified in the official EU-U.S. Data Privacy Framework list (adequacy decision of the European Commission, Art. 45 GDPR); as of 10/23/2026, its annual re-certification is under review. In addition, the EU Standard Contractual Clauses have been agreed in the data processing agreement (Art. 46(2)(c) GDPR).

Newsletter
With a single consent, you can receive news, offers and review requests (see below) from us by email. You can give this consent using a form on our website or using the checkbox at checkout or in your customer account. The consent only becomes effective once you have confirmed it (double opt-in); we only take confirmed consents into account. For the form, we send you an email with a confirmation link; your sign-up is complete once you open this link and click “Confirm subscription” on the page that opens. At checkout, Shopify sends you the confirmation email. After confirmation, we store your email address, together with a note of your confirmed consent to email marketing, as a customer record in our shop system at Shopify (see section 3). For sign-ups via the form, we also record the time of sign-up, the time of confirmation and the language as proof, both in the customer record and in a notification email to us; we send the confirmation email and this notification via Resend (see above). We use your email address for these emails until you withdraw your consent; after that, we keep the proof of your consent for three years (regular limitation period, Sections 195 and 199 of the German Civil Code, BGB) so that we can demonstrate it if necessary. We do not send any newsletters yet; before the first mailing, we will name the service we use for this in this privacy policy. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time via the unsubscribe link in any of these emails, in your customer account or by email to support@affairsofchemistry.com. The withdrawal applies to the whole consent, that is, to news, offers and review requests.

Product reviews
You can review a product using the form on our product pages. We process the star rating, headline and text, the name you enter, your email address and, if you arrive via the link in a review request, the order ID so that the review can be marked as “Verified Purchase”. We store reviews in our shop system at Shopify (see section 3) and check them before publication; we are notified of new reviews by email (via Resend). We publish approved reviews on the product page; reviews with at least four stars may also appear on our home page. We publish the name you entered, the star rating, headline, text and date and, for verified purchases, the note “Verified Purchase”. Email address and order ID are not published. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in publishing customer reviews). You can object to publication at any time and request the deletion of your review; an informal message to support@affairsofchemistry.com is sufficient.

Review requests
If you have consented to receiving news, offers and review requests by email and confirmed this consent (see “Newsletter”), we send you a single email about three days after an online order has been shipped, asking you to review the products you purchased. For this, we use your email address, the order number and the products ordered; the email is sent via Resend (see above). We only take into account consents given with the current wording, which expressly mentions review requests; without such consent, you will not receive any review requests. Legal basis: Art. 6(1)(a) GDPR (consent); by ticking the same checkbox or using the same form, you also give the consent to email advertising required under Section 7(2) no. 2 UWG (German Act against Unfair Competition). You can withdraw your consent at any time via the unsubscribe link in any review request, in your customer account or by email to support@affairsofchemistry.com. After that, you will no longer receive review requests, news or offers from us by email.

We store personal data only for as long as necessary for the respective processing purposes or as required by legal retention periods.

You have the right to:

• Access information (Art. 15 GDPR)

• Rectification (Art. 16 GDPR)

• Erasure (Art. 17 GDPR)

• Restriction of processing (Art. 18 GDPR)

• Data portability (Art. 20 GDPR)

• Object to processing (Art. 21 GDPR)

• Withdraw given consent (Art. 7(3) GDPR)

To exercise your rights, simply send an informal message to support@affairsofchemistry.com

We are not obligated and not willing to participate in dispute resolution proceedings.

This website uses SSL encryption for secure data transmission.