Privacy Policy

Last updated: 9 September 2026

This Privacy Policy explains which personal data is processed when you use MOMO SUPPLY, place orders or contact us. It applies to momo-supply.com. Personal data is information relating to an identified or identifiable individual.

1. Controller and contact details

The controller responsible for operating MOMO SUPPLY and for the processing described here is:

Edelstein Capital LLC
7545 NW 71st Ter
Parkland, FL 33067
United States of America

Email for customer service and privacy enquiries: momomaserati030@gmail.com

For enquiries about a specific order, please include its order number where possible. An order number is not required for general privacy enquiries. Please do not send us full credit card details, card security codes or passwords by email.

2. Data we receive

• Visits and technical use: IP address, time and requested URL, browser and device information, technical response and error data and, where applicable, the referring page.

• Cart, orders and delivery: selected items, variants and quantities, cart and order identifiers, name, email address, billing and delivery addresses, and any contact details or order notes you provide voluntarily.

• Payments: amount, currency, selected payment method, transaction reference, payment status, and information about refunds or payment disputes. Payment instrument data required for authorisation is processed through the payment processing service.

• Customer accounts and communication: if you use these features, contact details, login and security information, order history, messages and attachments you submit.

Data generally comes from you or is generated technically when you use the shop. We also receive payment statuses and transaction references from the payment processing service; shipping and delivery information may come from the carrier handling your delivery.

3. Why we process data

Shop operation and security: Technical connection and log data is needed to deliver pages and images, keep the service available, investigate errors and prevent attacks and misuse. Where the General Data Protection Regulation (GDPR) applies, this processing is based on our legitimate interest in operating a secure and functional online shop under Article 6(1)(f) GDPR.

Pre-contractual steps and orders: We process the necessary data to provide your cart and enable purchases, process orders, match payments, deliver goods, and handle returns, refunds or warranty enquiries. The legal basis is Article 6(1)(b) GDPR.

Customer accounts: If you use an account, its data is used to log you in, secure the account and provide the account features you request. The legal basis is Article 6(1)(b) GDPR; preventing misuse is additionally based on Article 6(1)(f) GDPR.

Contact and customer service: We use your message and contact details to respond to your enquiry. Article 6(1)(b) GDPR applies to contract-related enquiries; other enquiries are handled on the basis of our legitimate interest in responding to incoming communications under Article 6(1)(f) GDPR.

Records and legal obligations: Necessary business records are retained for accounting, tax obligations, and the handling or defence of legal claims. Where an obligation arises under applicable EU or Member State law, Article 6(1)(c) GDPR applies. The reasonable protection of our legal position and compliance with other legal requirements are based on Article 6(1)(f) GDPR where permitted.

Making a purchase or simply visiting our website does not constitute blanket consent to additional advertising or non-essential tracking.

4. Hosting and shop platform: Kotao Cloud

We use Kotao Cloud and the Kotao shop platform provided by Kotao GmbH, Cologne, Germany, for hosting and technical shop features. This involves processing the connection, customer, cart, order and communication data required for each feature. Kotao processes our shop data on our behalf; any independent processing by the provider is governed by its own privacy notices.

Technical service delivery involves infrastructure providers and subprocessors, particularly for databases, email delivery, network security and image delivery. Among other services, the current website uses the Cloudflare network. The name Kotao Cloud therefore does not mean that no infrastructure partners are involved or that all data is processed exclusively in Germany.

Further information: Kotao Privacy Policy and Kotao subprocessors. Not all optional services listed there are automatically enabled in this shop.

5. Payments: Kotao Payments

Payments are processed through Kotao Payments. This involves processing, in particular, the payment amount and currency, order reference, necessary billing and contact details, and information about the selected payment instrument. We receive the transaction and status information required to match and process payments.

Kotao provides the technical payment platform; regulated payment processing is performed by the payment service providers used for Kotao Payments. The payment service providers involved and, where applicable, your bank or wallet provider may also process data to fulfil their own legal obligations, conduct security checks and prevent fraud. The notices provided for the specific payment method also apply.

Full card numbers and card security codes are not made available to us for storage through normal payment processing. Processing necessary for the purchase is based on Article 6(1)(b) GDPR. Further information is available in the Kotao Payments Terms and the Kotao Privacy Policy.

6. Delivery and support emails

The shipping and delivery providers we engage receive the information necessary for delivery, in particular the recipient's name and delivery address. Additional contact details are shared only where needed for the specific delivery or where you request a corresponding additional service. This processing is necessary for performance of the contract under Article 6(1)(b) GDPR.

Our published support email address uses Gmail. If you write to us at that address, Google also processes your sender address, message, attachments and technical email data to provide the email service. Please limit attachments to information necessary for your enquiry. Further information: Google Privacy Policy.

7. Cookies and similar technologies

Strictly necessary cookies or comparable storage technologies may be used for shop features you request, for example to associate a cart with your session, log you in or secure a session. These identifiers enable the relevant feature without requiring you to re-enter your order information every time you visit another page.

