Privacy Policy

Last updated: October 19, 2026

1. Introduction

Omega Materials operates this online store and website, including all related information, content, features, tools, products and services (collectively, the "Services"). Our online store is powered by Shopify, which enables us to provide our products and Services to customers throughout the European Union.

This Privacy Policy explains how we collect, use, process, store and disclose personal information when you visit our website, use our Services, purchase our products or otherwise communicate with us.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

If there is a conflict between our Terms and Conditions and this Privacy Policy concerning the processing of personal data, this Privacy Policy shall apply to the extent required by applicable data protection law.

2. Data Controller

The controller responsible for processing personal data in connection with this online store is:

3. Personal Information We Collect

Depending on your interactions with our website and Services, we may collect and process the following categories of personal information:

Contact Information

• First and last name

• Billing and shipping addresses

• Email address

• Telephone number

• Company name and business contact information, where applicable

Order and Transaction Information

• Products viewed, selected or purchased

• Order numbers and purchase history

• Shipping and delivery information

• Returns, cancellations and refunds

• Payment method and payment confirmation

• VAT identification numbers, where applicable

Payment Information

Payment transactions are processed through Shopify and the payment service providers available during checkout.

Depending on the selected payment method, relevant payment information may be transmitted to the respective payment provider.

We generally do not receive or store complete payment card details when transactions are processed by external payment service providers.

Account Information

Where customer accounts are available, we may process account identifiers, login information, preferences, saved addresses and order history.

Technical and Usage Information

When you visit our website, technical information may be collected automatically, including:

• IP address

• Browser type and version

• Device type and operating system

• Date and time of access

• Pages visited

• Referring website

• Session information

• Cookie identifiers and similar technical identifiers

Communication Information

If you contact us, we may process your name, contact details, correspondence and any information voluntarily provided in your message.

Optional Information

Where the relevant features are available and used, we may also process information related to newsletter subscriptions, product reviews, customer feedback, marketing preferences and personalized shopping experiences.

4. Sources of Personal Information

We may collect personal information from the following sources:

• Directly from you when you place an order, create an account, contact us or otherwise provide information.

• Automatically through your use of our website and Services.

• Through Shopify and other service providers involved in processing orders, payments and deliveries.

• From third-party services and integrations where legally permitted.

• From marketing or analytics services, where enabled and subject to applicable consent requirements.

We only process personal information where an appropriate legal basis exists.

5. Purposes and Legal Bases for Processing

We process personal data for the following purposes and on the legal bases described below.

5.1 Order Processing and Contract Performance

We process customer information to:

• Process and fulfill orders

• Arrange payments

• Organize shipping and delivery

• Provide order confirmations and transactional notifications

• Handle returns, cancellations and refunds

• Respond to contractual inquiries

• Provide product-related support

Legal basis: Article 6(1)(b) GDPR – performance of a contract or steps taken prior to entering into a contract.

For business customers, the processing of business contact persons' data may additionally be based on Article 6(1)(f) GDPR, our legitimate interest in conducting and administering business relationships.

5.2 Compliance with Legal Obligations

We process and retain certain information to comply with applicable legal requirements, including:

• Tax and accounting obligations

• Commercial record-keeping requirements

• Consumer protection obligations

• Statutory warranty obligations

• Requirements imposed by competent public authorities

Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation.

5.3 Customer Service and Communication

We use personal information to respond to inquiries, provide technical support, resolve complaints and maintain customer relationships.

Legal basis: Article 6(1)(b) GDPR where communication relates to a contract or pre-contractual measures, or Article 6(1)(f) GDPR where processing is necessary for our legitimate interest in responding to general inquiries and maintaining business communications.

5.4 Website Security and Fraud Prevention

We may process technical and transactional information to:

• Protect our website and infrastructure

• Prevent unauthorized access

• Detect and investigate fraudulent transactions

• Prevent misuse of our Services

• Maintain website functionality and security

Legal basis: Article 6(1)(f) GDPR – our legitimate interest in maintaining the security, reliability and integrity of our Services.

Where processing is required by law, Article 6(1)(c) GDPR may apply.

