# Privacy Policy
## Table of Contents
1. Access Data and Hosting
1.1 Hosting
1.2 Content Delivery Network
2. Data Processing for Contract Fulfilment and Contact
2.1 Data Processing for Contract Fulfilment
2.2 Customer Account
Contact
3. Data Processing for Shipping
4. Data Processing for Payment Processing
4.1 Data Processing for Payment Transactions
4.2 Data Processing for Fraud Prevention and Optimisation of Our Payment Processes
5. Advertising by Email
Email Newsletter with Subscription, Newsletter Tracking with Separate Consent
6. Cookies and Other Technologies
6.1 General Information
6.2 Use of Shopify Consent Manager Tool for Managing Consent
7. Use of Cookies and Other Technologies
7.1 Use of Google Services
7.2 Use of Meta Services
7.3 Other Providers of Web Analytics and Online Marketing Services
8. Social Media
8.1 Social Buttons from Facebook (by Meta), Instagram (by Meta), Pinterest
8.2 Our Online Presence on Facebook (by Meta), Instagram (by Meta), YouTube, Pinterest
9. Contact Options and Your Rights
9.1 Your Rights
9.2 Contact Options
---
## Controller responsible for data processing
The controller responsible for data processing is:
**Marina Bell**
Boxhagener Strasse 93
10245 Berlin
Germany
Email: [m.bell@bellanatur.com](mailto:m.bell@bellanatur.com)
Phone: +49 (0)163 5539171
We are pleased that you are interested in our website. Protecting your privacy is very important to us. Below, we provide detailed information about how we handle your personal data.
## 1. Access Data and Hosting
You can visit our websites without providing any personal information.
Each time a website is accessed, the web server automatically stores a so-called server log file containing, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data), and documents the access.
This access data is evaluated exclusively to ensure the trouble-free operation of the website and to improve our services. This serves to protect our legitimate interests, which prevail as part of a balancing of interests, in the proper presentation of our services pursuant to Art. 6(1)(f) GDPR.
All access data is processed only for as long as necessary to achieve the purposes described above.
## 1.1 Hosting
The services for hosting and displaying the website are partly provided by our service providers as processors acting on our behalf.
Unless otherwise stated in this Privacy Policy, all access data and all data collected through forms provided on this website are processed on their servers.
If you have any questions about our service providers or the basis of our cooperation with them, please contact us using the contact details provided in this Privacy Policy.
Our service providers are located in and/or use servers in the following countries for which the European Commission has established an adequate level of data protection by decision: **USA**.
The adequacy decision for the USA applies as the basis for transfers to third countries where the respective service provider is certified. Certification is in place.
Our service providers are also located in and/or use servers in countries outside the EU and EEA for which the European Commission has not established an adequacy decision. Our cooperation with these providers is based on the European Commission's Standard Contractual Clauses.
## 1.2 Content Delivery Network
To reduce loading times, we use a so-called Content Delivery Network ("CDN") for some services.
With this service, content such as large media files is delivered through geographically distributed servers operated by external CDN providers.
Access data is therefore processed on the servers of these service providers. Our service providers act as processors on our behalf.
If you have any questions about our service providers or the basis of our cooperation with them, please contact us using the contact details provided in this Privacy Policy.
Our service providers are located in and/or use servers in countries for which the European Commission has established an adequate level of data protection, including the **USA**. The adequacy decision for the USA applies where the respective service provider is certified. Certification is in place.
Our service providers are also located in and/or use servers in countries outside the EU and EEA for which no adequacy decision exists. Our cooperation with these providers is based on the European Commission's Standard Contractual Clauses.
## 2. Data Processing for Contract Fulfilment and Contact
### 2.1 Data Processing for Contract Fulfilment
For the purpose of fulfilling contracts, including enquiries and processing of any existing claims arising from warranty rights, service disruptions and the right of withdrawal, as well as any statutory updating obligations, we collect personal data that you voluntarily provide to us when placing an order.
This processing is based on Art. 6(1)(b) GDPR.
Mandatory fields are marked as such because we require this information to fulfil the contract and cannot ship your order without it.
The data collected can be seen in the respective input forms.