The Kotao cart cookie kotao_cart contains a cart identifier and is configured to last for 30 days. It is transmitted over an encrypted connection and is not intended to be accessible to page scripts. Using the cart again may renew this period.

Where information is stored on or accessed from your device and this is strictly necessary for a service you explicitly request, the legal basis is Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Subsequent processing of personal data is governed by the purposes and legal bases described above. Non-essential storage or access generally requires your consent under Section 25(1) TDDDG.

You can delete cookies and website data or restrict their storage through your browser settings. This may cause features such as your cart or login to be lost. Deleting browser data does not automatically delete an order already placed or records that must be retained by law.

8. Analytics, advertising and current technical status

MOMO SUPPLY currently does not intend to use external advertising pixels or external analytics services such as Google Analytics, Meta Pixel or TikTok Pixel. Placing an order or contacting support does not subscribe you to marketing emails.

This is separate from the internal Kotao usage measurement built into the shop platform. The shop currently loads its own Kotao pixel. This may process pages viewed and timestamps, device category, referral and campaign information, and product, search, cart and checkout events, and transmit them to the Kotao platform. The platform may derive a pseudonymous visitor identifier from connection data that changes daily. Pseudonymous data is not automatically anonymous data.

Technical notice dated 9 September 2026: The existing shop configuration automatically sets the technical consent signal for analytics and marketing to “yes” without first asking you to make a corresponding choice. This automatic signal does not constitute consent given by you. This Privacy Policy therefore does not claim that effective consent management has already been implemented. Non-essential usage measurement that requires consent must be based on valid consent under Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG. This technical discrepancy must be addressed separately from this information notice.

If you have questions about usage data already collected or wish to exercise your rights, you can contact momomaserati030@gmail.com.

9. Recipients and processing outside the EEA

Access is limited to people and providers where necessary for the purposes described: our responsible staff, the shop and hosting platform, the payment service providers and banks involved, email and shipping providers and, where necessary, tax or legal advisers and competent authorities. Data is disclosed to authorities or other bodies where a corresponding legal obligation exists or where necessary for the lawful establishment, exercise or defence of legal claims.

Edelstein Capital LLC is based in the United States. Data may therefore be processed by us in the United States and, through the providers we use, outside the European Economic Area (EEA). Different data protection and government access rules may apply there. There is no general adequacy decision covering every recipient in the United States.

For international processing by its providers, Kotao describes the relevant regions and safeguards in its subprocessor list, in particular Standard Contractual Clauses or the EU–US Data Privacy Framework for appropriately certified recipients. This does not imply that Edelstein Capital LLC is certified. You can request information about the recipients and transfer mechanisms relevant to your case, as well as available copies of safeguards, using our contact details.

10. How long data is retained

Retention periods depend on the purpose and category of data:

• Connection and security data: for as long as necessary for service delivery, error analysis, prevention of misuse or investigation of a specific security incident; it is then deleted or anonymised unless another lawful reason for retention applies.

• Cart and session data: for the relevant session or the validity period of the cart or login feature. You can delete browser identifiers yourself.

• Order, payment and delivery records: during performance of the contract and afterwards where required by statutory retention obligations, warranty matters, payment disputes, or the establishment, exercise or defence of legal claims. The exact period depends on the document type, applicable law and any ongoing proceedings.

• Support enquiries: until the matter is resolved; longer retention only where the communication is needed as evidence relating to a contract, for legal claims or to comply with a legal obligation.

• Customer accounts: for the duration of account use. Deleting an account does not affect order records or other records that may still need to be retained.

• Internal usage statistics: the Kotao platform provides for automatic deletion of the raw events described in Section 8 after 14 months. The daily change of the visitor identifier does not automatically shorten the retention period of an event already collected.

Restriction or deletion is not replaced by blanket, indefinite retention. If you would like to know the specific retention period for your data, you can ask us using our contact details.

11. Your data protection rights

Where the legal requirements are met, you have, in particular, the rights to access your personal data, rectify inaccurate data, obtain erasure, restrict processing and receive your data in a portable format. You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing based on that consent before its withdrawal.

Right to object: You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. You may object to processing for direct marketing at any time without giving specific reasons; this also applies to related profiling.

Please send your request to momomaserati030@gmail.com. Where necessary to identify you securely, we may request reasonable additional information to verify your identity. Please do not send copies of identity documents as a precaution. We generally respond to requests within one month and will inform you of any extension permitted by law.

You may also lodge a complaint with a data protection supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the alleged infringement. An overview is available from the European Data Protection Board. You do not have to contact us first to lodge a complaint.

12. Required information and changes to this Policy

Information necessary for an order, payment or delivery is a prerequisite for the relevant service. Without this data, we may be unable to complete the relevant process. Voluntary information is not a prerequisite for making a purchase. Technical connection data is generated as soon as you access the website.

We do not ourselves make solely automated decisions in the shop that have legal or similarly significant effects within the meaning of Article 22 GDPR. This is separate from any independent authorisation and security checks performed by the payment service provider involved in a selected payment method; that provider's own information applies.

We update this Policy when our data processing or the applicable requirements change. The published version states its update date at the top. Changing this text does not replace any new consent that may be required.