Privacy policy

Sect. 1 General

We will process your personal data (name, phone number, address, country, e-mail address, records related to after-sales service and customer service, product serial number, product certification date, product purchase date, and — if you participate in the hurome membership programme — the membership data described in Sect. 8) solely in accordance with the provisions of the German data protection law and the data protection law of the European Union (EU). The following provisions will inform you, besides the information about the processing purposes, recipients, legal bases and storage periods, also about your rights and the controller for your data processing. This privacy policy applies to our websites and to the hurome membership programme (loyalty, rewards and referral) operated through them, including the member account, the earning, conversion and expiry of points, the membership tier system and the referral programme. It does not apply to other websites. If you are directed to other sites via links on our pages, please familiarise yourself with the respective use of your data there.

Sect. 2 Inventory data

(1) Purpose of data processing

Your personal data you provide us during the ordering process are necessary for the conclusion of a contract with us. You are not obliged to provide your personal data. Without the recipient's name and address, however, we could not send you the goods. For some payment methods we ask for the necessary payment data in order to pass them on to a payment service provider commissioned by us. Hence, the processing of your data collected during the ordering process is solely for the purpose of contract performance. If you send us a request by e-mail or by using the contact form, etc. before concluding the contract, we process the obtained data to carry out pre-contractual measures and answer your questions about e.g. our products.

(2) Legal basis

The legal basis for such processing is set out in Article 6 (1) (b) of the GDPR.

(3) Recipient categories

(a)Payment service provider, shipping service provider, hosting provider, if necessary merchandise management system, suppliers if necessary (drop-shipping), service provider in Korea for after-sales service (AS) and customer service (CS) purposes.

(b) (b) Transfer of personal data to Korea (Adequacy Decision) For the purpose of providing after-sales service (AS) and customer service (CS), your personal data may be transferred to a contracted service provider (processor) located in the Republic of Korea.

The personal data will be processed on our behalf by the following recipients (processors):

• Hurom LS Co., Ltd., 205, Dogok-ro, Gangnam-gu, Seoul, Republic of Korea
• Concentrix Services Korea Limited, 509, Teheran-ro, Gangnam-gu, Seoul 06169, Republic of Korea

This transfer is based on the European Commission’s Adequacy Decision for the Republic of Korea pursuant to Article 45 GDPR.

The transferred data may include the following categories: name, contact details, address, purchase and service records, product serial number, product certification date and product purchase date.

The data will be stored only for as long as necessary to fulfil the AS/CS purposes, in particular until the completion of the service request and the expiry of applicable warranty and statutory retention periods, and will then be deleted, unless statutory retention obligations apply. You may exercise your rights of access, rectification, erasure, restriction of processing or objection by contacting us at huromparts@hurom-europe.com or the above-mentioned processors.

(4) Duration of storage

We store the data required for the performance of the contract until the expiry of the statutory warranty periods and, where applicable, until the expiry of the voluntary guarantee periods we grant (up to 15 years depending on the model). We store the data required under commercial and tax law for the statutory periods, generally ten years (cf. § 257 German Commercial Code (HGB), § 147 Regulation of Taxation (AO)).
The data processed for the execution of pre-contractual measures will be deleted as soon as the measures have been carried out and the contract cannot be concluded.

Sect. 3 Further information

You may revoke your consent at any time with effect for the future by e-mail.

Sect. 4 Payment service providers

We use the following payment service providers for payments on our website. Your payment data is processed directly by the respective provider; we do not receive full card or account details. The legal basis for the processing is Art. 6(1)(b) GDPR (performance of a contract).