Further information about the processing of your data, particularly the transfer of data to our service providers for order processing, payment processing and shipping, can be found in the following sections of this Privacy Policy.
After the contract has been fully processed, your data will be restricted from further processing and deleted after the expiry of the statutory retention periods under tax and commercial law pursuant to Art. 6(1)(c) GDPR, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we reserve the right to use the data beyond this where legally permitted and have informed you accordingly in this Privacy Policy.
### 2.2 Customer Account
If you have given your consent pursuant to Art. 6(1)(a) GDPR by choosing to create a customer account, we use your data to create your customer account and store your information for future orders on our website.
You can delete your customer account at any time by contacting us using the contact details provided in this Privacy Policy or by using the relevant function in your customer account.
After your customer account has been deleted, your data will be deleted unless you have expressly consented to further use pursuant to Art. 6(1)(a) GDPR or we reserve the right to use the data beyond this where legally permitted and have informed you accordingly.
### Contact
As part of customer communication, we collect personal data that you voluntarily provide when contacting us, for example via contact form, live chat or email.
This processing is based on Art. 6(1)(b) GDPR.
Mandatory fields are marked as such where the information is necessary to process your enquiry.
After your enquiry has been fully processed, your data will be deleted unless you have expressly consented to further use pursuant to Art. 6(1)(a) GDPR or we reserve the right to use the data beyond this where legally permitted and have informed you accordingly.
## 3. Data Processing for Shipping
For the fulfilment of the contract pursuant to Art. 6(1)(b) GDPR, we transfer your data to the shipping service provider responsible for delivering your order, insofar as this is necessary for delivery of the goods ordered.
If you have any questions about our service providers or the basis of our cooperation with them, please contact us using the contact details provided in this Privacy Policy.
## 4. Data Processing for Payment Processing
When processing payments in our online shop, we work with the following partners:
* technical service providers
* banks and financial institutions
* payment service providers
### 4.1 Data Processing for Payment Transactions
Depending on the payment method selected, we transfer the data required to process the payment transaction to our technical service providers, the relevant banks or the selected payment service provider, insofar as this is necessary to process the payment.
This processing is carried out for the fulfilment of the contract pursuant to Art. 6(1)(b) GDPR.
Some payment service providers collect the data required to process the payment themselves, for example on their own website or through technical integration into the ordering process.
In such cases, the privacy policy of the respective payment service provider applies.
Depending on the payment method selected, data may be transferred to countries outside the EU/EEA for which the European Commission has established an adequate level of data protection.
Where data is transferred to countries outside the EU/EEA for which no adequacy decision exists, such transfers are based on the European Commission's Standard Contractual Clauses.
If you have any questions regarding our payment processing partners or the legal basis for our cooperation with them, please contact us using the contact details provided in this Privacy Policy.
### 4.2 Data Processing for Fraud Prevention and Optimisation of Payment Processes
Where necessary, we may provide the aforementioned service providers with additional data, which they use together with the data required for payment processing for the purpose of fraud prevention and optimisation of our payment processes.
This may include invoicing, handling disputed payments and supporting accounting processes.
This processing is based on Art. 6(1)(f) GDPR and serves our legitimate interests in protecting against fraud and ensuring efficient payment management.
## 5. Advertising by Email
### Email Newsletter with Subscription and Newsletter Tracking with Separate Consent
If you subscribe to our newsletter, we use the data required for this purpose or separately provided by you to regularly send you our email newsletter based on your consent pursuant to Art. 6(1)(a) GDPR.
You may unsubscribe from the newsletter at any time by contacting us using the contact details provided below or by using the unsubscribe link included in the newsletter.
After unsubscribing, your email address will be removed from the mailing list unless you have expressly consented to further use of your data pursuant to Art. 6(1)(a) GDPR or we are legally permitted to retain or use the data for another purpose and have informed you accordingly.
If you have additionally given your consent pursuant to Art. 6(1)(a) GDPR to analyse our newsletters, we analyse your interaction with our newsletters by measuring, storing and evaluating open rates and click rates for the purpose of designing future newsletter campaigns ("newsletter tracking").
