Datenschutzrichtlinie

§ 1 General Information

This privacy policy provides detailed information about what happens to your personal data when you visit our website naturkern.store. Any data that allows for your personal identification is considered personal data. We strictly adhere to legal requirements when processing your data, in particular the General Data Protection Regulation (“GDPR”). Ensuring your visit to our website is completely secure is very important to us.

§ 2 Responsible Body

The data controller responsible for the collection and processing of personal data on this website is:
     • Name: Naturkern
     • Represented by: Nico Mießlinger, Founder
     • Address: Kühgraben 194436 Simbach
     • Country: Germany
     • Email: info@naturkern.org
     • Tel: +49 160 6170106

§ 3 Contact Form

When you contact us via email or contact form, the data you provide, including your contact details, will be stored to process your request and to be available for any follow-up questions. This data will not be shared with third parties without your explicit consent. The processing of data transmitted via the contact form is based solely on your consent, granted in accordance with Article 6(1)(a) of the GDPR. You may withdraw this consent at any time without giving reasons. An informal notification by email to us is sufficient for withdrawal. The withdrawal of consent does not affect the lawfulness of data processing carried out before the withdrawal.

The data transmitted via the contact form will be stored by us until you request its deletion, withdraw your consent to its storage, or the necessity for data storage no longer applies. Statutory retention periods remain unaffected.

§ 4 Customer Account

Creating a customer account requires your consent to the storage of your personal data (name, address, email address, bank details) and usage data (username, password). This data is stored to enable you to place orders via your customer account using your email address and password.

§ 5 Online Payments

To process your order in our online shop, we require certain personal data from you. The mandatory information required for fulfilling the contract is marked accordingly. Depending on your chosen payment method, the data relevant for payment processing will be transmitted to the respective payment service provider. The legal basis for processing your data is Article 6(1)(b) GDPR.

​

A. Amazon Payments

Our website uses Amazon Payments, an online payment service. The service provider is the American company Amazon.com Inc. For the European region, Amazon Payments Europe SCA, 38 Avenue JF Kennedy, L-1855 Luxembourg, is responsible. Amazon Payments is primarily responsible for data processing in connection with Amazon Payments. It is important to understand that this may potentially involve the processing and storage of data without complete anonymization. Additionally, under certain circumstances, US authorities may gain access to this data. Furthermore, this data may be linked to information from other Amazon services if you have a user account there. Further information about the data processed through the use of Amazon Payments can be found in the Privacy Policy at https://pay.amazon.de/help/201212490.

​

B. American Express

​

Our website also uses American Express. The service provider is the American company American Express Company. For the European region, the company responsible is American Express Europe SA, Avenida Partenón 12-14, 28042, Madrid, Spain. American Express is primarily responsible for data processing in connection with American Express. It is important to understand that this may potentially involve the processing and storage of data without complete anonymization. Additionally, under certain circumstances, US authorities may gain access to this data. Furthermore, this data may be linked to information from other American Express services if you have a user account there. Further information about the data processed through the use of American Express can be found in the Privacy Policy at https://www.americanexpress.com/de/legal/online-datenschutzerklarung.html.
 

C. Apple Pay

Our website uses Apple Pay, an online payment service. The service provider is the American company Apple Inc., Infinite Loop, Cupertino, CA 95014, USA.  Apple Pay is primarily responsible for data processing in connection with Apple Pay. It is important to understand that this potentially involves processing and storing data without complete anonymization. can. Additionally, there is a possibility that US authorities may gain access to this data under certain circumstances. Furthermore, this data may be linked to information from other Apple Pay services if you have a user account there. You can find out more about the data processed through the use of Apple Pay in the Privacy Policy at https://www.apple.com/legal/privacy/de-ww/.
 

D. giropay

Our website uses the online payment provider giropay. The service provider is the German company paydirekt GmbH, Stephanstraße 14-16, 60313 Frankfurt am Main, Germany. You can find out more about the data processed through the use of giropay in the privacy policy at
https://www.giropay.de/rechtliches/datenschutzerklaerung/.

E. Google Pay

Our website uses the online payment provider Google Pay. The service provider is the American company Google Inc. For the European region, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, is responsible for all Google services. Google Pay is primarily responsible for data processing in connection with Google Pay. It is important to understand that this may potentially involve processing and storing data without complete anonymization. Additionally, under certain circumstances, US authorities may gain access to this data. Furthermore, this data may be linked to information from other Google services if you have a user account there. For more information about the data processed through the use of Google Pay, please see the Privacy Policy at

https://policies.google.com/privacy.
 

F. Klarna:

Our website allows payment via Klarna. The payment service provider is Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden. When using the Klarna Checkout solution for payment on our website, Klarna processes personal data. Information on the type and scope of data collection can be found in Klarna's privacy policy: https://www.klarna.com/de/datenschutz/. Klarna uses cookies to improve the user-friendliness of the Klarna Checkout solution. This procedure is covered by Klarna's legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. Cookies are small text files that your browser places on your device. Your device stores this information. It remains there until you delete it. For details on the use of Klarna cookies, please see the document at:

https://cdn.klarna.com/1.0/shared/content/policy/cookie/de_de/checkout.pdf. Your data is transferred to Klarna based on your consent (Art. 6 para. 1 lit. a GDPR) and for the performance of the contract (Art. 6 para. 1 lit. b GDPR). You can withdraw your consent at any time. However, please note that a withdrawal does not
affect data processing that has already taken place.

