Privacy Policy

Unless specified otherwise below, the provision of your personal data is neither required by law or contract, nor necessary for entering into a contract. You are not obliged to provide the data. Failure to provide it has no consequences. This applies only insofar as no other information is given for the following processing operations. "Personal data" means any information relating to an identified or identifiable natural person.

Server Log Files

You can visit our websites without providing any personal information.

Every time you access our website, usage data is transmitted to us or our web host / IT service provider by your internet browser and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred, and the requesting provider.

Processing is carried out on the basis of Art. 6 (1) (f) GDPR based on our overriding legitimate interest in ensuring the smooth operation of our website and improving our service.

Contact

Controller / Data Protection Officer

Feel free to contact us. The controller responsible for data processing is: Andreas Kesseler, Herrenwiesenring 19, 53501 Grafschaft – Nierendorf, Germany, +49 (0)2641/890 22 22, info@nutri-plus.de

You can contact our Data Protection Officer directly at: kueper@nutri-plus.de

Customer Initiated Contact by E-Mail

If you contact us proactively by e-mail, we only collect your personal data (name, e-mail address, message text) to the extent provided by you. The data processing serves the purpose of processing and answering your contact request.

If contacting us serves the execution of pre-contractual measures (e.g., consultation in case of purchase interest, creation of an offer) or concerns a contract already concluded between you and us, this data processing takes place on the basis of Art. 6 (1) (b) GDPR.

If contact is initiated for other reasons, this data processing takes place on the basis of Art. 6 (1) (f) GDPR based on our overriding legitimate interest in processing and answering your request. In this case, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6 (1) (f) GDPR.

We only use your e-mail address to process your request. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and Processing when Using the Contact Form

When using the contact form, we collect your personal data (name, e-mail address, message text) only to the extent provided by you. The data processing serves the purpose of establishing contact.

Collection and Processing when Using the Revocation Button

If you have concluded a contract via our online presence, we provide you with a revocation function (revocation button) through which you can directly submit your declaration of revocation.

When using the revocation function, we collect your personal data (name, e-mail address, information identifying the contract or part of the contract you wish to revoke, as well as the date and time of sending the revocation declaration) only to the extent provided by you. The data processing serves the purpose of providing you with the legally required possibility to revoke your contract and properly processing your revocation.

If the contact concerns a contract already concluded between you and us, this data processing takes place on the basis of Art. 6 (1) (b) GDPR. Otherwise, data processing takes place on the basis of Art. 6 (1) (c) GDPR to fulfill a legal obligation to provide a revocation function on our online presence.

We only use your e-mail address to process your revocation declaration. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

The processing of your personal data serves the purpose of legally complying with requirements for designing the revocation function and is based on Art. 6 (1) (c) GDPR. This data processing also takes place on the basis of Art. 6 (1) (f) GDPR based on our overriding legitimate interest in providing you with a user-friendly revocation option. In this case, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6 (1) (f) GDPR.

WhatsApp Business

If you contact us via WhatsApp, we use the WhatsApp Business version of WhatsApp Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; "WhatsApp"). If you are located outside the European Economic Area, this service is provided by WhatsApp Inc. (1601 Willow Road, Menlo Park, CA 94025, USA).

Data processing serves the purpose of processing and responding to your contact request. For this purpose, we collect and process your mobile phone number stored with WhatsApp, your name if provided, and other data to the extent provided by you. We use a mobile end device for this service whose address book only contains data of users who have contacted us via WhatsApp. No transfer of personal data to WhatsApp takes place without your prior consent given to WhatsApp.

Your data is transferred by WhatsApp to servers of Meta Platforms Inc. in the USA. An adequacy decision by the EU Commission is in place for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Meta Platforms Inc. has certified under the TADPF and thereby committed to complying with European data protection principles. If contacting us serves to carry out pre-contractual measures (e.g., advice on purchase interest, quotation) or concerns a contract already concluded between you and us, this data processing takes place on the basis of Art. 6 (1) (b) GDPR.

If contact is initiated for other reasons, this data processing takes place on the basis of Art. 6 (1) (f) GDPR out of our overriding legitimate interest in providing quick and easy contact and answering your request. In this case, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6 (1) (f) GDPR.

We only use your personal data to process your request. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Further information on terms of use and data privacy when using WhatsApp can be found at https://www.whatsapp.com/legal/#terms-of-service and https://www.whatsapp.com/legal/#privacy-policy.

Customer Account / Orders

Customer Account

When opening a customer account, we collect your personal data to the extent specified there. Data processing serves the purpose of improving your shopping experience and simplifying order processing. Processing takes place on the basis of Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time by notifying us, without affecting the lawfulness of processing based on consent before its withdrawal. Your customer account will then be deleted.

Collection, Processing, and Disclosure of Personal Data in Orders

When placing an order, we collect and process your personal data only as far as necessary to fulfill and process your order and to process your requests. The provision of data is necessary for concluding the contract. Failure to provide it means no contract can be concluded. Processing is based on Art. 6 (1) (b) GDPR and is required to perform a contract with you.

Your data may be passed on, for example, to shipping companies, dropshipping or fulfillment providers, payment service providers, order processing service providers, and IT service providers. In all cases, we strictly adhere to legal regulations. The scope of data transmission is restricted to a minimum.

Reviews / Advertising

Trustami Customer Reviews

The Trustami trust seal is embedded on this website to display collected reviews and social media feedback. This serves to implement our legitimate interests in optimal marketing of our offer on our own website pursuant to Art. 6 (1) sentence 1 (f) GDPR. When calling up the Trustami trust seal, the web server automatically saves log data (access data) in the form of a server log file containing the name of the retrieved website, file, date and time of retrieval, your IP address in shortened form, amount of data transferred, notification of successful retrieval, browser type, user operating system, referrer URL, and requesting provider. These access data are not evaluated and are automatically overwritten at the latest seven days after the end of your visit. The Trustami trust seal and advertised services are offered by Trustami GmbH, Schröderstraße 5, 10115 Berlin. The Trustami privacy policy applies to data collected by Trustami at www.trustami.com/datenschutz.

Use of E-Mail Address for Sending Newsletters

We use your e-mail address to send information and offers via newsletter, provided you have expressly agreed to this. The data processing serves exclusively the purpose of promotional communication. For this purpose, we process your e-mail address and any additional data voluntarily provided during newsletter registration.

Processing is based on Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

You can unsubscribe from the newsletter at any time using the corresponding link in the newsletter or by notifying us. Your e-mail address will then be removed from the distribution list. Despite removal, we may store your e-mail address in a blacklist to prevent future newsletter deliveries. This storage is based on Art. 6 (1) (f) GDPR out of our and your legitimate interest in preventing renewed usage of your e-mail address for sending our newsletter. You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.

Use of Brevo

We use the service of Brevo GmbH (Köpenicker Straße 126, 10179 Berlin; "Brevo") for newsletter delivery within the framework of data processing on behalf.

We forward the information provided during newsletter registration (e-mail address, first/last name if applicable) to Brevo. Data processing serves the purpose of sending newsletters and their statistical evaluation.

To evaluate newsletter campaigns, sent e-mail newsletters contain a 1x1 pixel graphic (tracking pixel) and/or a tracking link. This allows us to determine whether you opened the newsletter and clicked integrated links. In this context, personal data such as IP address, browser type/device, and time of opening may be collected. Pseudonymized user profiles can be created from this data. The collected data will not be used to identify you personally and serves solely statistical evaluation to improve newsletter campaigns.

The processing of your personal data is based on Art. 6 (1) (f) GDPR out of our overriding legitimate interest in a targeted, effective, and user-friendly newsletter system. You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.

Further information and Brevo's privacy policy can be found at: https://www.brevo.com/de/legal/privacypolicy/.

Use of Klaviyo

We use the service of Klaviyo Inc. (125 Summer St Floor 7, Boston, MA 02111, USA; "Klaviyo") for sending newsletters under a processor agreement.

We pass on the information provided during newsletter registration (e-mail address, first and last name if applicable) to Klaviyo. Data processing serves the purpose of newsletter distribution and statistical evaluation.

To evaluate newsletter campaigns, sent newsletters contain a 1x1 pixel graphic (tracking pixel) or tracking link to determine open rates and link clicks. In this context, we collect personal data such as IP address, browser type/device, and timestamp to create pseudonymous usage profiles. The collected data is used exclusively for statistical evaluation to improve newsletter campaigns.

Your data is generally transmitted to and stored on Klaviyo servers in the USA. An adequacy decision by the EU Commission exists for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). Klaviyo is certified under the TADPF and committed to European data protection standards.

Further information on data privacy at Klaviyo can be found at https://www.klaviyo.com/legal/privacy-notice and https://www.klaviyo.com/legal/data-processing-agreement.

Use of E-Mail Address for Stock Availability Notifications

We offer a product availability notification service on our website. If an item is temporarily out of stock, you can enter your e-mail address for that item to be notified once by e-mail when it becomes available, provided you have consented. Processing is based on Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time by notifying us. Your e-mail address will then be removed from the list.

ERP System

Use of an External ERP System

We use an Enterprise Resource Planning (ERP) system for contract processing on a processor basis. For this purpose, personal data collected during your order is transferred to:

Pickware GmbH, Goebelstr. 21, 64293 Darmstadt, Germany

JTL-Software-GmbH, Rheinstr. 7, 41836 Hückelhoven, Germany

The processing of your personal data serves to fulfill the contract concluded with you and is based on Art. 6 (1) (b) GDPR.

Payment Service Providers

Use of PayPal Checkout

We use the payment service PayPal Checkout provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. Data processing serves the purpose of offering payment via the payment service. Selecting and using options like PayPal, Credit Card via PayPal, Direct Debit via PayPal, or "Pay Later" via PayPal transmits data required for payment processing to PayPal to fulfill the contract with your chosen payment method based on Art. 6 (1) (b) GDPR.

Cookies enabling browser recognition may be stored. The resulting processing is based on Art. 6 (1) (f) GDPR out of our overriding legitimate interest in a customer-oriented offering of diverse payment methods. You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.

Credit Card via PayPal, Direct Debit via PayPal & "Pay Later" via PayPal

For specific payment methods like Credit Card, Direct Debit, or "Pay Later" via PayPal, PayPal reserves the right to obtain a credit report based on mathematical-statistical procedures through credit agencies. For this, PayPal transmits required personal data to a credit agency and uses the received statistical probability information regarding payment default to make a balanced decision on establishing, performing, or terminating the contractual relationship. The credit report may contain score values calculated on recognized mathematical-statistical methods incorporating address data. Your legitimate interests are respected according to statutory provisions based on Art. 6 (1) (f) GDPR out of PayPal's overriding legitimate interest in protecting against default when providing advance performance.

You have the right to object at any time, on grounds relating to your particular situation, to this processing by notifying PayPal. Providing data is necessary for contract conclusion with the requested payment method.

Third-Party Providers

When paying via a third-party payment method, data required for payment processing is initially transmitted to PayPal based on Art. 6 (1) (b) GDPR and subsequently forwarded to the respective provider. Local third-party providers may include:

Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)

Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)

Purchase on Account via PayPal

When paying via purchase on account, required data is transmitted to PayPal and then passed to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin, Germany; "Ratepay") to fulfill the contract based on Art. 6 (1) (b) GDPR. Ratepay may perform a credit check using credit agencies based on Art. 6 (1) (f) GDPR out of legitimate interest in protection against payment default. Further privacy information and credit agencies used by Ratepay are available at https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/.

For more details on PayPal's data processing, see their privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Use of Amazon Payments

We use Amazon Payments by Amazon Payments Europe s.c.a. (38 avenue John F. Kennedy, L-1855 Luxembourg; "Amazon Payments").

Data processing serves the purpose of offering payment via Amazon Payments.

Integrating this service requires Amazon Payments to collect, store, and analyze data (e.g., IP address, device type, operating system, browser type, location) upon page load. Cookies enabling browser recognition may be used.

Processing is based on Art. 6 (1) (f) GDPR out of our overriding legitimate interest in offering varied payment options. You have the right to object at any time, on grounds relating to your particular situation, to this processing.

Selecting "Amazon Payments" transfers necessary payment data to Amazon Payments based on Art. 6 (1) (b) GDPR to execute the contract.

More details on Amazon Payments data processing: https://pay.amazon.com/de/help/201212490

Use of Payment Service Provider Mollie

We use payment service provider Mollie B.V. (Keizersgracht 313, 1016 EE Amsterdam, Netherlands; "Mollie"). Data processing serves the purpose of offering multiple payment methods. Selecting a Mollie option transfers required data (payment details, IP address, browser/device type, name, address, purchased products) to Mollie based on Art. 6 (1) (b) GDPR. More information: https://www.mollie.com/de/legal/privacy

Cookies

Our website uses cookies. Cookies are small text files stored in or by your internet browser on your computer system. They contain a characteristic string enabling unique identification of the browser upon returning to the site.

Cookies are stored on your computer, giving you full control over their use. Browser settings allow you to be notified before cookies are set, decide individually, or block/delete existing cookies. Disabling cookies may limit website functionality.

Manage/disable cookies for key browsers via these links:

Chrome: https://support.google.com/accounts/answer/61416?hl=de

Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09

Mozilla Firefox: https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop

Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Technically Necessary Cookies

Unless stated otherwise, we only use technically necessary cookies to make our website user-friendly, effective, and secure, and to enable browser recognition across page changes. The use of cookies or similar technologies is based on Section 25 (2) TDDDG. Processing of personal data is based on Art. 6 (1) (f) GDPR out of our legitimate interest in optimal functionality and user-friendly site design.

You have the right to object at any time, on grounds relating to your particular situation, to this processing.

Use of CCM19 Cookie Consent Manager

We use the CCM19 Cookie Consent Manager by Papoo Software & Media GmbH (Auguststr. 4, 53229 Bonn, Germany; "CCM19").

This plugin allows you to grant consent for website data processing (especially cookies) and exercise your right of withdrawal. Data processing serves to obtain and document required consent to fulfill legal obligations.

Cookies store randomly generated IDs, consent status, and timestamp. Data is saved for 1 year and 1 month. No transfer to third parties occurs. Processing is based on legal obligation under Art. 6 (1) (c) GDPR.

More information: https://www.ccm19.de/datenschutzerklaerung.html.

Analytics / Ad Tracking / Affiliate

Use of Google Analytics 4

We use Google Analytics 4 provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google").

Data processing serves website and visitor analysis as well as marketing purposes. Google uses this information to evaluate site usage, compile activity reports, and provide related services.

Collected information includes IP address, date/time of page call, click path, browser/device info, visited pages, referrer URL, location data, and purchase activity. Google may link this to other data like search history or Google accounts.

IP addresses are shortened within EU/EEA member states prior to transmission.

Google uses cookies, web storage, and pixels. Technology usage is based on consent pursuant to Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR. Processing of personal data is based on consent under Art. 6 (1) (a) GDPR, which can be revoked at any time.

We also use Google Signals for cross-device tracking if "personalized ads" are enabled in your Google account. This compiles aggregated cross-device statistics. Disable personalized ads in Google account settings to prevent cross-device tracking: https://support.google.com/ads/answer/2662922?hl=de.

We use Advanced Consent Mode, sending unconsented user data to Google as "pings" (containing country-derived IP, timestamp, URL, user agent, referrer URL, event triggers) for data modeling.

Data is generally transferred to Google servers in the USA under the Trans-Atlantic Data Privacy Framework (TADPF). Google is TADPF certified.

Further details: https://policies.google.com/technologies/partner-sites, https://policies.google.com/privacy?hl=en, and https://business.safety.google/privacy/.

Use of Matomo

We use the Matomo analytics tool by InnoCraft Ltd. (150 Willis St, 6011 Wellington, New Zealand; "Matomo").

Data processing serves website and visitor analysis. Collected data includes anonymized IP, browser/device info, clicked/downloaded files, external links clicked, referrer URL, site URL, visit frequency/timestamps, timezone, and location. Pseudonymous profiles are generated without personal identification.

Data is transferred to a third country outside the EU with an adequacy decision in place. Cookies enable browser recognition.

Processing is based on Art. 6 (1) (f) GDPR out of our legitimate interest in tailored site design. You have the right to object to this processing at any time on grounds relating to your particular situation.

More privacy information: https://matomo.org/matomo-cloud-privacy-policy/ and https://matomo.org/gdpr-analytics/.

Use of Meta Pixel

We use the Meta Pixel provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; "Meta").

Meta and we are joint controllers for data collection and transmission via the service under a joint controller agreement (https://www.facebook.com/legal/terms/businesstools). We are responsible for Art. 13, 14 GDPR information obligations and technical security under Art. 32 GDPR. Meta is responsible for data subject rights (Art. 15–20 GDPR) and service security.

The pixel serves to target visitors with interest-based ads on Facebook and Instagram and build conversion statistics. No personally identifiable information is received by us.