For this purpose, the emails we send contain technologies such as one-pixel technologies, web beacons or tracking pixels.
The newsletter data may include:
* the page from which the request was made (referrer URL)
* date and time of access
* browser type
* IP address
* email address
* date and time of subscription and confirmation
The tracking technologies may be linked to your email address, IP address and, where applicable, an individual ID.
Links contained in the newsletter may also contain this ID.
You may withdraw your consent to newsletter tracking at any time by contacting us or using the relevant link in the newsletter.
The information is stored for as long as you remain subscribed to the newsletter.
## 6. Cookies and Other Technologies
### 6.1 General Information
To make our website attractive and enable certain functions, we use technologies including cookies on various pages.
Cookies are small text files automatically stored on your device.
Some cookies are deleted when you close your browser ("session cookies"). Other cookies remain on your device and allow us to recognise your browser when you visit our website again ("persistent cookies").
You can find information about the storage duration in your browser's cookie settings.
### Privacy Protection on Devices
When using our online services, we use strictly necessary technologies to provide the digital service you have expressly requested.
The storage of information on your device or access to information already stored on your device does not require consent where this is technically necessary to provide the service.
For functions that are not strictly necessary, storing information on your device or accessing information already stored on your device requires your consent.
Please note that if you do not provide consent, certain parts of our website may not function fully.
Any consent you provide remains valid until you change or reset the relevant settings on your device.
### Subsequent Data Processing Through Cookies and Other Technologies
We use technologies that are strictly necessary for certain functions of our website.
These technologies may collect and process:
* IP address
* time of visit
* device information
* browser information
* information about your use of our website
This processing is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR in optimising the presentation and functionality of our services.
We also use technologies to fulfil legal obligations, for example to document consent to the processing of personal data, as well as for web analytics and online marketing.
Further information, including the legal basis for processing, can be found in the following sections of this Privacy Policy.
### Cookie Settings
Cookie settings for your browser can be found under the following browsers:
**Microsoft Edge / Safari / Chrome / Firefox / Opera**
Where you have consented to the use of technologies pursuant to Art. 6(1)(a) GDPR, you may withdraw your consent at any time by contacting us using the contact details provided in this Privacy Policy.
Alternatively, you may use the following link:
**[https://bellanatur.shop/policies/#shopifyReshowConsentBanner](https://bellanatur.shop/policies/#shopifyReshowConsentBanner)**
Please note that refusing cookies may limit the functionality of our website.
## 6.2 Shopify Consent Manager Tool
We use the Shopify Consent Manager Tool on our website to inform you about the cookies and other technologies we use and to obtain, manage and document any consent required for processing your personal data.
This is necessary pursuant to Art. 6(1)(c) GDPR to fulfil our legal obligation under Art. 7(1) GDPR to be able to demonstrate that consent has been obtained.
The Shopify Consent Manager Tool is provided by:
**Shopify International Limited**
Victoria Buildings
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland
After you submit your cookie declaration on our website, Shopify's web server stores your IP address, the date and time of your declaration, browser information, language, the URL from which the declaration was submitted and information about your consent behaviour.
A cookie is also used to store information about your consent behaviour.
Your data will be deleted after 365 days unless you have expressly consented to further use pursuant to Art. 6(1)(a) GDPR or we are legally permitted to retain or use the data for another purpose and have informed you accordingly.
Our service providers are located in and/or use servers in countries for which the European Commission has established an adequate level of data protection, including the USA where the applicable certification requirements are met.
For transfers to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses.
### Shopify Tracking
We use the tracking and analytics tool provided by Shopify International Limited.
**Shopify International Limited**
Victoria Buildings
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland
This processing is based on Art. 6(1)(f) GDPR and serves our legitimate interests in statistically analysing user behaviour on our website and ensuring a user-friendly, needs-based design and continuous optimisation of our services.
Shopify tracking does not use cookies.
Your data, including IP address, time of visit, device and browser information, is automatically collected, combined and processed using pseudonymised usage profiles for the purposes described above.
The data is shortened, stored as a hash value and additionally encrypted using a random value that changes every 24 hours.
