Privacy policy
Last updated: August 17, 2026
1. OVERVIEW
This Privacy Policy describes how Marbury Lane ("Company," "we," "us," or "our") collects, uses, discloses and protects personal information when you visit, use or make a purchase from our website or otherwise interact with our services (the "Services").
Our online store is hosted by Shopify Inc., which provides the ecommerce platform enabling us to sell our products and services. Shopify acts as a data processor on our behalf.
This Policy also serves as our Notice at Collection for California residents.
2. DATA CONTROLLER
Data Controller:
Jakob Leuchtweis (trading as Marbury Lane)
Neuhauser Straße 7a
78576 Emmingen-Liptingen
Germany
Email: support@marburylane.com
We have not appointed a Data Protection Officer, as we are not required to do so.
3. PERSONAL INFORMATION WE COLLECT
Information you provide directly
Name
Billing and shipping address
Email address and phone number
Order and payment details. Payment card details are collected and processed by our payment providers, not by us
Customer support communications
Content you submit, such as reviews, photographs or videos
Personalization information
Text you submit to be engraved or applied to a product, including names, initials, dates, short messages and any artwork
A birth month, or a date of birth, where you provide one so that we can select the correct birthstone for an item
Any note or message you ask us to include with a gift
Gift recipient information
Where you place an order to be shipped to someone else, the recipient's name, shipping address and, where you provide it, their phone number. You are responsible for having a proper basis to share another person's details with us, and by providing them you confirm that you do
Information collected automatically
IP address
Browser, device, operating system and screen information
Website usage and interaction data, including pages viewed, products viewed, items added to cart, clicks, scrolling, cursor movement and time on page
Session recordings and heatmaps. See section 8
Referring URL and advertising click identifiers
Cookies and similar tracking technologies
Information from third parties
Advertising and analytics partners, including measurement and attribution data
Fraud prevention signals from Shopify and our payment providers
Carriers, for delivery status
What we do not collect. We do not collect government identifiers, financial account numbers, biometric data, precise geolocation, or information about your health, race, sexual orientation or union membership.
4. SENSITIVE INFORMATION, RELIGION AND BIRTH DATES
Two things about our product range deserve their own section, because they are the points at which ordinary shopping data could become sensitive data.
Faith jewelry and religious belief. We sell a sub-collection of jewelry using religious symbols, The Faith Edit. What you browse or buy from that collection could, in principle, support an inference about your religious beliefs. Religious or philosophical belief is special category data under Article 9 of the GDPR and sensitive personal information under California law, and we treat it accordingly:
We do not ask you about your religion and we do not record it
We do not use a purchase from, or a visit to, that collection to infer, label, segment or score your religious beliefs
We do not build or use advertising audiences, custom audiences or exclusion lists defined by religion or by faith-collection activity, and we do not ask any advertising platform to target on the basis of religion
We do not disclose faith-collection purchase or browsing activity to any third party for the purpose of inferring belief
Our advertising and analytics partners nonetheless receive product-level event data about your visit, as described in section 8, in the same way that they do for every other product we sell. If you would prefer that they did not, opt out as described in section 8 or section 13, or use your browser's tracking controls, before browsing.
Birth dates and birth months. Where you give us a birth month or a date of birth, it is used for one purpose: selecting the correct birthstone for the item you are ordering, and reproducing a date you asked us to engrave. It is not used to profile you, to estimate your age for advertising, to verify your age, or for any purpose other than fulfilling your order. Where a birth date belongs to someone other than you, for example a child or a parent whose birthstone you are buying, you are responsible for having a proper basis to give it to us.
Neither of the above is used for automated decision-making about you.
5. LEGAL BASES FOR PROCESSING (GDPR)
Our operator is established in Germany, so the EU General Data Protection Regulation applies to our processing regardless of where you are located. We process personal data on the following legal grounds:
Performance of a contract, for order processing, personalization, production and fulfillment, and customer support
Compliance with legal obligations, for tax, accounting, product safety and consumer protection purposes
Legitimate interests, for fraud prevention, site security, analytics, service improvement, direct marketing, and establishing or defending legal claims
Consent, for email and SMS marketing, and for certain tracking technologies where consent is required
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
6. HOW WE USE PERSONAL INFORMATION
We use personal information to:
Process and fulfill orders, including producing personalized items, and handle returns and refunds
Provide customer support, including sizing, care and order enquiries
Send transactional communications, including order confirmations, proofs for approval, dispatch notices and tracking
Improve and optimize our Services, including through analytics and session review
Prevent, detect and investigate fraud and abuse, including return and refund abuse
Comply with legal and regulatory obligations
Conduct marketing and advertising activities, including measuring and targeting advertising, subject to section 4
Establish, exercise or defend legal claims
We do not use personal information to train third-party artificial intelligence models, and we do not sell personal information for money.
