Privacy policy

Privacy Policy / Personal Data Protection Policy

Data Controller:
Ümit Erbakti
Heinrich-Hertz-Str. 48, 40699 Erkrath / Germany
E-mail: info@wenatur.com
Phone: +49 211 828 313 69

We are pleased about your interest in our online shop. Protecting your privacy is very important to us. Below you will find detailed information on how we handle your data.

1. Access Data and Hosting

You can visit our website without providing any personal information. Every time a website is accessed, the web server automatically saves a server log file. This file contains, for example, the name of the requested file, your IP address, date and time of access, amount of data transferred, and the requesting provider (access data), and documents the access. This access data is evaluated exclusively for the purpose of ensuring smooth operation of the site and improving our services. Pursuant to Art. 6(1)(f) GDPR, this serves to safeguard our legitimate interests in the correct presentation of our offering. All access data is erased no later than seven days after the end of your visit.

1.1 Hosting

The hosting and website rendering services are partially provided by external service providers acting on our behalf.

Our online shop is operated on the Shopify platform. Shopify processes personal data on our behalf to display the website, store data, fulfill orders, and maintain shop security.

Unless stated otherwise in this policy, access data and form data collected on our website are processed on our systems or those of our appointed service providers.

Our service providers process personal data strictly according to our instructions and based on data processing agreements pursuant to Art. 28 GDPR.

Shopify may act as a data processor for certain services. For services like Shop Pay or Shop, Shopify acts as an independent data controller for those transactions.

For questions regarding our service providers and data processing, please contact us using the details provided in this policy.

1.2 Content Delivery Network (CDN)

To reduce loading times, we use a Content Delivery Network ("CDN") for certain services. This service delivers large media files via distributed servers of external CDN providers. Therefore, access data is processed on these providers' servers. Our service providers operate under a processing agreement. If you have questions about our service providers, please contact us.

Under CDN usage, images, videos, fonts, scripts, and other media may be transmitted via geographically close servers to the user.

The following data may be processed during this operation:

  • IP address,
  • date and time of access,
  • visited page or file,
  • browser and device information,
  • technical connection and error data.

The legal basis for CDN usage is Art. 6(1)(f) GDPR based on our legitimate interest in delivering a fast, secure, and uninterrupted website.

Shopify and its affiliated companies or sub-processors may process personal data in the EEA, UK, Switzerland, Canada, USA, or other countries.

Where data is transferred outside the EEA to countries without an adequacy decision, processing takes place pursuant to Art. 44 et seq. GDPR using appropriate safeguards such as Standard Contractual Clauses (SCCs).

2. Data Processing for Contract Fulfillment, Contact, and Customer Account Creation

We collect personal data when you voluntarily provide it during order placement or when contacting us (e.g., via contact form or email). Mandatory fields are marked as such because we require this data to fulfill the contract or process your inquiry. The scope of collected data is evident from the input forms. We use your data pursuant to Art. 6(1)(b) GDPR for contract processing and inquiry handling.

If you give consent pursuant to Art. 6(1)(a) GDPR by opting to create a customer account, we process your data to manage your account. Upon full contract execution or account deletion, your data will be restricted from further processing and deleted after statutory tax and commercial retention periods expire (Art. 6(1)(c) GDPR), unless you explicitly consent to further use. Account deletion is possible at any time via message or built-in account features.

Shopify Infrastructure

Our shop utilizes the e-commerce infrastructure of Shopify Inc. Shopify processes data to fulfill orders, ensure security, and optimize performance. Further details are available at: https://privacy.shopify.com

3. Data Processing for Order Fulfillment and Shipping

For contract fulfillment pursuant to Art. 6(1)(b) GDPR, we transfer your data to the shipping provider responsible for delivery to the extent necessary to deliver your goods.

The technical infrastructure is provided by Shopify. Required data may be shared with Shopify for order completion, payment, and support. For third-country transfers, Shopify implements Standard Contractual Clauses (SCCs).

