As of: 22 September 2026

1. Controller

Sardashti Business – Mohammad Javad (Danial) Sardashti
Manganstraße 4, 65428 Rüsselsheim am Main, Germany
Phone: +49 176 622 99342
Email: info@sardashtibusiness.de

2. Hosting and server log files

When our website is accessed, server log files are collected automatically (e.g. IP address, date/time, referrer, browser type).
Purpose: Operation, security and prevention of misuse (Art. 6(1)(f) GDPR).
Retention period: 7–30 days, after which they are deleted.

3. Cookies & Consent Management (Borlabs Cookie)

We use Borlabs Cookie to record and manage consent for cookies and comparable technologies (Art. 6(1)(c) GDPR). The Essential service group contains Borlabs Cookie. The Statistics service group contains Google Tag Manager and Google Analytics. Statistics services remain blocked until you give consent and are also blocked if you choose essential cookies only.

Technically necessary functions

Technically necessary functions support security, shopping cart, checkout, payment processing and storage of your consent choice. These functions do not depend on consent to the Statistics service group.

  • WooCommerce: Shopping-cart and order processing.

  • Borlabs Cookie: Stores and applies your consent settings.

  • Payment providers: Stripe, PayPal and Klarna resources may be used on relevant product, cart or checkout pages for payment functions and fraud or security checks. They are not classified here as optional advertising services.

Statistics services (with consent)

Google Tag Manager (container GTM-T64F3LCV) is a tag-management mechanism used to control the delivery of the consented Google Analytics configuration. Google Tag Manager does not itself create website-usage analyses. It is activated through the Statistics service only after consent.

Google Analytics 4 (measurement ID G-84909V55RM; Google tag GT-TQVSXBQV) is used to analyse website usage only with your consent. Google Analytics may use the cookies _ga and _ga_*. The retention period may be up to 2 years. Privacy policy: https://policies.google.com/privacy

You can withdraw or change your consent at any time via the Cookie Settings link in the footer.

4. Online shop & contract processing (WooCommerce)

To process orders, we process master data, contact data, payment data and contract data (Art. 6(1)(b) GDPR).
Retention period: 10 years (commercial and tax law).

5. Payment service providers

Stripe

Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
Stripe processes data required for payment processing and security or fraud prevention, such as name, email address, billing and delivery address, payment details, device information and IP address. Stripe.js and Express Checkout components may initialise on product pages, the cart and checkout because Apple Pay and Google Pay are enabled as express-payment options; a wallet button is shown only when supported by the browser and device.
Details: https://stripe.com/privacy

PayPal

Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
At checkout, the PayPal SDK and FraudNet may process device and fraud-risk information for payment security. If PayPal is selected, data such as name, address, email address and payment information is transmitted to PayPal for payment processing.
Details: https://www.paypal.com/ie/legalhub/paypal/privacy-full

Klarna

Provider: Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden.
Klarna components are used at checkout for payment functionality. If a Klarna payment method is selected, Klarna may process payment, device, risk and fraud-prevention data and may carry out identity or creditworthiness checks where applicable to the selected payment method.
Details: https://www.klarna.com/de/datenschutz/

Advance payment / bank transfer

If “advance payment” is selected, we process only the data required for contract processing.

6. Google Tag Manager and Google Analytics 4

We use Google Tag Manager to manage the delivery of the Google Analytics configuration described below. Tag Manager is not used as an independent analytics service. Google Tag Manager and Google Analytics are assigned to the Statistics service group and remain blocked until you give consent.

We use Google Analytics 4 only with your consent (Art. 6(1)(a) GDPR).

  • IP anonymisation is enabled.

  • Google processes data partly in the EU and partly in the USA (with standard contractual clauses).
    Withdrawal: at any time via Cookie Settings.
    Details: https://policies.google.com/privacy

7. Contacting us

When you contact us (by email or form), we process the information you provide in order to handle the enquiry (Art. 6(1)(b)/(f) GDPR).
Data is deleted after the matter has been dealt with, unless statutory obligations prevent this.

8. Customer account / registration

When a customer account is created, we process the data provided for administration and order processing (Art. 6(1)(b) GDPR).
You can request deletion of the account at any time.

9. Social media

Our website contains only links to our social media profiles (e.g. Instagram). When you access these links, the privacy policies of the respective provider apply.

10. Recipients & data disclosure

We disclose data only insofar as this is necessary for contract fulfilment (hosting, payment services, shipping service providers, tax consultancy). Transfers to third countries take place only with the safeguards required by Art. 44 et seq. GDPR.

11. Retention period

Data is stored only for as long as is necessary for the respective purposes or statutory retention obligations.

12. Your rights

You have the following rights at any time (Art. 15–21 GDPR):

  • Access, rectification, erasure, restriction, data portability

  • Objection to processing based on legitimate interests

  • Withdrawal of consent granted (Art. 7(3) GDPR)

  • Lodging a complaint with a supervisory authority

Competent authority:
The Hessian Commissioner for Data Protection and Freedom of Information
Gustav-Stresemann-Ring 1, 65189 Wiesbaden
Tel. +49 611 1408-0, Email: poststelle@datenschutz.hessen.de
www.datenschutz.hessen.de

13. Changes to this policy

We reserve the right to amend this Privacy Policy if services, the legal situation or internal processes change.

Note regarding the ODR platform

The former EU ODR platform was discontinued on 20 July 2025. The corresponding notices have been removed.