The responsible party for data processing in accordance with the provisions of the General Data Protection Regulation (GDPR) is:

 

Natch Labs GmbH

Choriner Str. 3

10119 Berlin, Germany

 

Website: www.natchlabs.com

E-mail: privacy@natchlabs.com

 

We appreciate your interest in our online shop. Protecting your privacy is very important to us. Below we inform you in detail about the handling of your data.

1. ACCESS DATA AND HOSTING

You can visit our websites without providing any personal information. Each time a website is accessed, the web server automatically stores only a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of the retrieval, the amount of data transferred, and the requesting provider (access data) and documents the retrieval. This access data is evaluated exclusively for the purpose of ensuring trouble-free operation of the site and the improvement of our offer. This serves to safeguard our legitimate interests, which are predominant in the context of a balancing of interests, in the correct presentation of our offer in accordance with Art. 6(1)(f) GDPR. All access data will be deleted no later than seven days after the end of your page visit.

1.1 HOSTING

The services for hosting and displaying the website are provided by our service provider Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, in the course of processing on our behalf. Shopify uses Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada as a subprocessor. This transmission is justified under Art. 45 GDPR because Canada has an adequate level of data protection as per an adequacy decision of the European Commission. Further information about data protection at Shopify can be obtained at https://www.shopify.com/legal/privacy.

1.2 CONTENT DELIVERY NETWORK

For the purpose of shorter loading times, we use a so-called Content Delivery Network (CDN) for some services. This service provides content, such as large media files, through regionally distributed servers of external CDN service providers. Therefore, access data is processed on the servers of the service providers. Our service providers work for us as part of order processing.

2. DATA PROCESSING FOR CONTRACT INITIATION, CONTACT, AND OPENING OF A CUSTOMER ACCOUNT

We collect personal data if you voluntarily provide it to us as part of your order or when you contact us (e.g. via contact form or e-mail). Mandatory fields are marked as such, as in these cases we absolutely need the data for the execution of the contract or for the processing of your contact. The data collected can be seen from the respective input forms. We use the data you provide to process the contract and process your inquiries in accordance with Art. 6(1)(b) GDPR.

Insofar as you have given your consent in accordance with Art. 6(1)(a) GDPR by deciding to open a customer account, we will use your data for the purpose of opening the customer account. After the complete execution of the contract or deletion of your customer account, your data will be restricted for further processing and deleted after the expiry of the retention periods under tax and commercial law in accordance with Art. 6(1)(c) GDPR. The deletion of your customer account is possible at any time and can be done either by sending a message to the contact option described in this privacy policy or via a function provided for this purpose in the customer account.

3. DATA PROCESSING FOR THE PURPOSE OF SHIPPING PROCESSING

In order to fulfill the contract in accordance with Art. 6(1)(b) GDPR, we pass on your data to the shipping service provider commissioned with the delivery, insofar as this is necessary for the delivery of ordered goods.

4. DATA PROCESSING FOR PAYMENT PROCESSING

When processing payments in our online shop, we cooperate with these partners: technical service providers, credit institutions, payment service providers.

4.1 DATA PROCESSING FOR TRANSACTION PROCESSING

Depending on the payment method selected, we pass on the data necessary for the processing of the payment transaction to our technical service providers, who work for us in the context of order processing, or to the commissioned credit institutions or to the selected payment service provider, insofar as this is necessary for the processing of the payment. This serves the fulfilment of the contract in accordance with Art. 6(1)(b) GDPR.

4.2 DATA PROCESSING FOR THE PURPOSE OF FRAUD PREVENTION AND THE OPTIMIZATION OF OUR PAYMENT PROCESSES

If necessary, we provide our service providers with additional data that they use together with the data necessary for the processing of the payment as our processors for the purpose of preventing fraud and optimising our payment processes. In accordance with Art. 6(1)(f) GDPR, this serves to safeguard our overriding legitimate interests in our protection against fraud or inefficient payment management.

4.3 IDENTITY AND CREDIT CHECK AT THE SELECTION OF KLARNA PAYMENT SERVICES

Klarna Pay now (direct debit)

If you opt for the payment services of Klarna Bank AB (publ), Sveavagen 46, 111 34 Stockholm, Sweden, we ask for your consent in accordance with Art. 6(1)(a) GDPR that we may transmit to Klarna the data necessary for the processing of the payment and an identity and credit check. In Germany, the business information agencies mentioned in Klarna's data protection declaration may be used for identity and credit assessment. You can revoke your consent at any time by sending a message to the contact option mentioned in this privacy policy.

