Privacy policy

Privacy Policy

Unless otherwise stated below, the provision of your personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obligated to provide the data. Failure to provide the data will have no consequences. This applies only when no other information is provided regarding the following processing operations.
"Personal Data" means all information relating to an identified or identifiable natural person.

Your data may be transferred and processed in third countries outside the EU, in particular to Canada and the USA. For Canada, the EU Commission has issued an adequacy decision. For the USA, an adequacy decision is in place under the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is carried out on the basis of contractual obligations that are comparable to the standard contractual clauses of the EU Commission.

Contact

Data Controller
If you wish to contact us, the data controller responsible for the processing is: Steffen Fromm, Heubergstr 9, 72189 Vöhringen Germany, +49 176 81068339, steffen@naturbohne.de

Initiated Customer Contact via E-mail
If you initiate contact with us by e-mail, we only collect your personal data (name, e-mail address, message text) to the extent provided by you. The data processing is for the purpose of handling and responding to your inquiry.
If the contact is for the purpose of taking pre-contractual measures (for example, consultation regarding purchase interest, preparation of an offer) or relates to an existing contract between you and us, this data processing is based on Art. 6(1) lit. b GDPR.
If the contact is for other reasons, the data processing is carried out on the basis of Art. 6(1) lit. f GDPR due to our overriding legitimate interest in processing and answering your inquiry. In this case, you have the right to object at any time for reasons arising from your particular situation.
We only use your e-mail address to process your inquiry. Your data will be deleted afterwards in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and Processing When Using the Contact Form
When using the contact form, we collect your personal data (name, e-mail address, message text) only to the extent provided by you. The data processing is for the purpose of contacting you.
If the contact is for the purpose of taking pre-contractual measures (for example, consultation regarding purchase interest, preparation of an offer) or relates to an existing contract between you and us, this data processing is based on Art. 6(1) lit. b GDPR.
If the contact is for other reasons, the data processing is carried out on the basis of Art. 6(1) lit. f GDPR due to our overriding legitimate interest in processing and answering your inquiry. In this case, you have the right to object at any time for reasons arising from your particular situation.
We only use your e-mail address to process your inquiry. Your data will be deleted afterwards in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and Processing When Using the Application Form
When using the application form, we collect your personal data only to the extent provided by you. This includes your contact details (e.g., name, e-mail address, phone number), information about your professional qualifications and education, information on professional training, and performance-related certificates.
The data processing is for the purpose of contacting you and deciding whether to establish an employment relationship with you. Providing the data is necessary to conduct the application process. The processing of your personal data is carried out on the basis of Art. 6(1) lit. b GDPR in conjunction with § 26(1) BDSG for the purpose of taking pre-contractual measures (the application process as a prelude to an employment contract).
If you have given us consent to process your personal data for inclusion in our applicant pool, for example by checking a box, the processing is carried out on the basis of Art. 6(1) lit. a GDPR. You may revoke your consent at any time without affecting the lawfulness of the processing based on consent before the revocation.

Should special categories of personal data in the sense of Art. 9(1) GDPR be requested from applicants as part of the application process, such as information about the degree of disability, this is carried out on the basis of Art. 9(2) lit. b GDPR, so that we can exercise the rights arising from labor law and the law on social security and social protection and comply with our corresponding obligations.

We will store your personal data for as long as necessary to decide on your application. Your data will then be deleted after a maximum of six months, unless you have consented to further processing and use. If an employment relationship is subsequently established, the data provided will be further processed on the basis of Art. 6(1) lit. b GDPR in conjunction with § 26(1) BDSG for the purpose of fulfilling the employment relationship and then transferred to the personnel file.

WhatsApp Business
If you contact us via WhatsApp, we use WhatsApp Business by WhatsApp Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “WhatsApp”). If you are located outside the European Economic Area, this service is provided by WhatsApp Inc. (1601 Willow Road, Menlo Park, CA 94025, USA).
The data processing is for the purpose of handling and answering your inquiry. For this purpose, we collect and process your mobile phone number (if provided via WhatsApp), your name (if provided), and other data to the extent provided by you. We use a mobile device for this service, in whose address book only the data of users who have contacted us via WhatsApp are stored. Your personal data will not be passed on to WhatsApp without your prior consent.
Your data is transmitted by WhatsApp to Meta Platforms Inc. servers in the USA. For the USA, an adequacy decision is in place under the Trans-Atlantic Data Privacy Framework (TADPF). WhatsApp has been certified under the TADPF and is committed to complying with European data protection principles.
If the contact is for the purpose of taking pre-contractual measures (for example, consultation regarding purchase interest, preparation of an offer) or relates to an existing contract between you and us, this data processing is based on Art. 6(1) lit. b GDPR.
If the contact is for other reasons, the data processing is carried out on the basis of Art. 6(1) lit. f GDPR due to our overriding legitimate interest in providing a fast and easy way to contact us and in answering your inquiry. In this case, you have the right to object at any time for reasons arising from your particular situation.
We only use your personal data to process your inquiry. Your data will then be deleted in accordance with legal retention periods, unless you have consented to further processing and use.
For more information on the terms of use and data protection when using WhatsApp, please visit https://www.whatsapp.com/legal/#terms-of-service and https://www.whatsapp.com/legal/#privacy-policy.