7. CATEGORIES OF PERSONAL INFORMATION (CCPA / CPRA)
Within the past 12 months, we have collected the following categories:
Identifiers, including name, email address, postal address, phone number, IP address, and device and cookie identifiers
Customer records, including billing and shipping details and order history
Commercial information, including products purchased, considered or added to cart, personalization submitted, and return history
Internet or other electronic network activity, including browsing and interaction data and session recordings
Approximate location data derived from IP address
Inferences drawn to create a profile reflecting preferences and behavior, used for analytics and advertising, subject to the limits in section 4
Sources are: you directly, your device automatically, and our service providers and advertising partners.
We disclose these categories to: our ecommerce platform, payment processors, fulfillment, production and shipping partners, advertising and analytics providers, and legal or regulatory authorities where required.
Sale and sharing of personal information
We do not sell personal information for monetary consideration.
We do share personal information with advertising and analytics partners for cross-context behavioral advertising, including measuring advertising performance and delivering relevant ads. Under California, Colorado, Connecticut, Texas and other state privacy laws, this may be considered a "sale," "sharing" or "targeted advertising."
You have the right to opt out. See section 13.
8. TRACKING, COOKIES, SESSION RECORDING AND ADVERTISING
PLEASE READ THIS SECTION. IT DESCRIBES TECHNOLOGY THAT RECORDS HOW YOU USE THIS WEBSITE.
We use cookies, pixels, tags, SDKs and similar technologies provided by third parties, including:
Meta Pixel (Meta Platforms, Inc.)
Google Ads and Google Analytics (Google LLC)
TikTok Pixel (TikTok Inc.)
Microsoft Clarity (Microsoft Corporation)
Shopify Analytics (Shopify Inc.)
Triple Whale (Triple Whale, Inc.)
Session recording and heatmaps. Microsoft Clarity is a behavioral analytics tool that records your interaction with our website, including cursor movement, clicks, taps, scrolling, page navigation and the content displayed on the pages you view, and reconstructs it as a session replay that we can watch to understand how visitors use the site. Text you type into form fields is masked by the tool's default settings, but you should not enter information into any field on this site that you would not want recorded. That includes any engraving or personalization text, which we ask you to submit only through the fields provided for it. This data is processed by Microsoft and is subject to Microsoft's privacy practices.
Advertising and measurement. The Meta, Google and TikTok technologies transmit information about your visit, including pages and products viewed and actions taken such as adding to cart or purchasing, to those companies. Those companies use that information for our advertising measurement and targeting and also for their own purposes in accordance with their own privacy policies. Triple Whale receives order and site interaction data to attribute sales to advertising. See section 4 for the limits we place on how product-level data about our faith collection is used.
When these technologies operate. These technologies currently load and begin operating when you open a page on our website, before you take any action. We do not currently present a pre-consent blocking cookie banner to visitors in the United States. If you do not wish this to happen, you can opt out as described in section 13, use your browser's cookie and tracking controls, transmit a Global Privacy Control signal, or use industry opt-out tools including optout.aboutads.info and youradchoices.com. You can also opt out of Microsoft Clarity using your browser's controls or Microsoft's opt-out page.
Where required by applicable law, including the GDPR and the ePrivacy Directive, tracking technologies are deployed only after consent via our cookie consent mechanism.
We honor Global Privacy Control (GPC) signals as a valid request to opt out of sale and sharing for the browser transmitting the signal.
9. PAYMENT PROCESSORS
Payments are processed by secure third-party payment providers.
We do not store full payment card numbers or sensitive payment credentials on our servers.
10. DISCLOSURE OF PERSONAL INFORMATION
We may share personal information with:
Shopify and ecommerce service providers
Payment processors
Fulfillment, production, dropshipping and shipping partners, including partners located in China, who receive the name, address, phone number and order contents needed to produce and ship your order. Where an item is personalized, this necessarily includes the engraving text, name, initials, date or artwork you submitted, and where an order is a gift, it includes the recipient's details
Advertising and analytics providers
Professional advisers, including lawyers and accountants
Legal or regulatory authorities when required by law, and in connection with establishing or defending legal claims
A successor entity in connection with a merger, acquisition or sale of assets
All service providers process personal data under contractual obligations consistent with applicable privacy and data protection laws.
11. DATA RETENTION
We retain personal information only for as long as necessary for the purposes described in this Policy or as required by law:
Order and transaction data: up to 10 years, reflecting German commercial and tax retention obligations
Personalization records, including engraving text, submitted dates and approved proofs: retained with the order record, for the same period, because they are part of the record of what we sold you and are the evidence in any dispute about whether the item matched your instruction
Gift recipient details: retained with the order record
Customer support communications: up to 3 years
Marketing data: until consent is withdrawn or an opt-out occurs, after which a suppression record is kept so that we continue to honor it
Analytics data: up to 26 months
Session recordings: up to 30 days, in line with the tool's default retention
Legal or regulatory obligations, or the defense of legal claims, may require longer retention in certain cases.
12. YOUR RIGHTS UNDER GDPR
If you are located in the European Economic Area or the United Kingdom, you have the right to:
Access your personal data and receive a copy
Correct inaccurate or incomplete data
Request deletion of your data
Request data portability
Restrict or object to certain processing, including direct marketing, which you may object to at any time
Withdraw consent at any time where processing is based on consent
To exercise these rights, contact support@marburylane.com. We respond within one month, extendable by two further months for complex requests.
You also have the right to lodge a complaint with a supervisory authority. Our competent authority is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
You may also complain to the authority in your own country of residence or place of work.
13. UNITED STATES PRIVACY RIGHTS
Residents of United States states with comprehensive privacy laws, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, have rights that may include:
The right to know what personal information we collect, use and disclose
The right to access a copy of your personal information
The right to correct inaccurate personal information
The right to delete personal information
The right to data portability
The right to opt out of the sale or sharing of personal information and of targeted advertising
The right to limit the use of sensitive personal information
The right not to receive discriminatory treatment for exercising these rights
Do Not Sell or Share My Personal Information. To opt out of the sale or sharing of your personal information and of targeted advertising, email support@marburylane.com with the subject line "Do Not Sell or Share," or transmit a Global Privacy Control signal from your browser, which we honor automatically for that browser.
How to submit a request. Email support@marburylane.com. We may verify your identity before processing a request and may require additional information for security purposes. Authorized agents may submit requests on your behalf where permitted by law, with proof of authorization.
A note on deletion and personalized orders. Where you ask us to delete personal information, we may need to retain the order and personalization record for the retention period in section 11, because retaining it is necessary to comply with our legal obligations, to complete the transaction, and to defend against a claim that an item did not match what you asked for. We will delete what we can and tell you what we have kept and why.
Timing and appeals. We respond within 45 days, extendable by a further 45 days where reasonably necessary, with notice to you. If we decline a request, you may appeal by replying to our response with the word "Appeal." We will respond to an appeal within the period required by your state's law and will tell you how to contact your state Attorney General if you disagree with the outcome.
California Shine the Light. California residents may request information about disclosures of personal information to third parties for their direct marketing purposes under California Civil Code section 1798.83 by emailing support@marburylane.com.
Financial incentives. If we offer a discount or other benefit in exchange for signing up for marketing, participation is voluntary, you may withdraw at any time by unsubscribing, and the value of the incentive is reasonably related to the value of the data you provide, estimated by reference to the cost of the discount offered.
14. INTERNATIONAL DATA TRANSFERS
Personal data is transferred internationally as an inherent part of how we operate. Our operator is in Germany, our platform and several service providers are in the United States, and our fulfillment and production partners are primarily in China.
For personalized items this means that the text, name, initials, date or artwork you submit, and the recipient details for a gift order, are transmitted to a production partner outside the European Economic Area in order to make the item. There is no way to produce a personalized item without doing so.
Where required, such transfers are safeguarded through the European Commission's Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms, together with supplementary measures where appropriate.
15. SECURITY
We implement reasonable administrative, technical and organizational safeguards designed to protect personal information.
However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.
If a data breach affecting your personal information occurs, we will notify you and the relevant authorities where required by applicable law.
16. CHILDREN'S PRIVACY
The Services, including this website, are directed exclusively at adults. You must be at least 18 years old to purchase. The Services are not directed at children under the age of 13.
We do not knowingly collect personal information from children under 13. If such data is identified, it will be deleted promptly.
Where an adult customer submits a child's name, initials or date of birth to be engraved on a gift, that information is provided by the adult purchaser in the course of their own transaction, is used only to produce the item, and is retained with the order record. It is not used for marketing, profiling or advertising of any kind, and we do not contact the child.
This Policy does not create any obligation under the Children's Online Privacy Protection Act with respect to online collection of data from child visitors, as the Services are not directed at children and we do not have actual knowledge that we are collecting data from users under 13.
We do not knowingly sell or share the personal information of consumers under 16 years of age.
17. AUTOMATED DECISION-MAKING
We do not engage in profiling that produces legal or similarly significant effects concerning you, with one exception: orders are subject to automated fraud screening by our ecommerce platform and payment providers, which may result in an order being flagged, held or canceled.
If an order of yours is canceled on that basis, you may contact support@marburylane.com to ask for a human review of the decision and to contest it. You are always refunded in full for an order canceled this way.
18. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time.
Any changes will be posted on this page with an updated "Last updated" date. Material changes will be brought to your attention where required by law.
19. CONTACT
For privacy-related inquiries or to exercise your rights, contact:
Email: support@marburylane.com