5. ADVERTISING BY E-MAIL, POST

5.1 E-MAIL NEWSLETTER WITH REGISTRATION

When you subscribe to our newsletter, we use the data required or separately provided by you to regularly send you our e-mail newsletter on the basis of your consent in accordance with Art. 6(1)(a) GDPR.

You can unsubscribe from the newsletter at any time, either by sending a message to the contact option described in this privacy policy or via a dedicated link in the newsletter.

5.2 E-MAIL NEWSLETTER WITHOUT REGISTRATION AND YOUR RIGHT TO OBJECT

If we receive your e-mail address in connection with the sale of goods or services and you have not objected to this, we reserve the right to send you regular offers of similar products by e-mail on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR. You can object to this use of your e-mail address at any time by sending a message to the contact option described in this Privacy Policy or by means of a link provided for this purpose in the advertising email.

5.3 NEWSLETTER DISPATCH

The newsletter may also be sent by our service providers as part of processing on our behalf.

5.4 SENDING EVALUATION REQUESTS BY E-MAIL

If you have given us your express consent in accordance with Art. 6(1)(a) GDPR during or after your order, we will use your e-mail address to request a review of your order via the evaluation system we use. This consent can be revoked at any time by sending a message to the contact option described in this privacy policy or via a dedicated link in the evaluation request.

5.5 MAIL ADVERTISING AND YOUR RIGHT TO OPT-OUT

In addition, we reserve the right to use your first and last name as well as your postal address for our own advertising purposes, e.g. to send interesting offers and information about our products by post. This serves to safeguard our legitimate interests in accordance with Art. 6(1)(f) GDPR. You can object to the storage and use of your data for these purposes at any time by sending a message to the contact option described in this Privacy Policy.

6. COOKIES AND OTHER TECHNOLOGIES

6.1 GENERAL INFORMATION

In order to make your visit to our website attractive and to enable the use of certain functions, we use technologies including so-called cookies on various pages. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted after the end of the browser session, i.e. after closing your browser (so-called session cookies). Other cookies remain on your device and allow us to recognize your browser the next time you visit (persistent cookies).

We use such technologies that are strictly necessary for the use of certain functions of our website (e.g. shopping cart function). These technologies collect and process IP address, time of visit, device and browser information as well as information about your use of our website. This serves within the framework of a balance of interests of overriding legitimate interests in an optimized presentation of our offer in accordance with Art. 6(1)(f) GDPR.

We also use technologies to fulfill the legal obligations to which we are subject as well as for web analysis and online marketing. For more information, including the legal basis for data processing, please refer to the following sections of this Privacy Policy.

6.2 CONSENT MANAGEMENT TOOL (CONSENTMO) – INCLUDING GOOGLE CONSENT MODE V2

On our website, we use the consent management tool Consentmo GDPR provided by Digital Monkeys Limited, Bulgaria. This tool serves to inform you about the cookies and other technologies we use on our website, as well as to obtain, manage and document your consent to the processing of your personal data.

As part of Consentmo, Google Consent Mode v2 is also implemented. This mode allows the behavior of Google services (in particular Google Analytics and Google Ads) to be automatically adapted to your consent decisions:

•       If you do not consent to analytics or advertising cookies, the relevant Google services will either not be activated or will operate exclusively using cookie-free, aggregated modelling (Conversion Modelling / Behavioral Modelling) that does not allow personal identification.

•       If you give your consent, Google services will be activated as described in Section 7.1.

The legal basis for using the consent management tool is Art. 6(1)(c) GDPR (fulfillment of our legal obligation under Art. 7(1) GDPR to be able to demonstrate your consent). When you submit your cookie declaration on our website, your IP address, date and time of your declaration, browser information, language, URL from which the declaration was sent, and information about your consent behavior are stored server-side. The data will be deleted after 365 days.

Further information: https://consentmo.com/privacy-policy

7. USE OF COOKIES AND OTHER TECHNOLOGIES FOR WEB ANALYSIS AND ADVERTISING PURPOSES

Insofar as you have given your consent in accordance with Art. 6(1)(a) GDPR, we use the following cookies and other third-party technologies on our website. After the purpose has been fulfilled, the data collected in this context will be deleted. You can revoke your consent at any time with effect for the future.