G. Mastercard

Our website uses the payment service provider Mastercard. The service provider is the American company Mastercard Inc. For the European region, the company responsible is Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium. Mastercard is primarily responsible for data processing in connection with Mastercard. It is important to understand that this may potentially involve the processing and storage of data without complete anonymization. Additionally, under certain circumstances, US authorities may gain access to this data. Furthermore, this data may be linked to information from other Mastercard services if you have a user account there. Further information about the data processed through the use of Mastercard can be found in the Privacy Policy at https://www.mastercard.de/de-de/datenschutz.html.

H. PayPal

Our website uses the online payment service PayPal. The service provider is the American company PayPal Inc. For the European region, the responsible company is PayPal (Europe) S.à rl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal is primarily responsible for data processing in connection with PayPal. It is important to understand that this may potentially involve the processing and storage of data without complete anonymization. Additionally, under certain circumstances, US authorities may gain access to this data. Furthermore, this data may be linked to information from other PayPal services if you have a user account there. Further information about the data processed through the use of PayPal can be found in the Privacy Policy at

https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

I. Instant bank transfer

Our website allows payments via "Sofortüberweisung" (instant bank transfer). The payment service provider is Sofort GmbH, Theresienhöhe 12, 80339 Munich, Germany. By using "Sofortüberweisung," the receipt of payment is confirmed by Sofort GmbH in real time. This enables us to provide our services without delay. When paying via "Sofortüberweisung," your PIN and TAN are transmitted to Sofort GmbH.

 

They use this data to log into your online banking account , check your account balance, execute the transfer, and generate a transaction confirmation. As part of the login process, your transactions, overdraft limit, and the existence and balance of any other accounts are also automatically checked. The transmission of certain data to Sofort GmbH is required to process "Sofortüberweisung." In addition to your PIN and TAN, this includes payment details and personal data such as your first and last name, address, telephone number(s), email address, IP address, and, if applicable, other information necessary for payment processing.

 

The transmission of this data serves the purpose of identity verification and fraud prevention. The transfer of your data to Sofort GmbH is based on Art. 6 para. 1 lit. a GDPR (your consent) and on Art. 6 para. 1 lit. b GDPR (processing for the performance of a contract). You are entitled to withdraw your consent at any time. However, data processing that has already taken place remains unaffected by a withdrawal. Detailed information on payment via Sofortüberweisung can be found in the privacy policies at the following links: https://www.sofort.de/datenschutz.html and https://www.klarna.com/sofort/.

 

J. Visa

 

Our website enables payments via Visa. The service provider is the American company Visa Inc. For the European region, the responsible company is Visa Europe Services Inc., 1 Sheldon Square, London W2 6TT, United Kingdom. Visa is primarily responsible for data processing in connection with Visa . It is important to understand that this may potentially involve the processing and storage of data without complete anonymization. In addition, there is the possibility that US authorities may gain access to this data under certain circumstances. Furthermore, this data may be linked with information from other visa services, provided you have a user account there.

Further information about the data processed through the use of Visa can be found in the Privacy Policy at https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

Section 6 Use and Disclosure of Data

We assure you that personal data that you provide to us, for example, when placing an order or via email (such as your name, address, or email address), will not be sold to third parties or otherwise used for commercial purposes. Your data will be processed exclusively for the purpose of corresponding with you and for fulfilling the purpose for which you provided the data. As part of the payment processing, your payment details will be forwarded to the commissioned financial institution. The data automatically collected during your visit to our website will be used exclusively for the purposes mentioned above. The data will not be used for any other purpose. The protection of your personal data is important to us. Therefore, we generally do not disclose your data to third parties unless there is a legal obligation to do so or you have given us your explicit consent.

Section 7 Encryption (SSL/TLS)

Our website uses SSL/TLS encryption to ensure the security and protection of the transmission of confidential information. This applies in particular to orders or inquiries that you, as a website visitor, send to us as the website operator. An encrypted connection is recognizable by the "https://" in your browser's address bar and the padlock icon in your browser's address bar. Activating SSL/TLS encryption means that the data you send to us cannot be read by unauthorized third parties.

Section 8 Data Retention Period

Your personal data that you transmit to us via our website is stored only for the duration necessary to achieve the respective purpose of the data processing. However, in accordance with commercial and tax law retention obligations, the storage of certain data may last up to 10 years.

Section 9 Your Data Protection Rights

As a data subject, you have the following rights vis-à-vis the controller regarding your personal data, in accordance with the legal provisions:
 

A. Right to withdraw consent

Many data processing activities are only possible with your express consent. If If the processing of your data is based on your consent, you have the right to withdraw this consent at any time with effect for the future in accordance with Article 7(3) GDPR . The lawfulness of the data processing carried out on the basis of your consent until the withdrawal remains unaffected. The storage of data for billing and accounting purposes is not affected by a withdrawal.

