Desi, good value and halal

Free shipping from €39.99 Delivery across Germany with GLS

Sign inRegisterHelpDEEN

Account 0 0 0€0.00

datenschutz-widerruf

Additional privacy information

This information supplements our privacy policy for individual functions and service providers of our shop. Where it differs from the privacy policy, this additional information prevails. The controller is Dr. Shahinur Rahman, Tukwila Supermarket, Bautzner Straße 16, 01099 Dresden, Germany, phone +49 351 65399981, e-mail [email protected]. Your rights of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent, and your right to lodge a complaint with a supervisory authority (section 10), also apply to the processing described here. Periods running “from the end of the calendar year” start at the end of the year in which the transaction concerned was completed.

1. Electronic withdrawal function (“Withdraw from contract here”)

On the page tukwila.de/widerruf/ you can withdraw from a purchase contract online.

  • Data processed: the order number and e-mail address you enter; the order data stored for them (name, address, items), which we show you for checking; the content of your withdrawal statement; the date and time of receipt; the acknowledgement of receipt sent to you.
  • Purpose: receiving and documenting your withdrawal, sending the acknowledgement of receipt required by law, and unwinding the contract (return, refund).
  • Legal basis: Art. 6(1)(c) GDPR in conjunction with the statutory provisions on the electronic withdrawal function and the acknowledgement of receipt, and Art. 6(1)(b) GDPR for unwinding the contract.
  • Entries in the first step that you do not submit with “Confirm withdrawal” are not stored permanently. To protect against misuse, we limit the number of look-ups per IP address; for this purpose the IP address is processed only briefly in memory (Art. 6(1)(f) GDPR, our legitimate interest in the security of order data).
  • Recipients: for the refund we send the refund amount and the transaction reference to the payment service provider concerned (Stripe or Klarna); for payments by bank transfer we make the refund through our bank.
  • Retention: we keep the withdrawal statement and the acknowledgement with the order records for 6 years as commercial and business correspondence, or 8 years where they form part of the accounting records (Section 257 German Commercial Code, HGB; Section 147 German Fiscal Code, AO), in each case from the end of the calendar year. They are then deleted.

2. Notification when an item is back in stock

If an item is sold out, you can enter your e-mail address on the product page to be notified as soon as it is available again.

  • Data processed: e-mail address, the item concerned, language, time of the request and of the notification.
  • Purpose: we send you exactly one e-mail as soon as the item is available again. This e-mail contains no other advertising, and you are not added to our newsletter. We also see how many people are waiting for an item in order to plan our purchasing; for this we use only the number, not your e-mail address.
  • Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by submitting the form. You can withdraw it at any time with effect for the future, e.g. by e-mail to us; the request is then deleted. To protect against misuse, we use a check field that is invisible to people and limit the number of requests per IP address; for this purpose the IP address is processed only briefly in memory (Art. 6(1)(f) GDPR).
  • Retention: we delete open requests no later than 12 months after the request, even if the item has not become available again. After the notification has been sent, we delete the request after 30 days. Section 4 applies to the e-mail sent.

3. Ordering fresh meat via WhatsApp and our WhatsApp group

In addition to the section “Communication via WhatsApp” of our privacy policy and to section 7:

  • Ordering via WhatsApp: fresh halal meat can only be ordered via WhatsApp. For this we process your phone number, your WhatsApp profile name, the content of the chat, the details of the order and of the delivery address or collection, and the details of your bank transfer (account holder’s name, IBAN, amount, payment reference), which we receive through our bank, Ostsächsische Sparkasse Dresden. We send you the offer, the order confirmation, our terms and conditions, the withdrawal instructions and the contract confirmation via WhatsApp, partly as PDF files. We transfer the order data into our shop system to handle the order, invoice and shipping; as for every order, GLS receives the name, delivery address and phone number for this purpose. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps and performance of the contract) and Art. 6(1)(c) GDPR for retention.
  • Retention: we transfer the messages relevant to the contract (our offer, your order, our confirmation) to the order records and keep them there for 6 years, and invoices and payment records for 8 years, in each case from the end of the calendar year (Section 257 HGB, Section 147 AO). We delete the chat history in WhatsApp no later than 6 months after delivery or collection, unless it is needed for longer to resolve a complaint.
  • WhatsApp group: if you join our WhatsApp group via the invitation link on our website, the group administrators and – depending on WhatsApp’s settings – the other members can see your phone number and profile name. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by joining. You can leave the group at any time. We do not add anyone who has not joined themselves.