Note on consent (separate from newsletter): Consent for web analysis and advertising purposes may also cover personalized advertising measures where we transfer name and e-mail address in hashed form to advertising platforms (in particular Google and Meta) for customer matching (e.g. Customer Match / Custom Audiences from customer list) in order to build audiences (e.g. reactivation) or exclude audiences (e.g. existing customer exclusion). This consent is independent of newsletter consent (Section 5) and can be withdrawn at any time with effect for the future.

7.1 USE OF GOOGLE IRELAND LTD. SERVICES

We use the technologies of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. The information automatically collected by Google Technologies about your use of our website is usually transmitted to a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA and stored there.

There is no adequacy decision from the European Commission for the United States. Where personal data is transferred to certified U.S. companies, such transfers may be based on the European Commission's EU-U.S. Data Privacy Framework adequacy decision (10 July 2023); otherwise, transfers are carried out on the basis of appropriate safeguards (e.g. Standard Contractual Clauses). Our cooperation is based — where required — on Standard Contractual Clauses adopted by the European Commission.

If your IP address is collected via Google technologies, it will be truncated by activating IP anonymization before being stored on Google's servers. Further information about data processing by Google can be found in Google's privacy policy.

GOOGLE ANALYTICS

For the purpose of website analysis, Google Analytics automatically collects and stores data (IP address, time of visit, device and browser information as well as information about your use of our website) from which user profiles are created using pseudonyms. Cookies can be used for this purpose. Your IP address will not be merged with other data from Google. The data processing is based on an agreement on order processing by Google.

GOOGLE ADS

For advertising purposes in Google search results as well as on third-party websites, the so-called Google Remarketing Cookie is set when you visit our website, which automatically enables interest-based advertising by collecting and processing data (IP address, time of visit, device and browser information as well as information about your use of our website) and by means of a pseudonymous CookieID. For website analysis and event tracking, we use Google Ads Conversion Tracking to measure your subsequent usage behavior when you access our website via a Google Ads ad.

GOOGLE ADS – CUSTOMER MATCH / CUSTOMER LISTS

Subject to your consent pursuant to Art. 6(1)(a) GDPR, we use the Customer Match feature in Google Ads. In this context, we may transfer name and e-mail address in hashed form to Google so that Google can perform a matching process with Google user accounts and provide a customer list in our Google Ads account. Purposes: (a) Excluding existing customers from certain campaigns; (b) addressing leads through personalized advertising.

GOOGLE FONTS

For the uniform presentation of the contents on our website, data (IP address, time of visit, device and browser information) are collected by the script code Google Fonts, transmitted to Google and then processed by Google.

YOUTUBE VIDEO PLUGIN

In order to integrate third-party content, data (IP address, time of visit, device and browser information) is collected via the YouTube video plugin in the extended data protection mode used by us, and transmitted to Google and processed only if you are playing a video.

7.2 MICROSOFT ADVERTISING

For advertising purposes in Bing, Yahoo and MSN search results as well as on third-party websites, the so-called Microsoft Advertising Remarketing Cookie is set when you visit our website, which automatically enables interest-based advertising by collecting and processing data (IP address, time of visit, device and browser information as well as information about your use of our website) and by means of a pseudonymous CookieID.

7.3 USE OF FACEBOOK IRELAND LTD. SERVICES

USE OF FACEBOOK PIXEL

We use the Facebook Pixel as part of the technologies of Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. The Facebook Pixel automatically collects and stores data (IP address, time of visit, device and browser information as well as information about your use of our website based on events) from which user profiles are created using pseudonyms. Facebook will combine this information with other data from your Facebook account and use it to compile reports on website activity and to provide other services, in particular personalized and group-based advertising.

The information automatically collected by Facebook technologies is usually transmitted to a server of Facebook, Inc., 1601 Willow Road, Menlo Park, California 94025, USA and stored there. Where personal data is transferred to certified U.S. companies, such transfers may be based on the European Commission's EU-U.S. Data Privacy Framework adequacy decision; otherwise, transfers are carried out on the basis of Standard Contractual Clauses.

FACEBOOK ANALYTICS

As part of Facebook Analytics, statistics on visitor activity on our website are compiled from the data collected with the Facebook Pixel. The data processing is based on an agreement on order processing by Facebook.

