Privacy policy

Last updated: 22 October 2026

This Privacy Policy explains how Pink Universe processes personal data when you visit pink-universe.com, place an order or contact us. Simply using this website does not constitute consent to advertising or other optional processing of personal data.

1. Controller and contact

The controller responsible for the processing by Pink Universe described below is:

Gökhan Vodinali, trading as Vodinali Ventures
Gäbelbachstrasse 39
3027 Bern
Switzerland
Email: support@hemelion.com

You can use these contact details to ask privacy questions and exercise your rights.

2. Visiting the website

When you access the website, technical data transmitted by your browser to the shop platform is processed. This includes your IP address, browser and device information, pages accessed, time of access and technical usage events. This data is used to deliver the website, maintain its functions and detect errors and misuse. Language and privacy preferences are taken into account so that the website can remember your choices.

Further evaluation of your use of the website for analytics, personalisation or advertising depends on your choices in the cookie settings. The relevant Shopify functions are explained below.

3. Enquiries by form or email

If you write to us using the contact form or by email, we process your email address, the name you provide, the content of your message and any other details you submit yourself. We process a telephone number for your enquiry only if you provide one. We use this information to answer your enquiry, maintain the context of our correspondence and, where relevant, address legal claims arising from it.

The contact form is provided through Shopify. We use Google Workspace for the support@hemelion.com mailbox. Google processes message content and the sender, recipient and technical data required for email communications as a service provider. Contacting us does not sign you up for advertising. Please do not send payment details or identity document copies without being asked.

3a. Orders, payments and returns

When you place an order, we process the contact, billing and delivery details you enter at checkout, ordered items and variants, prices, payment and order status, and related correspondence. We need this information to accept and process orders, handle enquiries, arrange delivery, manage returns and refunds, keep accounts and investigate fraud or legal claims. Required fields are identified at checkout. We cannot fulfil an order without the details needed to process it.

Shopify provides our checkout and order management. Shopify Payments is configured for payment processing. Depending on your chosen payment method, payment and transaction data is also processed by the payment service providers, card networks or wallet providers involved. We receive the payment and transaction information needed to handle your order. Please do not send full card details by email or through the contact form. Additional services such as Shop Pay are also subject to the relevant provider’s privacy information; Shopify information is linked in section 4.

For direct deliveries, we use DSers to manage orders and shipping with suppliers on AliExpress. DSers, AliExpress, the relevant supplier and the carriers involved receive the recipient and delivery details and item and order data needed to procure and deliver the goods. Information about processing abroad is provided in section 6.

3b. Newsletters and marketing consent

If you expressly sign up for email marketing, we process your email address, your name if provided, and your sign-up time and consent status through Shopify. Double opt-in is enabled: you confirm your sign-up using the email sent for this purpose. Placing an order or contacting us does not by itself subscribe you to our newsletter.

You can withdraw consent for the future at any time using the unsubscribe link in our marketing emails or by writing to support@hemelion.com. Order-related messages, such as payment, delivery or return information, are independent of this consent. We retain consent records and unsubscribe status to the extent needed to respect your choices or deal with legal claims.

4. Shopify as our shop platform

Our website is hosted by Shopify. Shopify processes visit and usage data to provide and secure the website and operate its functions. According to Shopify, data from Switzerland is initially processed by Shopify International Limited in Ireland. For the operation of our shop, Shopify generally processes data on our behalf. The installed Shopify Translate & Adapt application is used to manage our translated shop content.

Shopify Network Intelligence is enabled. Through this feature, Shopify incorporates data from interactions with our shop, other merchants and Shopify to provide enhanced services for analytics, personalisation, performance improvements and advertising. Shopify acts as an independent controller for this processing. Use for purposes that require consent, particularly advertising across merchants, depends on your explicit choice; it is not authorised simply by visiting the website.

For further information, see the Shopify Consumer Privacy Policy. You can also exercise rights relating to Shopify’s processing as an independent controller through the Shopify Privacy Portal.

