Privacy Policy

MIVOR GbR
Last updated: 24 October 2026

1. Introduction

At MIVOR, we respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website, purchase our fashion products, create a customer account, contact us, subscribe to our newsletter, interact with our educational initiatives, or participate in the BRIDGE Survey.

It also explains how we use cookies, analytics, advertising technologies, and AI-assisted image creation and editing tools.

We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications Digital Services Data Protection Act (TDDDG), and other applicable laws.

2. Data Controller

The controller responsible for processing personal data is:

MIVOR GbR
Nibelungenstraße 36a
64579 Gernsheim
Germany

Represented by:
Marijan Govorkovic
Maja Govorkovic

Email: ggprayer.label@gmail.com
Phone: +49 151 26600552

For questions concerning your personal data or your rights, please contact us using the details above.

3. Categories of Personal Data

Depending on how you interact with MIVOR, we may process:

  • Identity and contact information, including names, email addresses, telephone numbers, billing addresses, and shipping addresses.
  • Order and transaction information, including purchased products, order numbers, payment methods, payment status, invoices, and delivery information.
  • Customer account information, including login details and order history.
  • Technical information, including IP addresses, browser and device information, operating systems, access timestamps, and security logs.
  • Website usage information where analytics or advertising technologies have been lawfully activated.
  • Communication information, including messages, inquiries, and customer service correspondence.
  • Marketing preferences, newsletter subscriptions, consent records, and newsletter interactions where permitted.
  • BRIDGE Survey email addresses, submitted answers, assessment results, assigned levels, personalised recommendations, and historical assessments.
  • Identifiable photographs and associated information where images of real individuals are processed using AI-assisted tools.

We process personal data for specified purposes and in accordance with applicable data protection requirements.

4. Legal Bases for Processing

Depending on the purpose, we rely on the following legal bases:

Article 6(1)(a) GDPR – Consent: For voluntary newsletter subscriptions, optional analytics and marketing technologies, and consent-based BRIDGE Survey processing.

Article 6(1)(b) GDPR – Contractual Necessity: For processing purchases, payments, deliveries, customer accounts, and contractual communications.

Article 6(1)(c) GDPR – Legal Obligation: For compliance with statutory accounting, tax, and recordkeeping requirements and other applicable legal obligations.

Article 6(1)(f) GDPR – Legitimate Interests: For website security, fraud prevention, technical maintenance, and other legitimate business purposes where our interests are not overridden by your rights.

Where BRIDGE Survey responses contain or reveal special categories of personal data, we additionally rely on explicit consent under Article 9(2)(a) GDPR, where applicable.

The storage of or access to information on your device is also subject to Section 25 TDDDG.

5. Website Hosting and Server Log Files

Our website is hosted by:

ALL-INKL.COM – Neue Medien Münnich
Hauptstraße 68
02742 Friedersdorf
Germany

Email: info@all-inkl.com
Website: https://all-inkl.com/

When you visit our website, technical information may be automatically processed, including:

  • IP address
  • Date and time of access
  • Requested pages and resources
  • Browser type and version
  • Operating system
  • Referrer URL, where transmitted
  • Technical errors and security information

Purpose: Website delivery, technical maintenance, troubleshooting, protection against attacks, and prevention of misuse.

Legal basis: Article 6(1)(f) GDPR.

Data retention: Server logs are retained for the period configured for our hosting service and necessary for the relevant technical or security purpose. The actual retention period must be confirmed against our hosting configuration before publication.

Further information: https://all-inkl.com/datenschutzinformationen/

6. Online Shop, Orders and Customer Accounts

We use WordPress and WooCommerce to operate our online fashion store.

When you place an order, we process information necessary to conclude and fulfil the purchase contract.

This may include:

  • Name and contact details
  • Billing and delivery addresses
  • Products ordered
  • Order date and order number
  • Payment method and payment status
  • Shipping and delivery information
  • Customer service correspondence

Purpose: Processing purchases, arranging delivery, communicating about orders, handling returns and complaints, and complying with legal obligations.