This prevents conclusions from being drawn about the identity of individual users. The data is not combined with other data.
## 7. Use of Cookies and Other Technologies
We use the following cookies and other technologies provided by third parties on our website.
Unless otherwise stated for the individual technologies, these are used on the basis of your consent pursuant to Art. 6(1)(a) GDPR.
Once the purpose for which the technology is used has ended, the data collected in this context will be deleted.
You may withdraw your consent at any time with effect for the future.
Further information about withdrawing consent can be found in the section "Cookies and Other Technologies".
## 7.1 Use of Google Services
We use technologies provided by **Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google")**.
Information automatically collected through Google technologies about your use of our website is generally transferred to and stored on a server operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Unless otherwise stated for the individual technologies, data processing is based on an agreement between jointly responsible parties pursuant to Art. 26 GDPR.
Further information about Google's processing of personal data can be found in Google's privacy information.
### Google Analytics
For website analysis purposes, Google Analytics automatically collects and stores data including:
* IP address
* time of visit
* device and browser information
* information about your use of our website
Pseudonymous usage profiles may be created from this data.
Cookies may be used for this purpose.
If you access our website from the EU, your IP address is stored on a server located in the EU for the purpose of deriving location data and is then immediately deleted before the traffic is forwarded to Google's other servers for processing.
Data processing is based on a data processing agreement with Google.
### Google Maps
Google Maps is used to display geographical information.
Google collects data about your use of the Maps functions, in particular your IP address and location data, transmits this information to Google and subsequently processes it.
We have no influence over this subsequent data processing.
### Google reCAPTCHA
We use Google reCAPTCHA to protect our web forms against misuse and spam from automated software ("bots").
Google reCAPTCHA collects data such as:
* IP address
* time of visit
* browser information
* information about your use of our website
It analyses your use of our website using JavaScript and cookies.
Other cookies stored by Google services in your browser may also be evaluated.
Data processing is based on a data processing agreement with Google.
### Google Tag Manager
Google Tag Manager allows us to manage various codes and services on our website.
When individual tags are implemented, Google may also process personal data such as IP addresses and online identifiers, including cookies.
Data processing is based on a data processing agreement with Google.
### YouTube Video Plugin
To integrate third-party content, we use the YouTube Video Plugin in its extended privacy mode.
Data such as IP address, time of visit, device and browser information is collected and transmitted to Google only when you play a video.
## 7.2 Use of Meta Services
### Meta Pixel
We use the Meta Pixel as part of the technologies provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland ("Meta").
The Meta Pixel automatically collects and stores data including:
* IP address
* time of visit
* device and browser information
* information about your use of our website, such as visits to pages or newsletter registrations
Pseudonymous usage profiles may be created from this data.
As part of advanced matching, information such as names, email addresses and telephone numbers may also be collected and stored in hashed form for matching purposes.
When you visit our website, the Meta Pixel automatically places a cookie that allows your browser to be recognised using a pseudonymous cookie ID when visiting other websites.
Meta may combine this information with other data from your Facebook account and use it to create reports about website activity and provide services associated with website usage, particularly personalised and group-based advertising.
The information collected through Meta technologies is generally transferred to and stored on servers operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA.
Further information can be found in Meta's privacy information.
### Meta Ads Manager
We use Meta Ads Manager to advertise our website on Facebook and other platforms.
We determine the parameters of the respective advertising campaigns.
Meta Platforms Ireland is responsible for the detailed implementation, particularly deciding where advertisements are shown to individual users.
Where applicable, data processing is based on an agreement between jointly responsible parties pursuant to Art. 26 GDPR.
We use statistics generated by the Meta Pixel to conduct group-based advertising through Custom Audiences.
We also use pseudonymous cookie IDs and information about your behaviour on our website for personalised advertising.
Through conversions measured using the Meta Pixel or Conversions API, we analyse and track your subsequent behaviour when you reach our website via an advertisement from Meta Ads Manager.
Data processing is based on a data processing agreement with Meta Platforms Ireland.
## 7.3 Other Providers of Web Analytics and Online Marketing Services
### Hotjar
We use technologies provided by **Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St Julian's STJ 3141, Malta ("Hotjar")** for website analysis.