3.1 Transfer of Shipping Information to Delivery Providers

If you gave explicit consent during or after your order (Art. 6(1)(a) GDPR), we pass your email address and phone number to the selected carrier so they can contact you prior to delivery for coordination or delivery announcements.

This consent can be revoked at any time by contacting us or the shipping carrier directly. Upon revocation, data will be deleted unless other legal bases apply.

  • United Parcel Service Deutschland S.à r.l. & Co. OHG: Görlitzer Straße 1, 41460 Neuss, Germany
  • General Logistics Systems Germany GmbH & Co. OHG: GLS Germany-Straße 1–7, DE-36286 Neuenstein, Germany
  • DHL Paket GmbH: Sträßchensweg 10, 53113 Bonn, Germany
  • Hermes Germany GmbH: Essener Straße 89, D-22419 Hamburg, Germany
  • DPD Deutschland GmbH: Wailandtstraße 1, 63741 Aschaffenburg, Germany

4. Data Processing for Payment Transactions

We work with technical service providers, banking institutions, and payment providers to process online payments.

4.1 Transaction Execution (Shopify Payments & Credit Cards)

Depending on the selected payment method (Shop Pay, Visa, Mastercard, American Express, Maestro, UnionPay), necessary transaction data is transferred via Shopify Payments to commissioned banks and technical providers (Art. 6(1)(b) GDPR). Payment providers may collect certain data directly via their integrated systems, governed by their respective privacy policies.

4.2 PayPal Payment Services

When selecting PayPal, your payment details are transferred to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg pursuant to Art. 6(1)(b) GDPR. PayPal may perform identity and credit checks under its own responsibility. Details: PayPal Privacy Statement.

4.3 Klarna Payment Services

Selecting Klarna options (Pay Now, Pay Later / Invoice, Slice It) transfers payment and address data to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (Art. 6(1)(a) and (b) GDPR). In Germany, Klarna may consult credit agencies. Details: Klarna Privacy Notice.

4.4 Express Wallets (Apple Pay / Google Pay)

When paying via Apple Pay or Google Pay, encrypted details are transmitted to Apple Distribution International Ltd. or Google Ireland Ltd. pursuant to Art. 6(1)(b) GDPR.

4.5 Local Payment Methods (Bancontact, EPS, iDEAL / Wero, MobilePay)

For local payment options (Bancontact, EPS, iDEAL / Wero, MobilePay), transaction details are securely transmitted via Shopify Payments to the relevant banking networks (Art. 6(1)(b) GDPR).

4.6 Fraud Prevention and Payment Process Optimization

Where necessary, additional transaction data may be provided to service providers to prevent fraud, ensure security, and process chargebacks based on our legitimate interests (Art. 6(1)(f) GDPR).

4.7 Credit Assessment

If required and consented to pursuant to Art. 6(1)(a) and Art. 22(2)(c) GDPR, data may be transmitted to credit reporting agencies for identity and solvency checks:

  • Creditreform Boniversum GmbH: Hellersbergstraße 11, 41460 Neuss, Germany
  • Arvato Infoscore GmbH: Rheinstraße 99, 76532 Baden-Baden, Germany
  • SCHUFA Holding AG: Kormoranweg 5, 65201 Wiesbaden, Germany

You can revoke your consent at any time with future effect, which may restrict access to certain payment methods.

5. Email Marketing and Newsletter

5.1 Registered Email Newsletter

When subscribing to our newsletter, we use required or separately provided data to send regular email newsletters based on your consent pursuant to Art. 6(1)(a) GDPR. You can unsubscribe at any time via the unsubscription link in the newsletter or by contacting us.

5.2 Newsletter Dispatch

Newsletters may be dispatched via service providers acting on our behalf. Transfers to non-EEA countries (e.g., Canada or USA) rely on EU Standard Contractual Clauses.

6. Cookies and Other Technologies

We use cookies and similar technologies to enhance browsing and provide essential features (e.g., shopping cart). Essential cookies operate pursuant to Art. 6(1)(f) GDPR and TDDDG § 25(2).