Legal bases: Article 6(1)(b) GDPR and Article 6(1)(c) GDPR.

Where customer accounts are available, we process account information to provide login functionality, manage saved addresses, and display order history.

Additional processing for account security and prevention of misuse may be based on Article 6(1)(f) GDPR.

We do not use payment information for unrelated marketing purposes without an appropriate legal basis.

7. Payment Processing

To process purchases through our online store, MIVOR offers payment methods including PayPal, direct bank transfer, and card payments through WooPayments, subject to the options actually available during checkout.

Depending on the selected payment method, personal data necessary to complete the transaction may be processed.

This may include names, billing details, email addresses, order numbers, payment amounts, payment status, and transaction identifiers.

7.1 PayPal

Payments through PayPal are processed by:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

When you select PayPal, the information necessary to process your payment is transmitted to PayPal.

PayPal may process personal data as an independent controller for certain purposes.

Privacy Policy: https://www.paypal.com/de/legalhub/paypal/privacy-full

7.2 Direct Bank Transfer

If you select direct bank transfer, we process the payment information necessary to identify your payment and allocate it to your order.

This may include your name, bank account information, transaction amount, payment reference, and payment date.

Participating financial institutions process payment data in accordance with their applicable legal obligations.

7.3 WooPayments – Credit and Debit Card Payments

We use WooPayments, a payment solution integrated into WooCommerce, to accept supported electronic payments.

WooPayments operates within the WooCommerce ecosystem and uses Stripe payment infrastructure.

Depending on the transaction and applicable arrangements, personal data may be processed by entities within the Automattic and Stripe groups.

Stripe Payments Europe, Limited
The One Building
1 Grand Canal Street Lower
Dublin 2
Ireland

Relevant transaction information, billing details, payment method information, and technical data may be transmitted to the payment infrastructure.

Card payment details are handled through the payment provider’s infrastructure and are not intended to be stored directly by MIVOR.

Further information:

WooPayments: https://woocommerce.com/document/woopayments/

Stripe Privacy Policy: https://stripe.com/privacy

7.4 Legal Basis and Retention

Legal bases: Article 6(1)(b) GDPR for payment processing and Article 6(1)(c) GDPR for statutory accounting and tax obligations.

Payment providers may process additional information for fraud prevention, payment security, and regulatory compliance under their own applicable legal bases.

Transaction records are retained in accordance with applicable statutory requirements.

8. Shipping and Delivery

To fulfil customer orders, we share the information necessary for delivery with our logistics partner:

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany

Depending on the shipment, this may include:

  • Recipient name
  • Shipping address
  • Order and shipment information
  • Email address or telephone number, where necessary and legally permitted

Purpose: Processing, shipping, tracking, and delivering customer orders.

Legal basis: Article 6(1)(b) GDPR.

Where additional contact information is used for optional delivery notifications, an appropriate legal basis is required.

DHL Privacy Information: https://www.dhl.de/de/toolbar/footer/datenschutz.html

9. Cookies and Similar Technologies

We use cookies and similar technologies to operate our website and, where you consent, to analyse website usage and support marketing activities.

These technologies may include cookies, local storage, pixels, tags, and comparable technologies.

We distinguish between four categories:

Basic Operations: Essential technologies necessary for website security, shopping cart functionality, checkout, login sessions, necessary payment functions, and storage of cookie preferences.

Content Personalization: Optional technologies used to remember preferences and provide personalised website experiences.

Site Optimization: Optional analytics technologies, including Google Analytics 4.

Ad Personalization: Optional advertising technologies, including Meta Pixel.

Technologies that are strictly necessary to provide a service expressly requested by the user may be used without consent where Section 25(2) TDDDG applies.

Other technologies requiring consent under Section 25(1) TDDDG are activated only after valid consent has been obtained.

Where personal data is processed, the relevant GDPR legal basis applies in addition.

Further information is available in our Cookie Policy.

10. Cookie Consent Management

We use Cookie Compliance by Hu-manity.co to manage cookie preferences and consent decisions.

The consent management solution may process:

  • Consent selections
  • Consent timestamps
  • Technical identifiers
  • Information necessary to document and manage consent preferences

Purpose: Consent management, compliance documentation, and enabling users to modify or withdraw their choices.

Legal bases: Article 6(1)(c) GDPR where processing is necessary to fulfil legal obligations, and Article 6(1)(f) GDPR where appropriate for the secure administration of consent preferences.

You may change or withdraw your consent at any time through the Cookie Settings function on our website.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

11. Website Analytics – Google Analytics 4

We use Google Analytics 4 to understand how visitors interact with our website and to improve its performance.

Provider:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

Depending on the configuration, Google Analytics may process:

  • Page views
  • Website interactions
  • Device and browser information
  • Online identifiers
  • Approximate location information
  • Purchase-related and conversion events

Purpose: Website analytics, performance measurement, and service improvement.

Legal basis: Article 6(1)(a) GDPR and Section 25(1) TDDDG, where consent is required.

Google Analytics technologies requiring consent are activated only after valid consent has been obtained.

Privacy Policy: https://policies.google.com/privacy

12. Advertising and Marketing Technologies – Meta Pixel

We use Meta Pixel to support advertising measurement, conversion tracking, and campaign optimisation.

Provider:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4
Ireland

Depending on the configuration, Meta Pixel may process:

  • Website interactions
  • Advertising and online identifiers
  • Browser and device information
  • Conversion and purchase-related events

Purpose: Advertising performance measurement, campaign optimisation, and personalised advertising.

Legal basis: Article 6(1)(a) GDPR and Section 25(1) TDDDG, where consent is required.

Meta Pixel technologies requiring consent are activated only after valid consent has been obtained.

Privacy Policy: https://www.facebook.com/privacy/policy/

Other advertising technologies, including Google Ads conversion tracking, are covered by this policy only if they are actually implemented and appropriately disclosed.

13. Social Media and Embedded Content

MIVOR may maintain profiles on social media platforms, including Instagram and Facebook, and link to content hosted by third parties.

When you visit an external social media platform, the relevant platform operator processes personal data according to its own privacy policy.

Where third-party content, such as videos or social media posts, is embedded directly into our website, personal data may be transmitted to the relevant provider when the content is loaded.

Where consent is required, embedded content is activated only after valid consent has been obtained.

Any additional processing associated with our own social media profiles is subject to applicable data protection requirements.

14. Newsletter and Email Marketing – Mailchimp

If you subscribe to our newsletter, we process your email address and any additional information voluntarily provided.

We may send updates concerning:

  • Fashion collections and product launches
  • MIVOR campaigns and events
  • Promotional offers
  • Educational initiatives
  • BRIDGE-related news
  • Brand updates

14.1 Newsletter Provider

We use Mailchimp, an email marketing platform operated by:

The Rocket Science Group LLC d/b/a Mailchimp
675 Ponce de Leon Ave NE, Suite 5000
Atlanta, GA 30308
United States

Mailchimp is part of the Intuit group.

14.2 Personal Data Processed

Depending on the features enabled, Mailchimp may process:

  • Email addresses
  • Names, where voluntarily provided
  • Subscription dates and consent records
  • Newsletter delivery and subscription status
  • Technical information relating to newsletter interactions
  • Email opens and link clicks, where tracking is enabled and legally permitted

14.3 Legal Basis

Newsletter subscriptions are generally based on consent under Article 6(1)(a) GDPR.

Where required, we use a double opt-in procedure to verify subscriptions and document consent.

Newsletter tracking technologies requiring consent are used only where valid consent has been obtained.

14.4 International Data Transfers

Mailchimp is based in the United States. Personal data may therefore be transferred to or processed in the United States.

Such transfers must comply with Chapter V GDPR.