Hotjar automatically collects and stores data including:
* IP address
* time of visit
* device and browser information
* information about your use of our website
Pseudonymous usage profiles may be created from this data.
Cookies may be used for this purpose.
The pseudonymised usage profiles are not combined with personal data identifying the person behind the pseudonym without separate and explicit consent.
Hotjar processes data on our behalf.
For transfers to countries without an adequacy decision, our cooperation is based on the European Commission's Standard Contractual Clauses.
## 8. Social Media
### 8.1 Social Buttons from Facebook, Instagram and Pinterest
Our website contains social media buttons for various social networks.
These are integrated into the website solely as HTML links, meaning that no connection to the servers of the respective provider is established when you initially visit our website.
If you click one of these buttons, the website of the respective social network opens in a new browser window.
There you can, for example, use the Like or Share function.
### 8.2 Our Online Presence on Facebook, Instagram, YouTube and Pinterest
Where you have given your consent pursuant to Art. 6(1)(a) GDPR to the respective social media provider, your data may be automatically collected and stored when you visit our social media pages for market research and advertising purposes.
Pseudonymous usage profiles may be created and used to display advertisements within and outside the respective platforms that are presumed to correspond to your interests.
Cookies are generally used for this purpose.
For detailed information about data processing and use by the respective social media providers, as well as contact options and your rights and privacy settings, please refer to the privacy policies of the respective providers.
### Facebook
Facebook is provided by **Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland**.
Information automatically collected by Meta about your use of our Facebook presence is generally transferred to and stored on servers operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA.
Data processing when visiting our Facebook page is based on an agreement between jointly responsible parties pursuant to Art. 26 GDPR.
### Instagram
Instagram is provided by **Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland**.
Information automatically collected by Meta about your use of our Instagram presence is generally transferred to and stored on servers operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA.
Data processing when visiting our Instagram page is based on an agreement between jointly responsible parties pursuant to Art. 26 GDPR.
### YouTube
YouTube is provided by **Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland**.
Information automatically collected by Google about your use of our YouTube presence is generally transferred to and stored on servers operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
For transfers to countries without an adequacy decision, our cooperation is based on the European Commission's Standard Contractual Clauses.
### Pinterest
Pinterest is provided by **Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland**.
Information automatically collected by Pinterest about your use of our Pinterest presence is generally transferred to and stored on servers operated by Pinterest, Inc., 505 Brannan St., San Francisco, CA 94107, USA.
For transfers to countries without an adequacy decision, our cooperation is based on the European Commission's Standard Contractual Clauses.
## 9. Contact Options and Your Rights
### 9.1 Your Rights
As a data subject, you have the following rights:
* **Right of access:** pursuant to Art. 15 GDPR, you have the right to request information about the personal data we process about you.
* **Right to rectification:** pursuant to Art. 16 GDPR, you have the right to request the immediate correction of inaccurate personal data or completion of incomplete data.
* **Right to erasure:** pursuant to Art. 17 GDPR, you have the right to request deletion of your personal data, subject to the legal exceptions.
* **Right to restriction of processing:** pursuant to Art. 18 GDPR, you have the right to request restriction of processing under the conditions specified there.
* **Right to data portability:** pursuant to Art. 20 GDPR, you have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format or request its transmission to another controller.
* **Right to lodge a complaint:** pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority.
You can generally contact the supervisory authority at your usual place of residence, place of work or our company's registered office.
### Right to Object
Where we process personal data on the basis of our legitimate interests as described above, you may object to this processing with effect for the future.
If the processing is carried out for direct marketing purposes, you may exercise your right to object at any time.
Where processing is carried out for other purposes, you may object only if there are grounds relating to your particular situation.
Following an objection, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
This does not apply where the processing is carried out for direct marketing purposes. In that case, we will no longer process your personal data for direct marketing.
### 9.2 Contact Options
If you have any questions regarding the collection, processing or use of your personal data, or if you wish to request access, rectification, restriction or deletion of data, withdraw consent or object to a specific use of your data, please contact us directly using the contact details provided in our **Legal Notice (Imprint)**.