Privacy notice

The controller is All of Nature GmbH, Hannah-Arendt-Straße 9, 60438 Frankfurt am Main, Germany. Contact: [email protected]; telephone: +353899800779. This notice covers the NaturaFlame shop, enquiries, orders, payment handling and withdrawal declarations.

Data and where it comes from

You provide names, email address, telephone number, billing and delivery address, company/VAT details where relevant, ordered goods, messages and withdrawal declarations. We also receive payment information from bank records and authorised payment confirmation. Website requests provide technical data such as IP address, browser, requested URL and time. With statistics consent, we record pseudonymous visit/session identifiers, source category, country, currency and product/cart/checkout events.

Orders, payment, delivery and enquiries

We use required contact, order and address details to take steps at your request before a contract and to perform it, including payment allocation, transport, service, withdrawal and refunds (Article 6(1)(b) GDPR). Enquiries unrelated to a contract are processed in our legitimate interest in answering business enquiries (Article 6(1)(f)). Invoice, accounting and legally required records are retained to comply with legal obligations (Article 6(1)(c)).

Security and necessary browser storage

Our legitimate interests are reliable operation, fraud prevention, protection of the shop and evidence for legal claims (Article 6(1)(f)). Necessary browser storage supports the cart, language/country selection, request security and prevention of duplicate orders; it is not an advertising consent. The language cookie lasts up to one year; the request-security cookie up to 12 hours. The cart is kept in browser local storage until it is cleared after an order or removed by you. Order-attempt information is stored for the browser session.

Optional statistics and Google

Optional shop statistics require consent (Article 6(1)(a) GDPR). The statistics visitor cookie lasts up to 30 days, the session cookie 30 minutes of inactivity, and the consent choice up to 180 days. The Google tags are currently disabled. If enabled later, Google Analytics statistics and advertising measurement/personalisation will require their respective choices in cookie settings. A purchase and acceptance of terms do not constitute advertising consent.

Recipients and service providers

Authorised shop staff receive the data needed for their duties. Necessary information may be provided to the hosting provider, the bank, contracted carriers, professional advisers and public authorities where required. Cloudflare provides website security/proxying and receives incoming email through Email Routing and an Email Worker; its webhook passes the message to the shop. Brevo sends order, service and withdrawal-confirmation emails through SMTP. Incoming email content and necessary attachment metadata are stored in the customer-service system. No customer account is required for a withdrawal declaration.

International processing and safeguards

Cloudflare operates an international network, so data may be processed outside the European Economic Area, including in the United States. Its published Data Processing Addendum describes the EU–US Data Privacy Framework and Standard Contractual Clauses for relevant transfers: https://www.cloudflare.com/cloudflare-customer-dpa/. Provider/subprocessor involvement can also entail international processing for email services. You can request information and a copy of the safeguards applicable to your data from [email protected]. The current provider details are available at https://www.brevo.com/legal/privacypolicy/.

How long data is kept

Order, payment, invoice, contract-condition snapshots and service records are retained while needed to perform the contract, comply with applicable accounting/tax retention duties or establish, exercise or defend legal claims. Enquiries and withdrawal records are assessed against their purpose and any linked contract or dispute; there is no blanket automatic deletion of orders after a fixed number of days. During routine shop-statistics cleanup, records of sessions inactive for more than 90 days and visitor records older than 90 days are removed. Successfully accepted outbound messages have their queued message body cleared; delivery metadata and service correspondence remain subject to the above criteria. Backups are restricted to recovery and authorised access; deletion from live data does not instantly erase existing recovery copies.

Your rights and choices

Subject to the legal conditions, you may request access, correction, erasure, restriction and portability of your data. You may object to processing based on legitimate interests and withdraw consent at any time through cookie settings or by contacting us, without affecting the lawfulness of prior processing. You may complain to a supervisory authority, in particular in your usual residence, place of work or place of an alleged infringement; the authority for our German registered office is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (https://datenschutz.hessen.de/). We do not make decisions with legal or similarly significant effects solely by automated processing.

Required information

Contact, delivery and payment details are needed to process an order or fulfil the contract. Without required details we cannot complete the requested transaction. Marketing/statistics consent is optional and refusing it does not prevent purchase. Please do not send passwords or payment-card details in messages.