Data may be transmitted to the USA under the Trans-Atlantic Data Privacy Framework (TADPF), for which Meta is certified.

Processing is based on your consent under Art. 6 (1) (a) GDPR, which can be withdrawn at any time. Privacy details: https://www.facebook.com/about/privacy/.

Use of Google Ads Conversion Tracking

We use Google Ads Conversion Tracking by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google").

Clicking a Google ad sets a conversion tracking cookie with limited validity that does not personally identify users. It compiles conversion statistics showing total user actions after clicking ads. We use Advanced Consent Mode pings for unconsented user data modeling.

Data may be transferred to Google LLC in the USA under TADPF certification.

Cookies and processing are based on consent under Section 25 (1) TDDDG / Art. 6 (1) (a) GDPR, which can be withdrawn at any time.

More information: https://www.google.com/policies/privacy/ or https://business.safety.google/privacy/

Use of Google AdSense

We use Google AdSense by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") to rent ad space and display personalized ads. Cookies analyze site usage and data is stored on US servers under TADPF certification.

Cookies and data processing are based on consent under Section 25 (1) TDDDG / Art. 6 (1) (a) GDPR (withdrawable at any time).

Privacy policies: https://www.google.com/policies/technologies/ads/, https://www.google.com/policies/privacy/, and https://business.safety.google/privacy/

Use of Google Remarketing or "Similar Audiences"

We use Google's Remarketing function (Google Ireland Limited) to analyze visitor behavior and show interest-based ads across the Google Display Network using cookies without storing personal data.

Data transmission to US servers occurs under TADPF certification.

Cookies and processing rely on consent under Section 25 (1) TDDDG / Art. 6 (1) (a) GDPR (withdrawable at any time).

More details: https://www.google.com/privacy/ads/ and https://business.safety.google/privacy/

Use of Microsoft Advertising

We use Microsoft Advertising by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052-6399, USA; "Microsoft") for conversion tracking and ad effectiveness measurement. Cookies and web beacons collect IP address, Microsoft IDs, browser/device data, and URLs without personally identifying users.

Data transmission to the USA occurs under TADPF certification.

Cookies and data processing rely on consent under Section 25 (1) TDDDG / Art. 6 (1) (a) GDPR (withdrawable at any time).

Privacy statement: https://privacy.microsoft.com/en-us/privacystatement.

Use of Awin Affiliate Program

We use the "Awin" partner program by AWIN AG (Eichhornstraße 3, 10785 Berlin, Germany; "Awin").

Clicking affiliate links sets cookies and uses fingerprinting to track order origins and bill partner services accurately. Transaction data and pseudonymous user IDs are recorded without revealing identities.

Data transfers to third countries (e.g., USA) rely on EU Standard Contractual Clauses: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.

Cookie use and processing rely on consent under Section 25 (1) TDDDG / Art. 6 (1) (a) GDPR (withdrawable at any time).

Awin Privacy Policy: https://www.awin.com/gb/privacy.

Plugins and Miscellaneous

Use of Google Tag Manager

We use Google Tag Manager by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google").

This tool manages JavaScript and HTML tags used to implement tracking/analytics tools for site optimization. Tag Manager itself stores no cookies and processes no personal data, but triggers other tags that may collect data.

Rights of the Data Subject and Storage Period

Storage Duration

After complete contract execution, data is stored for the duration of warranty periods, then according to statutory, commercial, and tax retention periods, and deleted thereafter unless consent for further use was granted.

Rights of the Data Subject

Under statutory requirements, you have the following rights according to Art. 15 to 20 GDPR: Right of access, rectification, erasure, restriction of processing, and data portability.

Furthermore, under Art. 21 (1) GDPR, you have the right to object to processing based on Art. 6 (1) (f) GDPR and processing for direct marketing purposes.

Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe your personal data is processed unlawfully.

You can contact our competent supervisory authority using the following details:

State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate
P.O. Box 30 40
55020 Mainz, Germany
Tel.: +49 6131 89200
Fax: +49 6131 8920299
E-Mail: poststelle@datenschutz.rlp.de

Right to Object

If the personal data processing listed here is based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR, you have the right to object to this processing for the future at any time on grounds relating to your particular situation.

Upon objection, processing of the affected data will be terminated unless we can demonstrate compelling legitimate grounds for processing overriding your interests, rights, and freedoms, or if processing serves the establishment, exercise, or defense of legal claims.