Browser Cookie Settings:
Microsoft Edge / Safari / Chrome / Firefox / Opera

6.1 Web Analytics and Advertising Cookies

If you give consent pursuant to Art. 6(1)(a) GDPR and TDDDG § 25(1), we use third-party analytics and marketing cookies. Consent can be revoked anytime via cookie settings.

7. Use of Google Services

We use services provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Data may be transmitted to Google LLC servers in the USA. IP anonymization is enabled. Details: https://policies.google.com/privacy

7.1 Google Analytics

Automatically collects access data to create pseudonymous usage profiles for website analysis (Art. 6(1)(a) GDPR).

7.2 Google Maps

Google Maps processes IP and location data to display interactive maps.

7.3 Google reCAPTCHA

Analyzes user behavior via JavaScript and cookies to protect against automated bot submission and spam.

7.4 Google Fonts

Transmits browser and IP data to Google servers to render fonts uniformly.

7.5 Google Ads & Enhanced Conversions

Uses hashed user details (e.g., email address) transmitted to Google to measure conversion accuracy (Art. 6(1)(a) GDPR).

8. YouTube Video Plugin

Embedded YouTube videos use enhanced privacy mode, transmitting data to Google only when playback is initiated.

9. Use of Facebook Services

9.1 Facebook Analytics & Pixel

Processes user activity data via Meta Pixel to optimize website performance (Art. 6(1)(a) GDPR).

9.2 Facebook Ads

We run ad campaigns where data collection and transfer are governed under joint responsibility with Meta Platforms Ireland Limited pursuant to Art. 26 GDPR.

10. Additional Services (Pinterest Tag)

Subject to consent, Pinterest Tag (Pinterest Europe Ltd., Ireland) is used for audience measurement and interest-based advertising, with potential data transfer to Pinterest Inc. (USA).

11. Adobe Fonts

Transmits technical device and IP data to Adobe Inc. (USA) for uniform font rendering.

12. Vimeo Video Plugin

Integrates video content via Vimeo LLC (USA) player, which may automatically include Google Analytics modules.

13. Social Media

13.1 Social Media Plugins

Social buttons are integrated as static HTML links. A connection to the platform provider is established only when you click the button.

13.2 Our Social Media Presence

We maintain brand pages on social networks. Platforms process user data under independent or joint controllership (Art. 26 GDPR):

  • Facebook & Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
  • X (Twitter): X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland
  • YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  • Pinterest: Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland

14. Privacy Notice for Giveaways and Competitions

  • Data Controller: Personal data is processed by WeNatur GmbH pursuant to GDPR.
  • Processed Data: Instagram username upon entry; winner's name, shipping address, and phone number for prize delivery.
  • Purpose and Legal Basis: Administering giveaways and delivering prizes pursuant to Art. 6(1)(b) GDPR. No marketing use without explicit consent.
  • Retention Period: All collected giveaway data is permanently deleted once the prize delivery is complete.
  • Data Subject Rights: Participants maintain rights to access, rectify, erase, and restrict processing of their data.

15. Data Subject Rights and Contact Options

As a data subject, you hold the following rights:

  • Right of access under Art. 15 GDPR;
  • Right to rectification under Art. 16 GDPR;
  • Right to erasure under Art. 17 GDPR;
  • Right to restriction of processing under Art. 18 GDPR;
  • Right to data portability under Art. 20 GDPR;
  • Right to lodge a complaint with a supervisory authority under Art. 77 GDPR.

For questions concerning data collection, processing, or exercising rights, please contact us directly. You may also exercise rights regarding Shopify via their Privacy Portal.

16. Right to Object

To the extent that we process personal data to safeguard our legitimate interests based on a balancing of interests, you may object to this processing at any time with effect for the future for reasons arising from your particular situation.

If processing is carried out for direct marketing purposes, you may object at any time without providing reasons. Upon objection, we will no longer process your personal data for these purposes.

This privacy policy was created based on Trusted Shops legal texts in cooperation with FÖHLISCH Rechtsanwälte.