5.5 Analytics and Website Improvement

We may use analytics services to understand website traffic, evaluate website performance, identify technical issues and improve our Services.

Where such services involve non-essential cookies, tracking technologies or access to information stored on users' devices requiring consent, they will be used only after the necessary consent has been obtained.

Legal basis: Article 6(1)(a) GDPR where consent is required, or Article 6(1)(f) GDPR where processing can lawfully be based on legitimate interests without requiring consent.

5.6 Marketing and Advertising

Where permitted by applicable law, we may process personal information for:

• Email newsletters

• Promotional campaigns

• Personalized advertisements

• Conversion measurement

• Remarketing

• Advertising performance analysis

Marketing emails requiring consent will only be sent where valid consent has been obtained.

Where legally permitted, we may send advertising communications to existing customers under applicable statutory conditions and subject to their right to object.

Non-essential advertising cookies, pixels and comparable tracking technologies requiring consent will not be activated before the relevant consent has been obtained.

Legal basis: Article 6(1)(a) GDPR where consent is required, or Article 6(1)(f) GDPR where direct marketing processing is lawfully permitted on the basis of legitimate interests.

You may withdraw your consent at any time with effect for the future.

6. Shopify and E-Commerce Infrastructure

Our online store is operated using the Shopify platform.

Shopify provides technical infrastructure and services necessary for operating the store, including:

• Website hosting

• Shopping cart functionality

• Checkout and order processing

• Customer account functionality

• Payment integrations

• Fraud prevention

• Store administration

• Technical analytics and operational services

Personal information submitted through our online store may be transmitted to Shopify and processed by Shopify and its authorized service providers.

Depending on the processing activity, Shopify may act as a data processor on our behalf or as an independent data controller.

Certain Shopify services may involve data processing or storage outside the European Economic Area.

Where enabled, Shopify enhanced services, including Shopify Network Intelligence, may process information from interactions with our store and other participating stores to provide analytics, personalization, advertising or other enhanced features.

In connection with such enhanced services, Shopify may act as an independent data controller for certain processing activities.

Where required, the use of customer data for non-essential analytics, advertising or personalization purposes is subject to applicable consent and privacy preferences.

Further information is available in Shopify's privacy documentation:

Shopify Privacy Policy

Shopify Consumer Privacy Policy

Shopify Privacy Portal

7. Payment Processing

Payments are processed using the payment methods and service providers made available during checkout.

Depending on the selected payment method, personal information necessary for payment processing may be transmitted to the relevant payment provider.

This may include:

• Customer name

• Billing address

• Payment amount

• Transaction reference

• Payment authorization information

• Information necessary for fraud prevention

Payment providers may process certain information as independent data controllers in accordance with their own privacy policies.

Legal basis: Article 6(1)(b) GDPR for contract performance, Article 6(1)(c) GDPR for applicable legal obligations and, where appropriate, Article 6(1)(f) GDPR for fraud prevention and transaction security.

8. Shipping and Delivery Providers

To fulfill orders, we share necessary delivery information with shipping and logistics providers.

This information may include:

• Recipient name

• Delivery address

• Telephone number, where necessary

• Email address, where necessary

• Shipment reference

• Information required for delivery

Information is shared only to the extent necessary for organizing and completing delivery or where another lawful basis applies.

Legal basis: Article 6(1)(b) GDPR – performance of a contract.

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies to operate the online store, maintain shopping cart functionality, manage customer sessions and support website security.

Depending on the technologies enabled, cookies may also be used for analytics, marketing, personalization and advertising.

We distinguish between the following categories:

Strictly Necessary Cookies

These cookies are required for essential website functions, including shopping carts, checkout, security and session management.

Where their use is strictly necessary to provide a service explicitly requested by the user, consent may not be required under applicable law.

Analytics Cookies

These technologies help us understand how visitors interact with our website and how our Services can be improved.

Where legally required, they are activated only after consent has been obtained.

Marketing and Advertising Cookies

Where enabled, these technologies may be used to measure advertising effectiveness, display relevant advertisements and support remarketing campaigns.