4. Log of e-mails sent

All e-mails from our shop (e.g. order, payment and shipping confirmations, invoices, cancellations and refunds, acknowledgements of withdrawals, password links, back-in-stock notifications, reminders and newsletters) are sent via a mail server that we operate ourselves on our server hosted by OVH in the EU (section 7). No external e-mail sending service is used for this.

  • Data processed: recipient address and name, subject, type of e-mail (service e-mail or advertising), a copy of the content, time of sending, delivery status and any error messages from the receiving mail server.
  • Purpose: proof that and when we sent an e-mail (e.g. the acknowledgement of a withdrawal), fixing delivery problems, avoiding duplicate e-mails and complying with statutory retention obligations.
  • Legal basis: Art. 6(1)(c) GDPR where we are obliged to retain; otherwise Art. 6(1)(f) GDPR (our legitimate interest in proof and reliable delivery).
  • Retention:
    • e-mails relating to an order (order confirmation, invoice, shipping, cancellation, refund, acknowledgement of a withdrawal): 6 years from the end of the calendar year (Section 257 HGB, Section 147 AO);
    • other service e-mails (e.g. password link, e-mail address confirmation, back-in-stock notification): 90 days after sending;
    • advertising e-mails (newsletter, review and cart reminders): content 90 days after sending; recipient, time and type of e-mail for the duration of your subscription or consent and 3 years thereafter, so that we can prove that we only advertised with consent.

5. Review reminders and publication of reviews

  • Review reminder: about 10 days after receipt of payment we send you a single e-mail asking you to review up to three items from your order. You receive this e-mail only if you have subscribed to our newsletter and confirmed the subscription, and not if the order was cancelled or refunded. We process your e-mail address, name, order number and the items ordered. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link in every e-mail. We delete the scheduled send as soon as the e-mail has been sent or skipped; section 4 applies to the e-mail itself.
  • Publication: if you submit a review, we publish, after checking it, the name you entered (you can use a first name or a pseudonym), your star rating, your text and the date. If you are signed in to your customer account, we check against your orders whether you bought the item from us and then mark the review “Verified purchase”. The legal basis for publication is your consent (Art. 6(1)(a) GDPR); for the purchase check it is our legitimate interest in providing transparent information about the authenticity of reviews (Art. 6(1)(f) GDPR). Reviews are stored for as long as they are published; we delete them at any time on request.

6. Reminder about an unfinished cart

  • Only if you tick the box (not pre-selected) “Remind me by e-mail if I do not complete my order” at checkout do we remind you of an unfinished purchase: no more than two e-mails, about 4 hours and 24 hours after the cart was last changed. Carts older than 10 days are no longer reminded. A newsletter subscription alone does not trigger cart reminders.
  • Data processed: e-mail address, cart contents, time of the last change.
  • Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link in every reminder e-mail or by e-mail to us.
  • Retention: we delete carts without an order 30 days after their last change. Section 4 applies to the e-mails sent.