• Credit card, Shop Pay and Google Pay: card and express payments are processed via Shopify Payments, a service of Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, Ireland. If you use Google Pay, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, additionally processes your wallet data. Details: https://www.shopify.com/legal/privacy
• PayPal: payments via PayPal (including PayPal Express) are processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. All PayPal transactions are subject to the PayPal Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
• Klarna: if you select Klarna, you will be redirected to Klarna. The data required for payment processing (contact and order data) is transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden; Klarna is independently responsible for this processing. Details: https://www.klarna.com/en-de/privacy/

Sect. 5 Information about cookies

(1) Categories of cookies we use

Our website uses cookies and comparable technologies. We distinguish four categories. Necessary cookies enable core functions such as security, page navigation, access to protected areas and the shopping basket; they cannot be switched off. Statistics cookies help us understand how visitors use our website so that we can improve it. Marketing cookies are used to deliver relevant content and advertising and to measure the effectiveness of our campaigns; they may track your activity across websites. Preference cookies store your choices, such as language settings.

(2) Legal basis

Necessary cookies are used on the basis of Article 6(1)(f) GDPR (our legitimate interest in a functioning and secure website) in conjunction with Section 25(2) of the German Digital Services Data Protection Act (TDDDG). All other cookies — statistics, marketing and preferences — are used only with your consent, on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG. You are not obliged to consent, and you suffer no disadvantage if you do not.

(3) Withdrawing your consent

We use the consent management tool Consentmo GDPR to obtain and manage your consent. You may change or withdraw your choices at any time via the “Cookie settings” link in the footer of our website. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal. You can also delete cookies at any time in your browser settings.

(4) Duration of storage

Necessary session cookies are deleted when you close your browser. Persistent cookies have storage periods ranging from a few minutes to several years, depending on their purpose. The storage period of each individual cookie is stated in the cookie list referred to in paragraph (5).

(5) Cookie list

A current list of the cookies used on our website — including the name, provider, purpose and storage period of each cookie — is available in the cookie settings on our website.

Sect. 6 Links to social networks

In the footer of our website we link to our profiles on social networks, for example Instagram. These are plain links and not social plugins: no content is loaded from the providers, and no personal data are transmitted to them when you merely visit our pages. Only when you click on such an icon do you leave our website; from that point the privacy policy of the relevant provider applies.

Sect. 7 Newsletter

(1) Purpose of data processing

When registering for the newsletter, your e-mail address will be used for advertising purposes, i.e. the newsletter will inform you in particular about products from our product range. For statistical purposes we may evaluate which links are viewed in the newsletter. However, it is not recognizable for us, which concrete person has accessed the links. You have expressly given this consent as a separate declaration. Sending begins only after you have confirmed your subscription via the confirmation e-mail (double opt-in). Where you are a member of the hurome membership programme, the newsletter points under Section 3.3 of the Program Terms are credited at that time.

(2) Legal basis

The legal basis for such processing is set out in Article 6 (1) (a) of the GDPR.

(3) Recipient categories

If necessary: Newsletter provider

(4) Duration of storage

Your e-mail address will only be stored for the respective duration of your registration.

(5) Right of revocation

You may revoke your consent at any time with effect for the future. If you no longer wish to receive the newsletter, you may unsubscribe as follows: By a log-out link at the bottom of the email.

Sect. 8 hurome Membership Program (Loyalty, Rewards and Referral)

(1) Scope

This Section applies to the processing of personal data in connection with the hurome membership programme (loyalty, rewards and referral). It covers the registration for and administration of your membership, the earning, conversion, redemption and expiry of hurome points, the determination of your membership tier, the referral programme and the issuing of discount codes. It supplements Sect. 1 to Sect. 7 above. Where this Section and another Section of this privacy policy both apply, both apply side by side.

(2) Purpose of data processing

We process your personal data in order to

(a) establish and administer your membership and your member account;

(b) calculate, credit, hold, deduct and expire hurome points, and to determine and update your membership tier;

(c) issue, convert, redeem and cancel the discount codes derived from points, and to reverse point entries in the event of returns, cancellations or refunds;

(d) inform you in advance of the forthcoming expiry of your points and of changes to your tier, to the programme or to the programme terms;

(e) verify referrals, that is to say to establish the link between a referring member and a referred person and to determine whether the conditions for a referral reward are met;

(f) prevent, detect and investigate abuse of the programme — in particular the use of multiple accounts, self-referral, the repeated obtaining of benefits which are granted only once per person, and returns made solely in order to retain a benefit — and to apply the measures provided for in the programme terms;

(g) prevent the repeated issuing of a welcome benefit which is granted only once per person, including after an account has been deleted;

(h) answer your enquiries relating to the programme, including appeals against measures taken under (f);

(i) inform you of product safety matters, including safety warnings and recalls relating to a product you have purchased or registered; and

(j) comply with our retention obligations under commercial and tax law.

