Privacy Policy | Emma Sleep IE

Webshop Privacy Policy

Version Updated: September 2026

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your personal data when you visit our website or purchase products from our online shop, in accordance with the applicable data protection laws.

1. Controller and Contact Details

The controller responsible for the processing of your personal data is Emma Matratzen GmbH, with registered address at Wilhelm-Leuschner-Str. 78, 60329 Frankfurt am Main, Germany. You can contact us and our data protection officer regarding data protection matters at: privacy@emma-sleep.com.

2. Scope of this Privacy Policy

This Privacy Policy applies to all personal data collected and processed in connection with the use of our website, online store, customer service, marketing communications, and related activities. It does not apply to third-party websites that may be accessed via links on our website.

We presume that the personal data you provide is yours. If you choose to provide personal data from third parties, namely payment or contact information, you must inform them in advance of the content of this Privacy Policy and the circumstances relating to the processing of their personal data, as well as obtaining their prior consent.

3. Processing Activities

We process your personal data only where permitted under the applicable data protection law and for clearly defined purposes. The sections below describe, for each processing activity, the personal data involved, the purpose, the legal basis, the recipients, and the applicable retention period.

3.1 Order Fulfilment and Contract Performance

When you purchase products from us, we process the following data:

Name
Email address
Phone number
Delivery address
Billing address
Order and product details (items purchased)
Payment confirmation (received from your payment provider)
Order history and account preferences
Delivery information and logistics updates
Returns and refunds data
Communications with our customer service team related to the order

Purpose: To conclude and perform purchase contracts with you, including processing payments, delivering products, managing returns and refunds, administering your customer account, verifying referral discounts, and handling order-related inquiries.

Legal basis: Article 6(1)(b) GDPR — processing is necessary for the performance of a contract to which you are a party.

Recipients: Payment service providers, banks, logistics and delivery partners, cloud and IT service providers, and affiliated companies within the Emma Group, to the extent necessary to fulfil your order.

Retention: For the duration of the contractual relationship and thereafter as required under applicable statutory retention obligations.

We may receive payment confirmation from financial and credit institutions such as PayPal. Personal data you share with those institutions is subject to their own privacy policies. If you purchase a product sold by a third party through our website, we may share relevant order and contact details with that supplier for warranty handling, product support, and customer service purposes.

Where you purchase a product through a third-party marketplace or retailer and Emma fulfils the delivery on their behalf, we may receive certain personal data from that marketplace or retailer in order to process and deliver your order. This data typically includes your name, delivery address, order details, and, where required for delivery coordination, your contact information. We process this data solely for the purpose of fulfilling the delivery and handling any associated after-sales service, acting as a data processor on behalf of the marketplace retailer. Your purchase is subject to the marketplace's own terms and privacy policy, and we encourage you to review those directly.

3.2 Customer Support and Enquiries

When you contact us via email, phone, chatbot, or other support channels, we process the following personal data:

Name
Email address
Phone number
The content of your communication and any attachments
Order or account details referenced in your enquiry
Communication history and follow-up records

Purpose: To respond to your enquiry, resolve complaints, and manage follow-up communication.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in providing effective customer support and improving our services. Where the enquiry concerns your purchase contract, Article 6(1)(b) GDPR also applies.

Use of AI tools: We may use generative AI–supported tools (chatbots, transcription, summarisation, translation) to assist our customer service operations. These tools process your communications solely for support purposes and do not provide professional, medical, or legally binding advice. These tools do not involve automated decision-making within the meaning of Article 22 GDPR. Our AI service providers are bound by data processing agreements requiring them to process data only on our instructions and to implement appropriate safeguards.

Recipients: Customer support providers, CRM vendors, and AI service providers under data processing agreements.

Retention: For as long as necessary to resolve your enquiry and in accordance with applicable statutory retention periods.

3.3 Website Security, Stability, and Fraud Prevention

When you visit our website, we automatically collect the following technical data:

IP address
Device type and browser information
Website interaction data and navigation paths
Log files and timestamps
Cookie identifiers
Approximate location data

Purpose: To ensure the security, stability, and proper functioning of our website and IT systems, including the prevention of fraud, misuse, and unauthorised access.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in maintaining secure and functional digital infrastructure.

Recipients: IT and cloud service providers, security vendors, and fraud prevention services.

Retention: Log files and similar technical data are processed only for as long as necessary for the stated purposes and are then deleted or anonymised.

3.4 Newsletter Marketing (Existing Customers)

If you are a customer of ours, we may send you newsletters about products similar to those you have purchased, and about programmes such as our referral programme. We process the following personal data:

Name
Email address
Purchase history (to enable marketing of similar products)
Last date of purchase (for data retention purposes)
Newsletter subscription status and communication preferences
Engagement data (e.g. email open rates, link interactions, where applicable)

We process this data for the following purposes:

Marketing similar products and services that may be of interest to you
Inviting you to participate in our referral programme

When you open a newsletter from us, we may use tracking technologies (including tracking pixels) to collect information about whether and when our emails are opened, for purposes of measuring campaign performance, improving the relevance of our communications, and managing our contact lists. You may opt out at any time by clicking the unsubscribe link in any email or updating your communication preferences.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in sending you information about identical or similar products relevant to your needs.

Recipients: Marketing email service providers and CRM vendors

Your right to object: You can object at any time by clicking the 'unsubscribe' button in any communication you receive, or by emailing privacy@emma-sleep.com.

Retention: Subject to applicable statutory retention periods under data protection law.

3.5 Direct Marketing to Prospective Customers (Consent-Based)

Where we use SMS, WhatsApp, or web push notifications, we process the following personal data with your consent:

Name
Email address, phone number
Marketing consent records and timestamps
Communication preferences and opt-out records

Purpose: To send you marketing communications about our products and services.

Legal basis: Article 6(1)(a) GDPR — your consent. Consent is documented and may be withdrawn at any time with effect for the future, without affecting the lawfulness of processing carried out prior to withdrawal.

Recipients: Marketing email and SMS service providers, CRM vendors

Retention: Until you withdraw your consent or until the purpose for which consent was given no longer applies.

How to withdraw: Click the unsubscribe link in any communication, or email privacy@emma-sleep.com.

3.6 Third-Party Partner Marketing (Consent-Based)

Based on your specific consent, you may receive email communications from our brand partners. We process the following personal data:

Email address
Consent record (including timestamp and scope)

Purpose: To send you marketing content from selected brand partners.

Legal basis: Article 6(1)(a) GDPR — your consent.

Current brand partners include: Complete Unity Yoga, Easy Storage, FiiT, Gousto, Make My Blinds, My Flowers, Rise Coffee, Simple Lighting, The Body Shop, Twinings, and Wild Deodorant. The list of partners may be updated from time to time and will be made available via this Privacy Policy or at the point of consent.

Retention: Until you withdraw your consent.

How to withdraw: Click the unsubscribe link in any communication, or email privacy@emma-sleep.com.

3.7 Referral Programme

If you participate in our referral programme, we process the following personal data:

Name
Email address
Referral code and discount record
Purchase history (to verify referral eligibility)
Information about the friend who referred you (where applicable)

We process this data for the following purposes:

Verifying and enabling referral discount codes
Identifying referral entries and detecting fraud

Legal basis: Article 6(1)(a) GDPR — your consent to participate in the referral programme.

Recipients: Referral programme platform providers.

Retention: For as long as your participation in the programme is active, and thereafter as required by applicable law.

3.8 Advertising Audiences

We use hashed personal data to create aggregated or lookalike audiences on advertising platforms. We process the following personal data (in hashed form):

Email address
Other identifiers used to create audience segments

Purpose: To deliver relevant advertising to users with interests similar to our existing customers. Identifiable personal data is not disclosed to advertising platforms.

Legal basis: Article 6(1)(a) GDPR — your consent.

Recipients: Advertising platform providers (data shared in pseudonymised or hashed form only).

Retention: For as long as the relevant advertising campaign is active, or until you object.

Your right to object: You may object at any time by emailing privacy@emma-sleep.com.

3.9 Customer Feedback, Reviews, and Surveys

We may contact you to request product reviews, feedback, or survey participation. We process the following personal data:

First name and initial of surname (displayed on published reviews)
Email address
Order details (to contextualise the review invitation)
Survey responses and satisfaction ratings
Follow-up communications regarding feedback

We process this data for the following purposes:

Product quality monitoring and service improvement
Customer experience optimisation
Following up on complaints or quality issues

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in improving our products and services. Participation is voluntary and you may unsubscribe from review invitation emails at any time. Where reviews are published, only your first name and the initial of your surname are displayed; no other personal data is published.

Recipients: Trusted third-party review and survey platforms, including Yotpo, Trustpilot, and Qualtrics, acting under data processing agreements.

Retention: For as long as necessary to fulfil the feedback purpose, and thereafter in accordance with applicable statutory requirements.

3.10 Compliance with Legal Obligations

We process certain personal data to comply with legal obligations applicable to us. This includes:

Identity and contact data
Order and transaction data
Financial and invoicing data
Health-related or injury data (where strictly necessary in the context of product claims)

We process this data for the following purposes:

Compliance with tax, accounting, regulatory, and reporting obligations
Compliance with anti-money laundering (AML) laws, including prevention of money laundering, terrorist financing, and fraud

Legal basis: Article 6(1)(c) GDPR — processing is necessary for compliance with a legal obligation. Health-related data is processed under Article 9(2)(f) GDPR where applicable.

Recipients: Tax authorities, regulatory bodies, auditors, financial institutions, and legal advisors.

Retention: Subject to applicable statutory retention periods under civil, tax, and commercial law, or equivalent requirements under applicable local law.

3.11 Establishment, Exercise, or Defence of Legal Claims

We may process personal data, including health-related data where strictly necessary, to protect our legal position. This includes:

Identity and contact data
Order and transaction data
Health-related or injury data (in the context of product-related claims)
Communications and correspondence

We process this data for the following purposes:

Establishing, exercising, or defending legal claims
Assessing injury or product-related claims
Preventing and investigating fraud
Responding to regulatory or judicial requests

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in protecting our legal rights and interests. Health-related data is processed under Article 9(2)(f) GDPR.

Recipients: Legal advisors, insurers, courts, and regulatory authorities.

Retention: For as long as necessary in connection with the relevant claim or proceeding, subject to applicable statutory retention periods under civil, tax, and commercial law, or equivalent requirements under applicable local law.

4. Cookies and Similar Technologies

Our website uses cookies and similar technologies to ensure basic functionality, improve user experience, analyse website usage, and deliver marketing content where permitted.

Essential cookies are used without consent where strictly necessary for the website to function.
All other cookies (analytical, functional, and marketing cookies) are used only after you have provided consent via our cookie banner.

To find out more about the use of cookies and how to manage or withdraw your consent, please access our Privacy Settings.

5. Recipients of Personal Data and International Transfers

Personal data may be shared with the following categories of recipients:

Service providers acting as processors under Article 28 GDPR (e.g. payment service providers, logistics partners, IT and cloud providers, CRM and marketing service providers, customer support service providers)
Affiliated companies and subsidiaries within the Emma group
Public authorities, courts, insurers, financial institutions, or legal advisors where legally required or permitted

Personal data may be shared with service providers acting as processors under Article 28 GDPR, including payment service providers, logistics partners, IT and cloud providers, CRM and marketing service providers, and customer support tools. We may also disclose data to public authorities, insurers, financial institutions, or legal advisors where legally required. We may also share your personal data with selected third parties, including affiliates and subsidiaries, to operate our business. Where data is transferred outside the EU/EEA, we ensure appropriate safeguards, such as adequacy decisions, Standard Contractual Clauses (you may find a copy of the EU and UK Standard Contractual Clauses we use by clicking here, together with additional protective measures.

These providers act as data processors and are contractually required to process personal data only on our instructions, apply appropriate technical and organizational security measures, and comply with applicable data protection laws.

If you purchase a product sold by a third party through our website, we may share relevant order and contact details with the supplier to enable warranty handling, product support, and customer service, in accordance with applicable data protection laws.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described above and to comply with statutory retention obligations. Retention periods may arise under tax, commercial, or civil law, and is subject to various statutory retention periods under the applicable law. Where data is no longer required and no legal obligation applies, it is securely deleted or anonymized.

7. Social Media Plugins

Our website may integrate social media plugins or widgets (such as “Like,” “Share,” or similar buttons) hosted by third-party social media platforms. When you visit a page containing such plugin, your browser may establish a direct connection with the servers of the relevant social media provider. As a result, certain information, including your IP address, browser information, and details of the page visited, may be transmitted to and processed by that provider, potentially even if you do not actively interact with the plugin. If you are logged into your social media account at the time, the provider may associate your visit with your profile. We do not control the scope or purpose of the data collected by the social media provider and recommend reviewing their respective privacy notices for further information.

8. Your Rights as a Data Subject

Where appropriate and applicable under law, you have the following rights in respect of your personal data:

Right of access (Article 15 GDPR) — you may request a copy of the personal data we hold about you.
Right to rectification (Article 16 GDPR) — you may request correction of inaccurate or incomplete personal data.
Right to erasure (Article 17 GDPR) — you may request deletion of your personal data under certain conditions.
Right to restriction of processing (Article 18 GDPR) — you may request that we limit how we use your personal data.
Right to data portability (Article 20 GDPR) — you may request a machine-readable copy of your data or its transfer to another controller.
Right to object (Article 21 GDPR) — you may object to processing based on legitimate interests, including direct marketing.
Right to withdraw consent (Article 7(3) GDPR) — where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right not to be subject to solely automated decision-making (Article 22 GDPR).
Right to lodge a complaint — you may lodge a complaint with the competent supervisory authority in your country of residence or with our lead supervisory authority (Hessian Data Protection Authority).

You can exercise your rights with respect to your personal data by contacting us via email to privacy@emma-sleep.com or post through the contact details shown at the beginning of this Privacy Policy.

9. Updates to this Privacy Policy

We may update this Privacy Policy to reflect changes in our processing activities or legal requirements. The current version is always available on our website.