FACEBOOK ADS

Through Facebook Ads, we promote this website on Facebook as well as on other platforms. The data processing is carried out on the basis of an agreement between joint controllers in accordance with Art. 26 GDPR. Joint responsibility is limited to the collection of data and their transmission to Facebook Ireland. Based on the statistics generated via Facebook Pixel, we use Facebook Custom Audience to create group-based advertising on Facebook.

META CUSTOM AUDIENCES FROM CUSTOMER LIST (CUSTOMER MATCHING)

Subject to your consent pursuant to Art. 6(1)(a) GDPR, we also use Custom Audiences from customer list. In this context, we may transfer name and e-mail address in hashed form to Meta Platforms Ireland Ltd. so that Meta can perform a matching process with user accounts and enable us to display ads to corresponding target groups. Purposes: (a) Reactivation of inactive customers via ads on Meta services; (b) addressing leads through personalized advertising. Important: Consent to our newsletter (Section 5) is separate from this.

7.4 OMNISEND (E-MAIL MARKETING)

Our e-mail newsletters are sent via the following provider: Omnisend Ltd (formerly Soundest Ltd), Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

Based on our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provide when registering for the newsletter to this provider in accordance with Art. 6(1)(f) GDPR so that they can send the newsletter on our behalf.

Subject to your express consent in accordance with Art. 6(1)(a) GDPR, the provider also carries out a statistical evaluation of the success of newsletter campaigns using web beacons or tracking pixels in the emails sent, which can measure opening rates and specific interactions with the content of the newsletter. You can revoke your consent to newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider. Further information: https://www.omnisend.com/privacy/

7.5 TRADEDOUBLER

The controller has integrated components of Tradedoubler on this website. Tradedoubler is a German affiliate network that offers affiliate marketing. The operating company of Tradedoubler is Tradedoubler GmbH, Herzog-Wilhelm-Strasse 26, 80331 Munich, Germany.

Tradedoubler sets a tracking cookie on the information technology system of the data subject. The tracking cookie from Tradedoubler does not store any personal data. Only the identification number of the affiliate, the serial number of the visitor, and the clicked advertising material are stored. The applicable data protection provisions of Tradedoubler can be accessed under http://www.tradedoubler.com/en/privacy-policy/.

7.6 TABOOLA

Taboola, Inc. uses cookies that determine what content you use and which of our pages you visit on the website. This enables us to create a pseudonymous user profile of you and to recommend content that suits your personal interests. Further information: https://www.taboola.com/privacy-policy

7.7 TRIPLE WHALE

We use the ecomOS service to measure the performance of our marketing services. Service provider: Triple Whale Inc, 800 N High Street, Columbus OH 43215, USA. Legal basis: Consent (Art. 6(1)(a) GDPR). Further information: https://www.triplewhale.com/privacy

7.8 SMILE.IO

We offer a loyalty points scheme through a third-party provider called Smile.io. Smile.io may collect and process certain personal data. Smile.io has their own privacy policy which can be found at https://smile.io/privacy-policy where you can update, change or delete your data.

7.9 TIKTOK

Our cooperation is based on the standard data protection clauses of the European Commission. TikTok Inc, Attn: TikTok Legal Department, 10100 Venice Blvd, Suite 401, Culver City, CA 90232, USA. Contact: https://www.tiktok.com/legal/report/privacy. Privacy Policy: https://www.tiktok.com/legal/privacy-policy

7.10 TRUSTPILOT

On our website we use the review service Trustpilot provided by Trustpilot A/S, Pilestrade 58, 5th Floor, 1112 Copenhagen, Denmark.

After completing an order, you may receive an invitation to submit a review by e-mail. For this purpose, we transmit your e-mail address as well as information about your order (order number, order date, products ordered) to Trustpilot. This serves the protection of our legitimate interest in presenting our offer through verified customer reviews in accordance with Art. 6(1)(f) GDPR. The data collected by Trustpilot is processed on servers within the EU. Further information: https://legal.trustpilot.com/privacy-policy

7.11 SEAL SUBSCRIPTIONS

For the management of subscriptions and recurring payments, we use the app Seal Subscriptions provided by Seal Subscriptions d.o.o., Slovenia.