(3) Categories of personal data processed

In addition to the data referred to in Sect. 1 and Sect. 2, we process, for the purposes set out in paragraph (2):

• your membership status, the date on which you joined the programme and, where applicable, the date on which your membership ended;
• the serial number of your Hurom appliance, the date of product registration and the date of purchase;
• your point balance and the complete history of points earned, converted, redeemed, reversed and expired, including the date, amount and reason of each entry;
• your cumulative earned points, your membership tier and the history of changes to that tier;
• your purchase history to the extent required for the programme: order number, order date, order value, the products contained in the order, and any returns, cancellations or refunds;
• referral data: the identifier of the referral link allocated to you, the link between a referring member and a referred person, and the date, value and status of the referred order;
• discount code data: the codes issued to you, their value, their period of validity, their status, and the order in which a code was used;
• whether you have consented to receive marketing information, the time and the wording of that consent and, where applicable, the time at which you withdrew it; and the status of your newsletter subscription including the time at which the subscription was confirmed;
• records of your communications with us relating to the programme.

(4) Legal basis

• Establishment and administration of the membership; earning, conversion, redemption and expiry of points; determination of the membership tier; advance notice of expiry and of changes; verification of referrals and granting of referral rewards; issuing of welcome and referral discount codes; handling of enquiries relating to the membership — Article 6(1)(b) GDPR (performance of the membership contract to which you are party, and steps taken at your request prior to entering into it).
• Sending of marketing information and of the newsletter — Article 6(1)(a) GDPR (your consent; see also Sect. 7).
• Prevention, detection and investigation of abuse of the programme; application of the measures provided for in the programme terms; prevention of the repeated issuing of a once-per-person welcome benefit after deletion of an account; security of the member account — Article 6(1)(f) GDPR (our legitimate interest; see paragraph (5)).
• Product safety warnings and recalls — Article 6(1)(c) GDPR in conjunction with Regulation (EU) 2023/988.
• Retention of transaction, accounting and tax records — Article 6(1)(c) GDPR in conjunction with Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO).

(5) Our legitimate interest

Our legitimate interest referred to in paragraph (4) is to protect the programme against abuse, and thereby to protect both us and our members from the economic consequences of such abuse, and to ensure that a benefit which is granted once per person is in fact granted once per person. We have weighed that interest against your interests, rights and freedoms. In doing so we have taken into account that we do not collect any additional data for this purpose but use only the programme data described in paragraph (3); that we do not evaluate your data for any purpose other than the detection of abuse; and that, for the sole purpose of preventing the repeated issuing of a welcome benefit, we retain only a one-way encrypted (hashed) value derived from the e-mail address, from which the e-mail address cannot be reconstructed and which cannot be used to contact you or to build a profile. You may object to this processing at any time; see paragraph (10).

(6) Recipients

The following recipients process personal data on our behalf as processors within the meaning of Article 28 GDPR:

• Growave (LLC “Growave”, 8 The Green STE R, Dover, DE 19901, USA), including the referral link domain refrr.app operated by Growave — operation of the loyalty, rewards and referral engine: member and account data, point balance and point history, membership tier, referral links and referral data, the order data required for these functions, and technical usage data (IP address, geolocation, browser and operating system data, cookies).
• Shopify — operation of the online store and of the customer account: customer account data, order and payment status data.
• Klaviyo (Klaviyo, Inc., USA) — sending of e-mails, including the advance notices of point expiry and, where you have consented, marketing e-mails: name, e-mail address, membership tier, point balance and expiry date, subscription and consent status.
• ReturnGo — operation of our returns and refunds portal: order data, return requests and their status.
• Consentmo GDPR — obtaining, managing and documenting your consent to the use of cookies and comparable technologies: consent status, time of consent and technical connection data.