They are used only in accordance with applicable legal requirements, including consent requirements.

Functional and Personalization Cookies

These technologies may remember preferences and provide optional personalized website features.

Consent will be obtained where required by applicable law.

Visitors can manage their cookie preferences through the cookie consent controls provided on our website, where available.

Consent may be withdrawn at any time with effect for the future.

Further information about Shopify's use of cookies is available at:

https://www.shopify.com/legal/cookies

10. Analytics and Advertising Services

We may integrate additional analytics or advertising services into our online store.

Depending on the services enabled, these may include Google Analytics, Google Ads, Meta Pixel or comparable technologies.

Such services may process technical information, online identifiers, website interaction data, conversion events and other information necessary for analytics or advertising purposes.

Where processing requires consent, the relevant technologies will be activated only after valid consent has been obtained.

Where applicable, additional information about the actual service providers, data recipients, international transfers, processing purposes and available privacy controls will be provided through our privacy information and consent management tools.

11. Email Marketing and Newsletters

Where newsletter or marketing subscription functionality is available, customers may choose to receive promotional communications from us.

The information processed may include:

• Email address

• Name, where provided

• Subscription preferences

• Subscription and consent records

• Interaction information, where legally permitted

Where consent is legally required, marketing communications are sent only after valid consent has been obtained.

Subscribers can unsubscribe at any time using the unsubscribe link provided in marketing emails or by contacting us.

Unsubscribing from marketing communications does not affect essential transactional communications concerning orders, payments, delivery or contractual matters.

Legal basis: Article 6(1)(a) GDPR where processing is based on consent, or another applicable legal basis where marketing is permitted by law.

12. Product Reviews and Customer Feedback

Where product reviews or customer feedback features are available, we may process information voluntarily submitted by customers.

This may include names or display names, ratings, review content, product references and related information.

Where reviews are published, the information identified as public may be visible to other website visitors.

Customers should avoid including sensitive personal information in publicly submitted reviews.

Legal basis: Article 6(1)(a) GDPR where processing is based on consent, Article 6(1)(b) GDPR where necessary for an agreed service, or Article 6(1)(f) GDPR where justified by our legitimate interest in providing customer feedback features.

13. Disclosure of Personal Information

We may disclose personal information to third parties where necessary and legally permitted.

Recipients may include:

• Shopify and its authorized service providers

• Payment processing providers

• Shipping and logistics providers

• IT hosting and technical support providers

• Accounting and tax service providers

• Analytics and marketing service providers, where enabled

• Customer support and communication providers

• Public authorities where disclosure is legally required

Where third parties process personal data on our behalf, we enter into appropriate data processing arrangements where required by Article 28 GDPR.

We do not disclose personal information to third parties without an appropriate legal basis.

Personal information may also be disclosed where necessary to protect legal rights, comply with applicable law or respond to lawful requests from competent authorities.

14. International Data Transfers

Some of our technology providers, including Shopify and potentially other service providers, may process personal information outside Germany or the European Economic Area.

Where personal data is transferred to a country outside the European Economic Area, appropriate safeguards are applied in accordance with Chapter V GDPR.

Depending on the circumstances, these may include:

• An adequacy decision adopted by the European Commission

• Standard Contractual Clauses approved by the European Commission

• Other legally recognized transfer mechanisms

• Additional safeguards where necessary

Where applicable, information concerning the safeguards used and how to obtain a copy or further details may be requested using the contact information provided in this Privacy Policy.

15. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected or as required by applicable law.

Retention periods depend on the type of information and the legal requirements applicable to the processing activity.

Order and Accounting Records

Order records, invoices and relevant transaction information may be retained in accordance with German commercial and tax retention requirements.

Depending on the document category, statutory retention periods may generally be six, eight or ten years.

Customer Account Information

Customer account information is retained for as long as necessary to provide the account service and fulfill relevant contractual or legal obligations.

Account deletion requests are handled in accordance with applicable law, subject to statutory retention requirements.

Customer Communications

Customer correspondence is retained for as long as necessary to handle inquiries, provide support, establish or defend legal claims and comply with any applicable retention obligations.