5. Cookies and your choices

Cookies and similar technologies store information on your device or read it from your device. Technically necessary functions support a secure session, protection against misuse and the storage of your privacy choices. Other technologies are used to analyse website usage, personalise the experience or provide advertising.

The cookie banner lets you select “Accept”, “Decline” or “Manage preferences” to choose optional purposes. Non-essential processing through the Shopify technologies controlled by this banner requires your corresponding consent. You can continue to use the website’s necessary functions after rejecting optional processing. You can change your choices later using “Cookie preferences” in the website footer and withdraw consent for the future. Withdrawal does not affect the lawfulness of processing that has already taken place.

Information about Shopify’s cookies, their purposes and their individual lifetimes is available in the Shopify Cookie Policy. You can also delete or block cookies in your browser; blocking necessary cookies may prevent some functions from working.

6. Service providers and processing abroad

Shopify and its technical subprocessors receive the data needed to operate the website. Google Workspace and its technical service providers receive the relevant communication data for our email correspondence. Within our business, we use this data to deal with your enquiries and operate the website. Data is disclosed to authorities where we are legally required to do so.

The DSers app is installed in Shopify to connect suppliers and manage orders and shipping. The provider’s documentation identifies Nebulapart Ltd with an address in Hong Kong. Its app permissions cover shop and owner information, together with customer contact, device and activity data and order and shipping data held in Shopify. DSers states in its Privacy Policy that data is processed in the United States.

According to our Shopify setting, the primary storage location for shop and customer data is the European Union. This does not mean that all processing takes place exclusively there. Shopify uses entities and technical service providers outside the EU and Switzerland, particularly in Canada and the United States. The Shopify subprocessor list identifies the recipients, their countries and their roles.

Google Workspace also operates through international infrastructure, including entities in Ireland and the United States. The recipients and processing countries designated for each service are set out in the Google Workspace subprocessor list. The activities described there distinguish, in particular, technical operation from support access requested by us.

Shopify’s and Google’s data protection terms provide for recognised safeguards for their cross-border processing. For countries without a recognised adequate level of protection, these include standard data protection clauses and the adaptations required for Swiss data, or other permitted transfer mechanisms. Details are set out in the Shopify Data Processing Addendum and the Google Cloud Data Processing Addendum. You can contact us about the recipients, countries and safeguards relevant to your data.

7. Retention and security

We retain correspondence for as long as it is needed to handle and follow up your enquiry. Once the matter is closed, personal data that is no longer needed is deleted unless a statutory retention obligation or a specific need to establish or defend legal claims requires otherwise. Such data is retained only for the remaining purpose.

Technical platform data and cookies have different retention periods; cookie lifetimes are listed in the Shopify policy linked above. We protect our systems and access credentials through appropriate technical and organisational measures. Absolute security during data transmission or storage cannot be guaranteed.

Order, payment and return records are retained to perform the contract and subsequently for as long as statutory retention obligations or the establishment or defence of legal claims require. Retention for these purposes is independent of marketing consent.

8. Your rights

Under applicable data protection law, you can request information about your personal data and its processing, and request correction of inaccurate data. You can request deletion and object to processing. We review such requests; statutory retention obligations or other permitted grounds may prevent deletion or require processing to continue. Subject to the relevant statutory conditions, you also have rights to receive or transfer your data and to restrict processing. You can withdraw consent for the future.

To exercise your rights, write to support@hemelion.com or to our postal address above. We will review your request and ask only for information needed to identify you securely. Under Swiss law, information is normally provided within 30 days and free of charge. We will inform you if a statutory exception or a delay applies.

You can also raise privacy concerns with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or another supervisory authority competent for you. This policy does not restrict statutory rights.

9. Changes

We update this policy when actual processing practices or legal requirements change. The date above identifies the version. We will provide additional notice of changes where required by applicable law.