Referral links are issued and delivered through the domain refrr.app, which is operated by Growave as its default referral link domain. It is not a separate service provider. Where you open a referral link, you are redirected via that domain; see paragraph (12).

In addition, the recipients referred to in Sect. 2 (3) — payment service providers, shipping service providers, hosting providers, and the after-sales and customer service providers in the Republic of Korea — may receive data in connection with an order placed within the programme.

(7) Transfers to third countries

Growave and Klaviyo are established in the United States, and Growave uses further sub-processors established in the United States.

• Transfers to Growave take place on the basis of the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914, Module Two — controller to processor).
• Transfers to Klaviyo take place, for as long as and to the extent that Klaviyo participates in the EU-U.S. Data Privacy Framework and the data concerned fall within the scope of its certification, on the basis of the European Commission’s adequacy decision for that framework; in all other cases on the basis of the standard contractual clauses referred to above. You can check the current status of a participant’s certification at the register maintained by the U.S. Department of Commerce.
• Where personal data are transferred to any other recipient outside the European Economic Area in connection with the operation of the online store or of the returns portal, the transfer is based either on an adequacy decision of the European Commission or on the standard contractual clauses referred to above.
• The transfer to the Republic of Korea described in Sect. 2 (3) (b) is unaffected and continues to be based on the adequacy decision pursuant to Article 45 GDPR.

You may request a copy of the safeguards referred to above by writing to huromparts@hurom-europe.com.

(8) Duration of storage

• Membership master data, point balance, point history, membership tier and tier history — for the duration of your membership. Upon termination of the membership, by your withdrawal, by termination, or upon a valid request for erasure of your loyalty profile, these data are erased, subject to the retention obligations set out in the last item of this list.
• Referral data — for the duration of the membership of the referring member; data relating to a referred order are retained together with that order.
• Discount code data — until the code has expired or been used, and thereafter for three years in order to handle complaints and reversals.
• Records of consent to marketing information and of the newsletter subscription — for the duration of the consent and for three years after its withdrawal, in order to be able to demonstrate that consent was given (Article 7(1) GDPR).
• Records relating to the detection of abuse and to measures taken under the programme terms — three years from the date of the measure.
• One-way encrypted (hashed) values derived from the e-mail address, used solely to prevent the repeated issuing of a once-per-person welcome benefit — for three years from deletion of the account.
• Transaction, accounting and tax records — ten years (Section 257 HGB, Section 147 AO).

The erasure of your loyalty profile results in the irrevocable loss of the points and tier recorded in it. Records which we are required to retain under commercial or tax law are retained separately from your loyalty profile and are not used for the operation of the programme.

(9) Automated processing and profiling

Your membership tier is determined automatically on the basis of the points you have earned, and points expire automatically on the basis of the date of your last qualifying activity. This constitutes profiling within the meaning of Article 4(4) GDPR.

It does not constitute a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22(1) GDPR: an increase in tier is exclusively advantageous to you; a correction of points or tier following a return, cancellation or refund merely restores the position which would have existed without the reversed transaction; and the measures provided for in the programme terms in cases of abuse are not applied automatically, but only after we have notified you and given you the opportunity to comment.

(10) Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on Article 6(1)(f) GDPR, that is to say to the processing described in paragraph (5). Where you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

Where your personal data are processed for direct marketing purposes, you have the right to object at any time and without giving any reasons. If you object to processing for direct marketing purposes, your personal data will no longer be processed for those purposes.

An objection is not subject to any particular form. It is sufficient to send an e-mail to huromparts@hurom-europe.com.