Marketing Information

Marketing consent records and subscription information are retained for as long as necessary to administer subscriptions, demonstrate compliance with consent requirements and address relevant legal obligations or claims.

Technical and Analytics Information

Technical logs, cookies and analytics information are retained according to their respective purposes, configured retention settings and applicable legal requirements.

Where the relevant retention purpose no longer exists and no legal obligation requires continued storage, personal information will be deleted or anonymized.

16. Data Security

We implement appropriate technical and organizational measures to protect personal information against unauthorized access, accidental loss, alteration, disclosure or destruction.

These measures may include access controls, secure communications, authentication mechanisms and security safeguards provided by our technical service providers.

However, no method of electronic transmission or storage can guarantee absolute security.

Customers who use an account are responsible for keeping their login credentials confidential and should contact us if they suspect unauthorized access.

17. Your Rights Under the GDPR

If the GDPR applies to the processing of your personal data, you have the following rights, subject to applicable legal conditions and limitations:

Right of Access – Article 15 GDPR

You have the right to request information about the personal data we process concerning you.

Right to Rectification – Article 16 GDPR

You have the right to request correction of inaccurate personal information and completion of incomplete information.

Right to Erasure – Article 17 GDPR

You may request deletion of your personal data where the relevant statutory requirements are met.

Right to Restriction of Processing – Article 18 GDPR

You may request restriction of certain processing activities under the conditions set out in the GDPR.

Right to Data Portability – Article 20 GDPR

Where the statutory requirements are met, you may request to receive relevant personal data in a structured, commonly used and machine-readable format or have it transmitted to another controller.

Right to Object – Article 21 GDPR

You have the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or Article 6(1)(f) GDPR, subject to applicable legal conditions.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time.

Right to Withdraw Consent – Article 7(3) GDPR

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Right to Lodge a Complaint – Article 77 GDPR

You have the right to lodge a complaint with a competent data protection supervisory authority.

To exercise your rights, please contact:

shopify@omega-materials.com

We may request additional information where reasonably necessary to verify your identity.

We will respond to requests within the time limits prescribed by applicable data protection law, generally within one month, subject to any legally permitted extension.

18. Data Protection Supervisory Authority

The data protection supervisory authority generally responsible for our business establishment in Bavaria, Germany, is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)

Promenade 18
91522 Ansbach
Germany

Website: https://www.lda.bayern.de

You may also have the right to lodge a complaint with another competent supervisory authority, including an authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

A list of European data protection authorities is available at:

https://edpb.europa.eu/about-edpb/about-edpb/members

19. Automated Decision-Making and Profiling

Certain technical services, including fraud prevention tools and optional advertising or personalization technologies, may use automated processing to evaluate transactions, detect suspicious activity or personalize content.

Where processing constitutes automated decision-making with legal or similarly significant effects within the meaning of Article 22 GDPR, the applicable transparency requirements and safeguards will be observed.

Where required, additional information will be provided about the relevant decision-making processes, their significance, potential consequences and available rights.

20. Children's Privacy

Our website and products are not specifically directed at children.

We do not knowingly collect personal information from children where doing so would violate applicable data protection laws.

If a parent or legal guardian believes that a child has provided personal information to us unlawfully, they may contact us to request appropriate action.

21. Third-Party Websites and External Links

Our website may contain links to external websites, social media platforms or other third-party services.

These services may have their own privacy policies and data processing practices.

We recommend reviewing the privacy information of any third-party website before providing personal information.

We are not responsible for independent processing activities carried out by third-party website operators, except where applicable law provides otherwise.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, legal requirements, technology providers or data processing activities.

The updated version will be published on our website with a revised "Last updated" date.

Where required by applicable law, we will provide additional notice or obtain renewed consent before introducing relevant changes to processing activities.

23. Contact

For questions concerning this Privacy Policy, our privacy practices or the exercise of your data protection rights, please contact:

The data controller within the meaning of Article 4(7) GDPR is Hasan Bahri Atil, trading as AMAF Engineering.