14.5 Withdrawal and Unsubscription

You may withdraw your newsletter consent at any time by clicking the unsubscribe link included in our marketing emails or by contacting:

ggprayer.label@gmail.com

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

After unsubscribing, your email address will be removed from active marketing lists unless limited retention is necessary to document your withdrawal or comply with legal obligations.

14.6 Data Retention

We retain newsletter subscription data for as long as the subscription remains active.

After withdrawal, personal data that is no longer required is deleted, subject to applicable legal obligations and the need to document consent or objections.

14.7 Further Information

Mailchimp Privacy Information: https://www.intuit.com/privacy/statement/

15. Contact Requests and Customer Support

If you contact us by email, telephone, or through a contact form, we process the information necessary to respond.

Depending on the inquiry, this may include your name, contact details, message content, and relevant order information.

Purpose: Responding to inquiries, handling customer service requests, and managing contractual communications.

Legal bases: Article 6(1)(b) GDPR for contractual or pre-contractual inquiries, or Article 6(1)(f) GDPR for other legitimate communications.

Correspondence is retained only for as long as necessary for the relevant purpose or applicable legal obligations.

16. Educational Initiatives and BRIDGE Survey

MIVOR promotes cultural understanding, inclusion, and awareness of discrimination through fashion, educational content, and related initiatives.

One of these initiatives is the BRIDGE Survey, a voluntary self-reflection and educational assessment.

The BRIDGE Survey contains 42 questions and typically takes approximately 20 minutes to complete.

It addresses perspectives concerning discrimination, cultural differences, religion, ethnicity, skin colour, and related subjects.

Based on the responses provided, the BRIDGE Model assigns an individual assessment within six defined levels and provides related educational guidance.

The assessment is intended to encourage personal reflection and development.

It is not a medical or psychological diagnosis and does not constitute an objectively definitive determination of a person’s character or attitudes.

17. BRIDGE Survey – Personal Data

When participating in the BRIDGE Survey, we process:

  • Your email address
  • Your answers to the survey questions
  • Your calculated BRIDGE assessment
  • Your assigned BRIDGE level
  • Personalised feedback and educational recommendations
  • Historical assessments where you participate more than once
  • Technical information necessary to provide and secure the survey, where applicable

We do not request your name as a direct identification detail.

However, because your email address can be associated with your answers and assessment results, the information constitutes personal data.

We do not treat email-linked survey responses as anonymous.

18. BRIDGE Survey – Sensitive Personal Data and Consent

The BRIDGE Survey addresses subjects that may include religion, ethnicity, skin colour, cultural background, and attitudes towards discrimination.

Depending on the questions and answers, survey information may reveal or permit inferences about special categories of personal data within the meaning of Article 9 GDPR, including religious beliefs or racial or ethnic origin.

We therefore apply additional safeguards to the processing of this information.

Legal bases:

  • Article 6(1)(a) GDPR – Consent.
  • Article 9(2)(a) GDPR – Explicit consent for the processing of special-category personal data, where applicable.

Participation in the BRIDGE Survey is voluntary.

Participants are informed about the purposes of processing before submitting their responses.

Where explicit consent is required, it is obtained through a separate affirmative action.

Consent may be withdrawn at any time with effect for the future.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

19. BRIDGE Survey – Profiling and Assessment

The BRIDGE Model evaluates submitted responses and assigns an individual result within six defined levels.

Where automated processing is used to evaluate personal characteristics, attitudes, or behavioural tendencies, this constitutes profiling within the meaning of Article 4(4) GDPR.

Purpose: Educational feedback, self-reflection, and personal development.

The assessment depends on the answers submitted and the limitations of the underlying methodology.

It does not represent a clinical diagnosis, a scientifically definitive character assessment, or an objective determination of whether a person is racist.

The results are not used to determine eligibility for employment, education, insurance, credit, or other similarly significant opportunities.

We do not use BRIDGE results to make solely automated decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR.

20. BRIDGE Survey – Long-Term Storage and Historical Results

We use your email address to associate your responses and results with your participation.