In the course of order processing, your data provided during the ordering process (name, e-mail address, delivery address, payment data) is transmitted to Seal Subscriptions and processed there, insofar as this is necessary for the management of your subscription. The legal basis is Art. 6(1)(b) GDPR. A data processing agreement exists with the provider. Further information: https://sealsubscriptions.com/privacy-policy

7.12 HELIUM CUSTOMER FIELDS

For the collection and management of extended customer profile fields (e.g. during account registration), we use the app Helium Customer Fields provided by Helium Development LLC, USA.

The data collected in this context is processed on the basis of your consent (Art. 6(1)(a) GDPR) or for the initiation and performance of a contract (Art. 6(1)(b) GDPR). The transfer to the USA is carried out on the basis of Standard Contractual Clauses pursuant to Art. 46 GDPR. Further information: https://heliumdev.com/privacy

8. TRUSTED SHOPS TRUSTBADGE INTEGRATION

The Trusted Shops Trustbadge is included on this website for the display of our Trusted Shops seal of approval and the reviews collected if necessary, as well as for the offer of Trusted Shops products for buyers after an order. This serves to safeguard our legitimate interests, which are predominant in the context of a balancing of interests, in optimal marketing by enabling safe purchasing in accordance with Art. 6(1)(f) GDPR. The Trustbadge and the services advertised are an offer of Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne.

When the Trustbadge is called, the web server automatically stores a server log file, which also contains your IP address, date and time of retrieval, transferred data volume, and the requesting provider. Individual access data is stored in a secure database for the analysis of security vulnerabilities. The log files are automatically deleted no later than 90 days after creation. Further information on the data protection of Trusted Shops GmbH can be found in the Trustbadge privacy policy.

9. SOCIAL MEDIA

OUR ONLINE PRESENCE ON FACEBOOK, TWITTER, INSTAGRAM, YOUTUBE, PINTEREST, LINKEDIN

Insofar as you have given your consent to this in accordance with Art. 6(1)(a) GDPR to the respective social media operator, your data will be automatically collected and stored for market research and advertising purposes when you visit our online presence on the above-mentioned social media, from which user profiles are created using pseudonyms.

Facebook is an offer of Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. Our cooperation is based on Standard Contractual Clauses of the European Commission. The data processing in the context of the visit of a Facebook fan page is carried out on the basis of an agreement between joint controllers in accordance with Art. 26 GDPR.

Twitter is an offer of Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Our cooperation is based on Standard Contractual Clauses of the European Commission.

Instagram is an offer of Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. Our cooperation is based on Standard Contractual Clauses of the European Commission.

YouTube is an offer of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Our cooperation is based on Standard Contractual Clauses of the European Commission.

Pinterest is an offer of Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Our cooperation is based on Standard Contractual Clauses of the European Commission.

LinkedIn is an offer of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Our cooperation is based on Standard Contractual Clauses of the European Commission.

10. CONTACTS AND YOUR RIGHTS

As a data subject, you have the following rights:

•       pursuant to Art. 15 GDPR, the right to request information about your personal data processed by us;

•       pursuant to Art. 16 GDPR, the right to request immediate correction of inaccurate or completion of your personal data stored by us;

•       pursuant to Art. 17 GDPR, the right to request the deletion of your personal data stored by us, unless a legal exception applies;

•       pursuant to Art. 18 GDPR, the right to request the restriction of the processing of your personal data;

•       pursuant to Art. 20 GDPR, the right to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request the transfer to another controller;

•       the right to complain to a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our registered office.

If you have any questions about the collection, processing or use of your personal data, please contact us directly via the contact details in our imprint.

11. ESTIMATED DELIVERY TIME BASED ON IP LOCATION (GEOLOCATION)

To calculate estimated delivery times, we use a location-based feature provided by our fulfillment partner Hive. Your IP address is temporarily used to determine your approximate location. This is solely for displaying realistic delivery times in the store and is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR to provide you with an optimized user experience. The IP address is not stored or used for any other purpose (e.g. marketing).

RIGHT TO OBJECT

Insofar as we process personal data as explained above in order to safeguard our legitimate interests, which are predominant in the context of a balancing of interests, you may object to this processing with effect for the future. If the processing is carried out for the purposes of direct marketing, you can exercise this right at any time as described above. Insofar as the processing takes place for other purposes, you are only entitled to object if there are reasons arising from your particular situation.

After exercising your right to object, we will not process your personal data for these purposes, unless we can prove compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims.