Privacy Policy
This English translation is provided for your convenience only. Only the German version is legally binding.
Privacy Policy
Last updated: October 2026
1) Information on the collection of personal data and contact details of the controller
1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about how we handle your personal data when you use our website. Personal data is any data that can be used to identify you personally.
1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is ORGANICATION Europe GmbH, Neckartailfingerstr. 28, 72622 Nürtingen, Germany, phone: +49 7022 9045200, fax: +49 7022 9045202, email: info@organication.de.
1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries), this website uses SSL/TLS encryption. You can recognise an encrypted connection by the character string “https://” and the padlock symbol in your browser’s address bar.
2) Data collected when you visit our website
When you use our website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called “server log files”). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:
- the page of our website visited
- date and time of access
- amount of data sent in bytes
- source/referrer from which you reached the page
- browser used
- operating system used
- IP address used (anonymised where applicable)
The processing is based on Art. 6(1)(f) GDPR on the basis of our legitimate interest in the stability, security and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to review the server log files retrospectively if there are concrete indications of unlawful use.
3) Hosting by Shopify
We use the shop system of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”) for hosting and displaying the online shop on the basis of processing on our behalf (Art. 28 GDPR). All data collected on our website is processed on Shopify’s servers. As part of Shopify’s services, data may also be transferred to Shopify Inc., 151 O’Connor Street, Ground Floor, Ottawa, ON K2P 2L8, Canada, and to group companies in the USA. An adequacy decision of the European Commission exists for Canada. For transfers to the USA, Shopify relies on the European Commission’s Standard Contractual Clauses and – where certified – on the adequacy decision for the EU-US Data Privacy Framework.
The legal basis is Art. 6(1)(b) GDPR insofar as the processing is necessary for initiating or performing a contract, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing a secure and functional online shop. Further information on data protection at Shopify: https://www.shopify.com/legal/privacy
4) Cookies and similar technologies, consent management
4.1 Our website uses cookies and similar technologies (e.g. pixels, local storage). Information is stored on or read from your device.
4.2 We use technically necessary cookies that are strictly required to operate the online shop (e.g. shopping basket, checkout, login, storing your cookie choices) on the basis of Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Where personal data is processed in this context, the legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (legitimate interest in a functioning shop).
4.3 We only use all other cookies and technologies, in particular for analytics and marketing purposes (see sections 12 and 13), if you have given your prior consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw or change your consent at any time with effect for the future by reopening the cookie settings via the corresponding link in the footer of our website.
4.4 In addition, you can set your browser to inform you when cookies are set, to allow cookies only in individual cases or to block them in general. Disabling cookies may limit the functionality of our website.
5) Contacting us
When you contact us (e.g. via the contact form or by email), personal data is collected. The data collected when using a contact form can be seen in the respective form. This data is stored and used exclusively for the purpose of answering your enquiry or for contacting you and the associated technical administration. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry); if your enquiry is aimed at concluding a contract, Art. 6(1)(b) GDPR also applies. Your data will be deleted once your enquiry has been fully dealt with, unless statutory retention obligations prevent this.
6) Data processing when opening a customer account and for contract processing
In accordance with Art. 6(1)(b) GDPR, personal data is collected and processed if you provide it to us for the performance of a contract or when opening a customer account. The data collected can be seen in the respective input forms. You can delete your customer account at any time by sending a message to the controller at the address above. After the contract has been fully processed or your customer account has been deleted, your data will be blocked with regard to retention periods under tax and commercial law and deleted after these periods have expired, unless you have expressly consented to further use of your data or we have reserved the right to further use of data permitted by law.
7) Comment function
When you use the comment function on this website, in addition to your comment, information on the time the comment was created and the commenter name you chose will be stored and published. Your IP address is also logged for security reasons in case a comment violates the rights of third parties or unlawful content is published. We need your email address to contact you if a third party objects to your comment as unlawful. The legal bases are Art. 6(1)(b) and (f) GDPR. We reserve the right to delete comments if third parties object to them as unlawful.
8) Newsletter
8.1 Subscribing to our email newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information is your email address; any further information is voluntary and is used to address you personally. We use the so-called double opt-in procedure: you will only receive the newsletter after confirming your subscription via the link in our confirmation email. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. When you subscribe, we store your IP address and the date and time of subscription in order to be able to trace any misuse of your email address (Art. 6(1)(f) GDPR). You can unsubscribe from the newsletter at any time via the unsubscribe link in the newsletter or by sending us a message. After unsubscribing, your email address will be deleted from the mailing list without delay, unless you have consented to further use or further use is permitted by law.