7. Service providers and recipients

  • Hosting – OVH SAS, 2 rue Kellermann, 59100 Roubaix, France: OVH provides the server on which our shop, our database (customer, order and contract data) and our mail server run. The server is located in a data centre in the EU (Frankfurt am Main or Paris). OVH acts as a processor; we have concluded a data processing agreement under Art. 28 GDPR. Legal basis: Art. 6(1)(b) and (f) GDPR (performance of the contract; our legitimate interest in secure and reliable operation). As far as hosting is concerned, this replaces the reference to Cloudflare as hoster in our privacy policy.
  • Content delivery network and DDoS protection – Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: all requests to our website pass through Cloudflare’s network, which delivers content faster, encrypts the connection and blocks attacks. Cloudflare processes in particular your IP address, the address requested, browser and device information and the time. Cloudflare may set a technically necessary security cookie to detect automated access. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in providing the website securely and quickly). We have concluded a data processing agreement. For transfers to the USA we rely on the adequacy decision for the EU-US Data Privacy Framework, under which Cloudflare is certified, and additionally on standard contractual clauses.
  • Payment processing – Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland: Stripe processes your payment by card and with Klarna. For this Stripe receives your name, e-mail address, billing address, order number and amount; you enter your card details directly into Stripe’s payment form, and we do not receive them. To prevent fraud, Stripe also processes your IP address and device information. Stripe acts partly as our processor and partly as an independent controller, in particular for fraud prevention and for its own legal obligations. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (fraud prevention). Data may be transferred to Stripe, Inc. in the USA; Stripe is certified under the EU-US Data Privacy Framework. We keep the payment reference and status with the order records for 8 years from the end of the calendar year. More: stripe.com/privacy.
  • Klarna – Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden: if you choose Klarna, your name, address, e-mail address, phone number where applicable, order details and amount are sent to Klarna. Klarna is an independent controller for this and may check your identity and creditworthiness. Legal basis: Art. 6(1)(b) GDPR. More: klarna.com/de/datenschutz.
  • Shipping – GLS Germany GmbH & Co. OHG, GLS-Germany-Straße 1–7, 36286 Neuenstein, Germany: for delivery, GLS receives your name, delivery address and phone number (for delivery and delivery notifications). We pass your e-mail address to GLS only with your consent. GLS is an independent controller. Legal basis: Art. 6(1)(b) GDPR.
  • WhatsApp – WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland: we use WhatsApp Business for orders of fresh meat, customer enquiries and our WhatsApp group (see section 3 and the section “Communication via WhatsApp” of the privacy policy). Content is end-to-end encrypted; WhatsApp receives metadata (e.g. phone numbers, times). Data may be transferred to Meta Platforms, Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework.

8. Analytics and marketing only with your consent

We load Google Analytics, Microsoft Clarity and the Meta pixel only after you have agreed in the cookie banner. Without your consent these services are not loaded. The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link in the footer of every page.

  • Google Analytics 4 – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: audience measurement and analysis of how our shop is used (pages viewed, clicks, cart and purchase events, device and browser information, approximate location). Google Analytics sets cookies for this (e.g. “_ga”). Event data is deleted after no more than 14 months.
  • Microsoft Clarity – Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland: analysis of how our pages are used through heatmaps and session recordings (mouse movements, clicks, scrolling). Entries in form fields are masked. Clarity sets cookies for this (e.g. “_clck”, “_clsk”). According to Microsoft, session recordings are deleted after 30 days and aggregated analyses after no more than 13 months.
  • Meta pixel – Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland: measuring the success of our advertising on Facebook and Instagram and building audiences for advertising. The pixel sets cookies for this (e.g. “_fbp”). We and Meta are joint controllers for collecting the data and transmitting it to Meta (Art. 26 GDPR); Meta alone is responsible for any further processing.

Google, Microsoft and Meta may transfer data to their parent companies in the USA. Google LLC, Microsoft Corporation and Meta Platforms, Inc. are certified under the EU-US Data Privacy Framework. We store your choice in the cookie banner in your browser for 12 months, so that it is respected on your next visit and we can prove your consent (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR; Section 25(2) no. 2 TDDDG).

9. Necessary cookies and note on the TDDDG

Since 14 May 2024 the former German Telecommunications Telemedia Data Protection Act (TTDSG) has been called the Telecommunications Digital Services Data Protection Act (TDDDG). Where our privacy policy refers to Section 25 TTDSG, Section 25 TDDDG is meant. For the functions you request, we use without consent only cookies and similar storage that are strictly necessary for them (e.g. session, protection of forms against misuse, cart, wish list, language, your choice in the cookie banner, Cloudflare’s security cookie); the legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.

10. Competent supervisory authority

The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 5, 01067 Dresden, Germany. You can also contact any other data protection supervisory authority, in particular in the member state of your habitual residence.

Last updated: October 2026