(11) Your rights and how to exercise them

You have the rights described in Sect. 9 of this privacy policy — in particular the right of access, to rectification, to erasure, to restriction of processing, to data portability, to withdraw consent and to lodge a complaint with a supervisory authority — and they apply in full to the processing described in this Section.

You may exercise those rights at any time by writing to huromparts@hurom-europe.com. We will provide you with information on action taken without undue delay and in any event within one month of receipt of your request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests; in that case we will inform you of the extension, together with the reasons for the delay, within one month of receipt of the request (Article 12(3) GDPR).

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. If you unsubscribe from the newsletter, that is also treated as a withdrawal of your consent to receive marketing information. Points already credited to you are not reversed if you withdraw your consent or unsubscribe.

(12) Referral links

A referral link allocated to you contains an identifier which allows an order subsequently placed by the person who opened the link to be attributed to your referral. When a referral link is opened, the browser of the person opening it is redirected via the domain refrr.app, and information is stored on or read from that person’s terminal equipment for the purpose of that attribution.

(13) Provision of data

The information marked as mandatory during product registration — the serial number, the date of purchase, your name and your e-mail address — is required in order to conclude and perform the membership contract. You are not obliged to provide it, but without it we cannot admit you to the programme. Consent to receive marketing information is voluntary: your membership, and your ability to earn and to redeem points, do not depend on it, and you suffer no disadvantage if you do not consent.

Sect. 9 Your rights as a data subject

If your personal data is being processed, you are the ‘data subject’ in terms of GDPR and you have the following rights towards us, the controller:

We will provide you with information on action taken in response to a request under this Section without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests; in that case we will inform you of the extension, together with the reasons for the delay, within one month of receipt of the request (Article 12(3) GDPR). You may exercise your rights at any time by writing to huromparts@hurom-europe.com.

1. Right to information

You may request us to provide information about your personal data processed by us under Article 15 of the GDPR.

2. Right to rectification

If your personal data provided to us is not up to date or not accurate you have the right to ask for modifications to your personal data under Article 16 of the GDPR. You also have the right to request us to complete an incomplete data.

3. Right to erasure

You have the right to have your personal data erased and ask for deletion of your data under Article 17 of the GDPR.

4. Right to restriction of processing

You have the right to restrict the processing your personal data under Article 18 of the GDPR.

5. Right to data portability

You have the right referred to in Article 20 of the GDPR to receive your personal data provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller.

6. Right to revoke the consent given under data protection law

You have the right referred to in paragraph 3 of Article 7 to withdraw your given consent based on the data protection provisions at any time. This does not affect the lawfulness of the processing based on consent before its withdrawal.

7. Right to lodge a complaint with a supervisory authority

If you consider that the processing of personal data relating to you infringes the GDPR, you have the right referring to in Article 77 of the GDPR to complain to the supervisory authority against the processing of your personal data (in particular in the Member State of your habitual residence, place of work or place of the alleged infringement).

Please also note your right of objection under Article 21 GDPR:

a) In general: Reasoned objection required
If the processing of personal data concerning you takes place in order
– to perform our overriding legitimate interest (legal basis: Article 6 (1f) GDPR)
or
– to safeguard the public interest (legal basis: Article 6 (1e) GDPR),
you are entitled to object to the processing at any time for reasons arising from your particular situation; this also applies to profiling based on the provisions of the GDPR.

In the event of objection, we will no longer process the personal data concerning you unless we can prove compelling grounds for processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defense of legal claims;

b) Special case of direct marketing: simple objection is sufficient
If the personal data concerning you are processed for the purpose of direct marketing, you have the right to object at any time to the processing and without stating reasons; this includes profiling to the extent that it is related to such direct marketing.

If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

Controller:

Hurom Europe GmbH
Weberstraße 19
65779 Kelkheim (Taunus), Germany
E-mail: huromparts@hurom-europe.com

Contact for data protection enquiries:

Hurom Europe GmbH, Weberstraße 19, 65779 Kelkheim (Taunus), Germany
E-mail: huromparts@hurom-europe.com

As of: 07.09.2026