8.2 Newsletter sending via Omnisend
Our newsletters are sent via the service provider Omnisend (Soundest Ltd., Unit a3, Gateway Tower, 32 Western Gateway, London E16 1YL, United Kingdom) as a processor (Art. 28 GDPR). An adequacy decision of the European Commission exists for the United Kingdom. The emails sent contain so-called tracking pixels which record whether a newsletter has been opened and which links have been clicked; technical information (e.g. time of retrieval, IP address, browser type, operating system) is also recorded. This analysis is based on your consent to receive the newsletter (Art. 6(1)(a) GDPR) and serves to improve our newsletters. If you wish to object to this analysis, you can unsubscribe from the newsletter. Further information: https://www.omnisend.com/privacy
9) Data processing for order processing
9.1 Insofar as necessary for contract processing for delivery and payment purposes, your personal data will be passed on to the commissioned transport company and the respective payment service provider in accordance with Art. 6(1)(b) GDPR.
9.2 JTL
Orders are processed via the merchandise management system of JTL-Software-GmbH, Rheinstr. 7, 41836 Hückelhoven, Germany, as a processor. Name, address and, where applicable, other order data are processed in accordance with Art. 6(1)(b) GDPR exclusively for the purpose of processing your order. Further information: https://www.jtl-software.de/Datenschutz
9.3 DHL
If the goods are delivered by DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany), we only pass on your email address to DHL to announce or arrange delivery if you have expressly consented to this during the ordering process (Art. 6(1)(a) GDPR). Otherwise, we only pass on your name and delivery address to DHL for the purpose of delivery (Art. 6(1)(b) GDPR). You can withdraw your consent at any time with effect for the future by notifying us or DHL.
9.4 Payment service providers
– Shopify Payments / Stripe
If you select a payment method offered via Shopify Payments (e.g. credit card, Apple Pay, Google Pay, Bancontact, BLIK, EPS, iDEAL | Wero, MobilePay), payment is processed via Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”). For this purpose, we pass on the information provided during the ordering process together with order information (name, address, payment data, invoice amount, currency, transaction number) to Stripe in accordance with Art. 6(1)(b) GDPR. Further information: https://stripe.com/privacy and https://www.shopify.com/legal/privacy
– Apple Pay
If you select “Apple Pay” from Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is made via the Apple Pay function of your device by charging a payment card stored there. The order and payment information is transmitted in encrypted form to Apple and the payment service provider (Art. 6(1)(b) GDPR). Further information: https://www.apple.com/legal/privacy/
– Google Pay
If you select “Google Pay” from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, payment is made via the Google Pay function of your device by charging a payment method stored there. The necessary order and payment information is transmitted to Google (Art. 6(1)(b) GDPR). According to Google, it also processes certain transaction data under its own responsibility. Further information: Google Payments Privacy Notice
– Shop Pay
If you use “Shop Pay”, your payment and delivery details are stored by Shopify if you choose this option in order to speed up future purchases. The processing is based on Art. 6(1)(b) GDPR. Further information: https://www.shopify.com/legal/privacy
– PayPal
If you pay via PayPal (including the payment methods offered via PayPal), we pass on your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”) (Art. 6(1)(b) GDPR). For certain payment methods (e.g. purchase on account, instalment payment, direct debit), PayPal reserves the right to carry out a credit check; for this purpose, your data may be transmitted to credit agencies on the basis of PayPal’s legitimate interest (Art. 6(1)(f) GDPR). The result may contain probability values (score values), the calculation of which includes, among other things, address data. You can object to this processing at any time by sending a message to PayPal. Further information: https://www.paypal.com/de/legalhub/privacy-full
– Klarna
If you select a payment method of the payment service provider Klarna (e.g. purchase on account, instalments or instant payment), payment is processed via Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (“Klarna”). For this purpose, we pass on the data you provided during the ordering process together with order information (e.g. name, address, email address, telephone number, date of birth where requested, order contents, invoice amount, currency) to Klarna in accordance with Art. 6(1)(b) GDPR. For payment methods in which we provide advance performance, Klarna carries out a credit check to verify your identity and creditworthiness; for this purpose, your data may be transmitted to credit agencies on the basis of Klarna’s legitimate interest (Art. 6(1)(f) GDPR). The result may contain probability values (score values), the calculation of which includes, among other things, address data. In this respect, Klarna processes the data under its own responsibility. You can object to this processing at any time by sending a message to Klarna; in that case, Klarna may no longer be able to offer you the selected payment method. Further information: https://www.klarna.com/de/datenschutz/
10) Electronic withdrawal function
If you declare a withdrawal via our withdrawal function (“Vertrag widerrufen” / Withdraw from contract), we process the data you enter (name, order number or information identifying the contract, email address and, where applicable, the items concerned and your message) in order to process your withdrawal and send you an acknowledgement of receipt. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code (BGB) and Art. 6(1)(b) GDPR. The function is provided via the Shopify app “EU Widerrufsbutton” of 401layers UG (haftungsbeschränkt), Dorothea-Erxleben-Str. 1a, 40721 Hilden, Germany, which supports us in receiving and documenting declarations of withdrawal and in sending the electronic acknowledgement of receipt, and which processes the data as a processor on our behalf (Art. 28 GDPR).
11) Customer reviews via Judge.me
11.1 Review reminder
We use your email address to remind you to submit a review of your order if you have given us your express consent to do so during or after your order in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by sending us a message or via the unsubscribe link in the email.
11.2 Use of Judge.me
To send review reminders and to collect and display customer reviews on our website, we use the Judge.me service of JUDGE.ME LTD, c/o Buckworths, 2nd Floor, 1-3 Worship Street, London EC2A 2AB, United Kingdom, as a processor (Art. 28 GDPR). For this purpose, we process in particular your name, email address, order details (e.g. items purchased, order date) and – if you submit a review – the content of your review, any photos uploaded and the display name you choose. Submitted reviews are published on our website under the name you choose.
Judge.me hosts the data on Amazon Web Services servers in the USA. An adequacy decision of the European Commission exists for the United Kingdom; for transfers to the USA and other third countries, Judge.me relies on the European Commission’s Standard Contractual Clauses. The legal basis for sending the reminder is your consent (Art. 6(1)(a) GDPR); the publication of your review is likewise based on your consent, which you give by submitting the review. You can request the deletion of your review from us at any time. Further information: https://judge.me/privacy
12) Social media and online marketing
12.1 Links to social networks
Buttons linking to our profiles on social networks (e.g. Instagram, Facebook, Pinterest, YouTube, TikTok, LinkedIn) are integrated on our website as simple links only. No connection to the servers of these networks is established when you visit our website. Only when you click on a button will you be redirected to the page of the respective provider, to which its privacy policy applies.
12.2 Meta Pixel (Facebook/Instagram) with advanced matching
Only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR) do we use the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). This enables us to define visitors to our website as a target group for adverts on Facebook and Instagram (“Custom Audiences”) and to measure the effectiveness of our adverts (“Conversions”). In advanced matching mode, customer data collected by us (e.g. email address) is additionally transmitted to Meta in encrypted (hashed) form in order to match it with Meta user accounts. Meta may link the data to your user account and also use it for its own purposes.
We and Meta are joint controllers for the collection and transmission of the data to Meta (Art. 26 GDPR); the essential content of the agreement can be found at https://www.facebook.com/legal/controller_addendum. Further processing is the sole responsibility of Meta. Data may be transferred to Meta Platforms, Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time with effect for the future via the cookie settings. Further information: https://www.facebook.com/privacy/policy/
13) Web analytics: Google Analytics 4
Only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR) do we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies and similar technologies that enable an analysis of your use of our website (e.g. pages visited, time spent, approximate location, device and browser information). Google Analytics 4 does not log or store IP addresses. Google processes this information on our behalf (Art. 28 GDPR) in order to evaluate the use of our website and compile reports.
Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, and the European Commission’s Standard Contractual Clauses apply in addition. The data is deleted after the retention period set in Google Analytics (maximum 14 months). You can withdraw your consent at any time with effect for the future via the cookie settings. Further information: https://policies.google.com/privacy?hl=en
14) Google reCAPTCHA
To protect our forms against misuse and spam, the reCAPTCHA function of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, may be used. Among other things, your IP address and other data required for the service are transmitted to Google; a transfer to Google LLC in the USA is possible (EU-US Data Privacy Framework). The processing is based on Art. 6(1)(f) GDPR on the basis of our legitimate interest in preventing automated misuse. Further information: https://policies.google.com/privacy?hl=en
15) Rights of the data subject
15.1 You have the following rights vis-à-vis the controller:
- right of access (Art. 15 GDPR)
- right to rectification (Art. 16 GDPR)
- right to erasure (Art. 17 GDPR)
- right to restriction of processing (Art. 18 GDPR)
- right to notification (Art. 19 GDPR)
- right to data portability (Art. 20 GDPR)
- right to withdraw consent given (Art. 7(3) GDPR)
- right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
15.2 RIGHT TO OBJECT
IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST AS PART OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION (ART. 21(1) GDPR). IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING FOR SUCH PURPOSES (ART. 21(2) GDPR). IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING FOR DIRECT MARKETING PURPOSES.
16) Duration of storage of personal data
The duration of storage is determined by the respective legal basis, the purpose of processing and – where applicable – the statutory retention periods (e.g. retention periods under commercial and tax law of up to ten years).
Where processing is based on consent (Art. 6(1)(a) GDPR), the data is stored until you withdraw your consent. Where processing is based on Art. 6(1)(b) GDPR, the data is deleted after the statutory retention periods have expired, provided it is no longer required for the performance or initiation of a contract. Where processing is based on Art. 6(1)(f) GDPR, the data is stored until you exercise your right to object under Art. 21 GDPR, unless there are compelling legitimate grounds for further processing. Otherwise, data is deleted as soon as it is no longer required for the purposes for which it was collected.