We intend to retain historical survey answers and assessments so that returning participants can retrieve earlier results and compare their personal development over time.

This functionality requires a continuing association between your email address and the relevant assessment records.

Identifiable survey information is retained only while the stated purposes remain applicable, a valid legal basis exists, and continued retention complies with the GDPR.

We review whether continued identifiable storage is necessary and whether the original purpose remains applicable.

Survey information is deleted or anonymised when no longer necessary, when applicable consent is withdrawn and no other legal basis permits retention, or when deletion is otherwise required by law.

The specific retention and review arrangements must be defined and documented as part of our internal data protection procedures.

21. BRIDGE Survey – Confidentiality, Research and Disclosure

Individual survey answers and results are not made publicly available.

We do not disclose identifiable BRIDGE results to employers, educational institutions, commercial partners, or other third parties for their independent purposes without an appropriate legal basis.

Authorised technical service providers may process survey information on our behalf where necessary to operate the survey and subject to applicable data protection requirements.

We may use effectively anonymised and aggregated findings to evaluate and improve our educational initiatives, provided that individuals can no longer reasonably be identified.

Where identifiable survey information is used for additional research, development, or improvement of the BRIDGE Model beyond the purposes originally communicated, we establish an appropriate legal basis and obtain additional consent where required.

Participation in the BRIDGE Survey does not automatically constitute consent to receive newsletters, promotional messages, or personalised advertising.

22. BRIDGE Survey – Withdrawal and Data Protection Rights

Participants may withdraw their consent at any time with effect for the future.

They may also exercise applicable rights of access, rectification, erasure, restriction of processing, and data portability.

Requests may be submitted to:

ggprayer.label@gmail.com

Where consent is the only legal basis for continued processing, the relevant personal data will be deleted unless another legal basis permits or requires retention.

23. AI-Assisted Image Creation and Editing

MIVOR uses ChatGPT, provided by OpenAI, to create and edit visual content for fashion campaigns, our website, social media, and marketing materials.

This includes the generation of entirely synthetic images and the editing of existing photographs.

23.1 Processing of Identifiable Photographs

Where photographs of identifiable individuals are uploaded to ChatGPT, the photographs and associated instructions may constitute personal data.

Purpose: Creating, adapting, and publishing fashion and promotional materials.

The applicable legal basis depends on the circumstances and relevant agreements with the individuals depicted.

Where required, we obtain consent under Article 6(1)(a) GDPR.

We also respect applicable image rights and contractual permissions concerning the use, modification, and publication of photographs.

23.2 AI Service Provider

OpenAI – ChatGPT

Privacy information: https://openai.com/policies/privacy-policy/

Uploaded information may be processed by OpenAI and its service providers in accordance with the applicable service terms, account settings, and contractual arrangements.

Depending on the service configuration, processing may involve international data transfers subject to Chapter V GDPR.

23.3 Data Minimisation and Retention

We limit uploads of identifiable photographs to what is necessary for the relevant creative purpose.

Access to source photographs and AI-assisted materials is restricted as appropriate.

Retention within ChatGPT depends on the account type, service settings, and applicable deletion practices.

23.4 Transparency

Where legally required, we provide appropriate information about artificially generated or manipulated visual content.

AI-assisted imagery is used for creative and promotional purposes and is not intended to mislead viewers about real events or individuals.

24. Recipients and Service Providers

We share personal data only where necessary and legally permitted.

Depending on the services used, recipients may include:

  • Website hosting and technical service providers
  • Payment service providers
  • Shipping and logistics providers
  • IT maintenance and security providers
  • Newsletter and email marketing providers
  • Analytics and advertising providers, subject to applicable consent requirements
  • Technical providers operating the BRIDGE Survey
  • AI service providers where identifiable photographs are processed
  • Accounting and professional service providers
  • Public authorities where legally required

Where a service provider processes personal data on our behalf, we enter into an agreement under Article 28 GDPR where required.

We do not sell personal data.

25. International Data Transfers

Some service providers may process personal data outside the European Economic Area, including in the United States.

Where such transfers occur, we comply with Chapter V GDPR.

Depending on the provider and circumstances, applicable transfer mechanisms may include:

  • An adequacy decision under Article 45 GDPR.
  • The EU-US Data Privacy Framework, where applicable to the recipient and processing.
  • Standard Contractual Clauses under Article 46 GDPR.
  • Other lawful transfer mechanisms under Chapter V GDPR.

Additional safeguards may be necessary depending on the circumstances.

The specific transfer mechanisms applicable to individual providers depend on their contractual arrangements and current certification status.

26. Data Retention and Deletion

We retain personal data only for as long as necessary for the relevant processing purpose or as required by law.

Orders and accounting: Records are retained according to applicable German tax and commercial law. Depending on the type of record, statutory retention periods may be six, eight, or ten years.

Customer accounts: Information is retained while necessary to provide the requested account functionality and comply with applicable obligations.

Customer communications: Information is retained according to the purpose of the communication and applicable legal requirements.

Newsletter subscriptions: Data is retained while the subscription remains active. Limited records may be retained after withdrawal where necessary to document consent, withdrawal, or objections.

Server logs and technical data: Retention depends on the actual hosting configuration and relevant security requirements.

BRIDGE Survey: Identifiable responses and results may be retained for long-term retrieval and comparison, subject to a valid legal basis, periodic necessity reviews, and applicable deletion rights.

AI-related materials: Retention depends on the relevant creative purpose, contractual arrangements, and applicable service settings.

Personal data is deleted or anonymised when the relevant purpose no longer applies and no other legal basis permits or requires continued retention.

27. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, and unlawful disclosure.

Depending on the relevant processing activity, these measures may include:

  • Encrypted connections
  • Access restrictions
  • Authentication controls
  • Software updates
  • Appropriate backup arrangements
  • Technical security measures
  • Measures to prevent unauthorised disclosure

BRIDGE Survey information requires particular protection because responses may contain special-category personal data.

No internet-based system can guarantee absolute security.

28. Your Data Protection Rights

Under the GDPR, you have the following rights, subject to applicable legal conditions:

  • Right of access under Article 15 GDPR.
  • Right to rectification under Article 16 GDPR.
  • Right to erasure under Article 17 GDPR.
  • Right to restriction of processing under Article 18 GDPR.
  • Right to data portability under Article 20 GDPR.
  • Right to object under Article 21 GDPR.
  • Right to withdraw consent under Article 7(3) GDPR.
  • Right to lodge a complaint with a competent supervisory authority under Article 77 GDPR.

Where personal data is processed for direct marketing, you may object to that processing at any time.

You may exercise your rights by contacting:

ggprayer.label@gmail.com

29. Supervisory Authority

You have the right to lodge a complaint with a competent data protection supervisory authority.

For MIVOR’s location in Hesse, Germany, the relevant supervisory authority is:

The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)

Website: https://datenschutz.hessen.de/

You may also contact another competent supervisory authority in accordance with applicable law.

30. Automated Decision-Making

We do not use personal data to make solely automated decisions producing legal effects concerning individuals or similarly significantly affecting them within the meaning of Article 22 GDPR.

The BRIDGE Survey involves an individual assessment based on submitted responses.

The purpose, nature, and limitations of this assessment are explained in Sections 16–22 of this Privacy Policy.

31. Obligation to Provide Personal Data

Certain personal data is necessary to place orders and fulfil purchase contracts.

Without the information required for billing, payment, or delivery, we may be unable to process an order.

Providing data for optional marketing, analytics, or newsletter subscriptions is not a contractual requirement.

Participation in the BRIDGE Survey is voluntary.

Providing the required survey information and consent is necessary to receive an individual BRIDGE assessment.

32. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technologies, or applicable legal requirements.

The latest version will be published on our website with its date of revision.

Where required by law, we will provide additional information or obtain renewed consent before introducing relevant changes.