Customer Account      Orders      

Customer Account
When you open a customer account, we collect your personal data to the extent provided. The data processing is for the purpose of improving your shopping experience and simplifying order processing. The processing is carried out on the basis of Art. 6(1) lit. a GDPR with your consent. You may revoke your consent at any time by notifying us, without affecting the lawfulness of the processing based on consent prior to revocation. Your customer account will then be deleted.

Your data may be transferred and processed in third countries outside the EU, in particular to Canada and the USA. For Canada, an adequacy decision has been issued by the EU Commission. For the USA, an adequacy decision is in place under the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is carried out on the basis of contractual obligations comparable to the standard contractual clauses of the EU Commission.

Reviews       Advertising      


Collection of Data When Submitting a Comment or Review
When you comment on or review an article or post, we collect your personal data (name, e-mail address, comment text) only to the extent provided by you. The processing is for the purpose of enabling a comment/review and displaying comments/reviews. 

By submitting your comment/review, you consent to the processing of the data transmitted. The processing is carried out on the basis of Art. 6(1) lit. a GDPR with your consent. You may revoke your consent at any time by notifying us, without affecting the lawfulness of the processing based on consent prior to revocation. Your personal data will then be deleted.

Furthermore, when you submit a comment/review, your IP address is stored in order to prevent abuse of the commenting or review function and to ensure the security of our IT systems. By submitting your comment/review, you consent to the processing of the transmitted data. The processing is carried out on the basis of Art. 6(1) lit. a GDPR with your consent. You may revoke your consent at any time by notifying us, without affecting the lawfulness of the processing based on consent prior to revocation. Your IP address will then be deleted.

Use of Your Personal Data for Sending Postal Advertising
We use your personal data (name, address) that we receive in the context of the sale of a product or service to send you postal advertising, unless you object to this use. The provision of this data is necessary for the conclusion of a contract. Failure to provide the data will result in no contract being concluded.
The processing is carried out on the basis of Art. 6(1) lit. f GDPR due to our overriding legitimate interest in direct marketing. You may object to this use of your address data at any time by notifying us. The contact details for exercising your right to object can be found in the imprint.

Use of the E-mail Address for Sending Newsletters
We use your e-mail address, independent of the conclusion of a contract, exclusively for our own advertising purposes for newsletter distribution, provided you have expressly consented. The processing is carried out on the basis of Art. 6(1) lit. a GDPR with your consent. You may revoke your consent at any time without affecting the lawfulness of the processing based on consent prior to revocation. You may unsubscribe from the newsletter at any time using the corresponding link in the newsletter or by notifying us. Your e-mail address will then be removed from the distribution list. 

Use of the E-mail Address for Sending Direct Advertising
We use your e-mail address, which we received in the context of the sale of a product or service, for the electronic transmission of advertising for our own goods or services that are similar to those you have already purchased from us, unless you object to this use. The provision of the e-mail address is necessary for the conclusion of a contract. Failure to provide the e-mail address will result in no contract being concluded. The processing is carried out on the basis of Art. 6(1) lit. f GDPR due to our overriding legitimate interest in direct marketing. You may object to this use of your e-mail address at any time by notifying us. The contact details for exercising your right to object can be found in the imprint. You may also use the designated link in the advertising e-mail. Only the transmission costs according to the basic rates will be incurred.

Use of HubSpot
We use HubSpot for newsletter distribution, provided by HubSpot Ireland Ltd. (Ground Floor, Two Dockland Central Guild Street, Dublin 1, Ireland; "HubSpot") as part of order processing. HubSpot is affiliated with HubSpot, Inc. (25 First Street, Cambridge, MA 02141, USA).
We pass on the information (e-mail address, and if applicable first and last name) provided by you during newsletter registration to HubSpot. The processing is for the purpose of sending the newsletter and its statistical evaluation.
To evaluate newsletter campaigns, the newsletters contain a 1x1 pixel graphic (tracking pixel) or a tracking link. This allows us to determine whether you opened the newsletter and whether you clicked any integrated links. In this context, we collect your personal data such as IP address, browser type, device, and the time of the page visit. From these data, usage profiles can be created using a pseudonym. The collected data are not used to personally identify you. They are solely used for statistical analysis to improve newsletter campaigns.
Your data may be transferred to HubSpot servers in the USA and stored there. For the USA, an adequacy decision has been issued by the EU Commission under the Trans-Atlantic Data Privacy Framework (TADPF). HubSpot has been certified under the TADPF and is committed to complying with European data protection principles.
The processing of your personal data is carried out on the basis of Art. 6(1) lit. f GDPR due to our overriding legitimate interest in a targeted, effective, and user-friendly newsletter system. You have the right to object at any time for reasons arising from your particular situation regarding this processing of your personal data.
For more information on data collection and use by HubSpot, your rights, and how to protect your privacy, please refer to the HubSpot privacy policy at: https://legal.hubspot.com/de/privacy-policy and the data processing agreement at: https://legal.hubspot.com/de/dpa.

Use of E-mail Address for Availability Notifications

Analytics       Advertising Tracking       Communication       Affiliate      

Use of Shopify Analytics
We use the statistics and analysis functions of Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify") on our website as part of order processing. Shopify is affiliated with Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).
The processing is for the purpose of analyzing this website and its visitors. Data are stored for marketing and optimization purposes and provided in reports, analyses, and statistics. Among other things, the following device information is collected and processed: information about the web browser, IP address, time zone, and some cookies installed on your device. As you navigate the website, information about the pages or products visited, the referrer URL (the website from which you accessed our website), and details of how you interact with the site are also recorded. Technologies such as cookies, web beacons, tags, and pixels (electronic files used to capture information about how you navigate the site) are used for this purpose.
Your data may be transferred to third countries outside the EU, in particular to Canada and the USA. For Canada, an adequacy decision has been issued by the EU Commission. For the USA, an adequacy decision is in place under the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is carried out on the basis of contractual obligations comparable to the standard contractual clauses of the EU Commission.
The use of cookies or similar technologies is based on your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1) lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1) lit. a GDPR. You may revoke your consent at any time without affecting the lawfulness of the processing based on consent prior to revocation.
For more information on data protection at Shopify, please visit: https://www.shopify.com/de/legal/datenschutz, for the data processing agreement: https://www.shopify.com/de/legal/dpa, and for information on the cookies used: https://www.shopify.com/de/legal/cookies.


Use of the Meta Pixel

Plugins and Other

Use of Social Plugins
We use social network plugins on our website. The integration of social plugins and the associated data processing is for the purpose of optimizing advertising for our products.
When social plugins are embedded, a connection is automatically established between your computer and the servers of the social network provider, and the plugin is displayed on the page by sending information to your browser, provided you have expressly consented. In doing so, both your IP address and information about which of our pages you visited are transmitted to the provider’s servers. This applies whether or not you are registered or logged into the social network. If you are simultaneously connected to one or more of your social network accounts, the collected information may also be associated with your respective profiles. If you wish to prevent such association, log out of your social media accounts before visiting our website and before activating the buttons.
The use of cookies or similar technologies is based on your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1) lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1) lit. a GDPR. You may revoke your consent at any time without affecting the lawfulness of the processing based on consent prior to revocation.
The following social networks are integrated on our website via social plugins. Detailed information on the scope and purpose of the data collection and use, as well as your rights and options for protecting your privacy, can be found in the linked privacy notices of the providers.

Facebook by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
Meta Platforms Ireland and we are jointly responsible for the collection and transfer of your data when this service is embedded. For more information, please see https://www.facebook.com/legal/controller_addendum. We are particularly responsible for meeting the information obligations under Arts. 13 and 14 GDPR, for complying with the security requirements of Art. 32 GDPR regarding the proper technical implementation of the service, and for fulfilling the obligations under Arts. 33 and 34 GDPR, as far as a breach of personal data protection affects our obligations under the joint processing agreement. Meta Platforms Ireland is responsible for enabling data subject rights under Arts. 15–20 GDPR, ensuring the security of the service in accordance with Art. 32 GDPR, and meeting the obligations under Arts. 33 and 34 GDPR as far as Meta Platforms Ireland’s obligations under the joint processing agreement are concerned.
Your data may be transferred to the USA. For the USA, an adequacy decision has been issued by the EU Commission under the Trans-Atlantic Data Privacy Framework (TADPF). Meta has been certified under the TADPF and is committed to complying with European data protection principles.
For detailed information on Facebook’s data collection and use, and your rights and options for protecting your privacy, please refer to Facebook’s privacy notice at https://www.facebook.com/about/privacy/.

LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland)
https://www.linkedin.com/legal/privacy-policy?trk=uno-reg-guest-home-privacy-policy
Your data may be transferred to the USA. For the USA, an adequacy decision has been issued by the EU Commission under the Trans-Atlantic Data Privacy Framework (TADPF). LinkedIn has been certified under the TADPF and is committed to complying with European data protection principles.

Pinterest by Pinterest Inc. (635 High Street, Palo Alto, CA 94301, USA)
https://policy.pinterest.com/de/privacy-policy
Your data may be transferred to the USA. For the USA, an adequacy decision has been issued by the EU Commission under the Trans-Atlantic Data Privacy Framework (TADPF). Pinterest is not certified under the TADPF.

Use of All In One WP Security & Firewall
We use the security plugin "All In One WP Security & Firewall" by Tips and Tricks HQ on our website.
The data processing is for the purpose of enhancing the security and protection of our website and detecting security vulnerabilities. Cookies may be used, which can collect user data such as your IP address. The data are stored only on our servers. No data will be passed on to third parties.
The use of cookies or similar technologies is based on your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1) lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1) lit. a GDPR. You may revoke your consent at any time without affecting the lawfulness of the processing based on consent prior to revocation.
For more information on data processing when using the plugin, please visit https://de.wordpress.org/plugins/all-in-one-wp-security-and-firewall/ and https://www.tipsandtricks-hq.com/wordpress-security-and-firewall-plugin.

Use of Google Maps
We use the embedded Google Maps feature on our website provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google").
This feature allows the visual display of geographic information and interactive maps. When pages with embedded Google Maps are accessed, Google may collect, process, and use data about the visitors of the website.
Your data may be transferred to the USA. For the USA, an adequacy decision has been issued by the EU Commission under the Trans-Atlantic Data Privacy Framework (TADPF). Google has been certified under the TADPF and is committed to complying with European data protection principles.
The use of cookies or similar technologies is based on your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1) lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1) lit. a GDPR. You may revoke your consent at any time without affecting the lawfulness of the processing based on consent prior to revocation.
For more information on the collection and use of data by Google, please refer to Google’s privacy notice at https://www.google.com/privacypolicy.html. There you can also change your settings in the privacy center to manage and protect the data processed by Google.

Use of YouTube
We use the video embedding feature from YouTube on our website provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “YouTube”). YouTube is affiliated with Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).
The feature displays YouTube-hosted videos in an iframe on our website. The "Enhanced Privacy Mode" is activated, so YouTube does not store information about visitors until you choose to watch a video, at which point data will be transmitted and stored by YouTube. Your data may be transferred to the USA. For the USA, an adequacy decision has been issued by the EU Commission under the Trans-Atlantic Data Privacy Framework (TADPF). YouTube has been certified under the TADPF and is committed to complying with European data protection principles.
The use of cookies or similar technologies is based on your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1) lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1) lit. a GDPR. You may revoke your consent at any time without affecting the lawfulness of the processing based on consent prior to revocation.
For more detailed information on YouTube and Google’s data collection and use, as well as your rights and options for protecting your privacy, please refer to YouTube’s privacy notice at https://www.youtube.com/t/privacy.

Use of Vimeo
We use plugins from Vimeo Inc. (555 West 18th Street, New York, NY 10011, USA; “Vimeo”) to embed videos from the Vimeo portal on our website.
When you access pages with such plugins, a connection is established with Vimeo’s servers and the plugin is displayed by sending information to your browser. In doing so, your IP address and information about which of our pages you have visited are transmitted to Vimeo.
If you are logged into Vimeo, this information is associated with your personal account. When you interact with the plugin (for example, by starting a video), this information is also associated with your Vimeo account.
Your data may be transferred to the USA. For the USA, an adequacy decision has been issued by the EU Commission under the Trans-Atlantic Data Privacy Framework (TADPF). Vimeo has been certified under the TADPF and is committed to complying with European data protection principles. 
The use of cookies or similar technologies is based on your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1) lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1) lit. a GDPR. You may revoke your consent at any time without affecting the lawfulness of the processing based on consent prior to revocation.
For more detailed information on the purpose and scope of data collection, further use, and processing by Vimeo, as well as your rights and options for protecting your privacy, please refer to Vimeo’s privacy notice at: https://vimeo.com/privacy.