 

B. Right of access:

 

In accordance with Article 15 GDPR, you have the right to request confirmation from us as to whether we process your personal data. If this is the case, you have the right to information about this data, including the purposes of the processing, the categories of data processed, the recipients or categories of recipients to whom the data have been or will be disclosed, the planned storage period or the criteria for determining it, the existence of a right to rectification, erasure, restriction of processing, objection to processing, lodging a complaint with a supervisory authority, the origin of the data if they were not collected from you, the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you, and your right to be informed of the safeguards pursuant to Article 46 GDPR relating to the transfer of your data to third countries.

 

C. Right to rectification

 

You have the right, at any time pursuant to Article 16 GDPR , to request from us the correction of inaccurate personal data concerning you and/or the completion of your incomplete data.

 

D. Right to Erasure

 

You have the right, pursuant to Article 17 GDPR, to request the erasure of your personal data if one of the following grounds applies:

 

a. Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.

b. You withdraw your consent, which legitimized the processing pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for the processing.

c. You object to the processing pursuant to Article 21(1) GDPR and there are no compelling legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR.

d. The personal data has been unlawfully processed. 

e. We are obliged to erase the personal data due to a legal obligation under Union law or the law of the Member State to which we are subject.

f. The personal data were collected in connection with the provision of information society services pursuant to Article 8(1) GDPR.

 

This right may be restricted in the following circumstances where processing is essential:

 

a. to comply with a legal obligation which requires processing under Union or Member State law to which we are subject, or to perform a task carried out in the public interest or in the exercise of official authority;

b. to comply with a legal obligation which requires processing under Union or Member State law to which we are subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in us;

c. for reasons of public interest in the area of ​​public health in accordance with Article 9(2)(h) and (i) as well as Article 9(3) GDPR;

d. for archiving purposes, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1) GDPR, which are in the public interest, provided that safeguarding the rights of the data subject would render impossible or seriously impair the objectives of this processing; or

e. for the establishment, exercise, or defense of legal claims. If we have made your personal data public and are obliged to erase it pursuant to the above provisions, we will take reasonable steps, including technical measures, taking into account available technology and the cost of implementation , to inform controllers who are processing this data that you, as the data subject, have requested the erasure of all links to, copies of, or replications of your personal data.

 

E. Right to restriction of processing

 

Pursuant to Article 18 GDPR, you have the right to request the restriction of processing (blocking) of your personal data. To exercise this right, you can contact us at any time. You can find our contact details in the legal notice. A restriction of processing can be requested in the following cases:

 

a. If you wish to verify the accuracy of your personal data stored with us If you dispute the processing of your personal data, we generally need time to verify this. For the duration of the verification process, you have the right to request the restriction of the processing of your personal data. 

b. If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of erasure 

c. If we no longer need your personal data, but you require it for the establishment, exercise, or defense of legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure. 

d. If you have objected to processing pursuant to Article 21(1) GDPR, a balancing of interests between your interests and ours must be carried out. As long as it is not yet clear whose interests prevail, you have the right to request the restriction of the processing of your personal data. After a restriction of the processing of your personal data, it may, in principle, only be processed with your consent. Exceptions apply in certain legally defined cases, such as for the establishment, exercise, or defense of legal claims or for the protection of public interests.

F. Right to Information If you exercise

your right to rectification, erasure, or restriction of the processing of your personal data, we are obligated under Article 19 GDPR to inform all recipients to whom the data has been disclosed . This does not apply if notification proves impossible or involves a disproportionate effort. Upon your request, we will inform you of the recipients of your data.

 

G. Protection against Automated Decisions (Profiling)

 

Under Article 22 GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision is a. necessary for entering into, or performing, a contract between you and us , b. authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights, freedoms, and legitimate interests, or c. based on your explicit consent.

However, decisions in the cases mentioned under (a) to (c) may not be based on special categories of personal data within the meaning of Article 9(1) GDPR, unless Article 9(2)(a) or (g) applies and appropriate measures have been taken to safeguard your rights and freedoms and legitimate interests. In the cases mentioned under (a) and (c), we take appropriate measures to safeguard your rights and freedoms and legitimate interests. This includes, at a minimum, the right to request human intervention by the controller , to express your point of view, and to contest the decision.

H. Right to Data Portability

In the case of processing your personal data based on your consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and carried out by automated means, you have the right, pursuant to Art. 20 GDPR, to receive the data you have provided to us in a structured, commonly used and machine-readable format and to transmit this data to another controller or to request that we transmit it to another controller, provided this is technically feasible.

I. Right to Object

If we process your personal data on the basis of a balancing of interests pursuant to Art. 6 para. 1 lit. f GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation; this also applies to profiling based on this. You can find the applicable legal basis for the processing in this privacy policy. In the event of an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defense of legal claims (objection pursuant to Article 21(1) GDPR). If your personal data is processed for direct marketing purposes, you have the right to object to this processing at any time; this also applies to profiling insofar as it is related to such direct marketing. In the event of an objection, your personal data will no longer be used for direct marketing purposes (objection pursuant to Article 21(2) GDPR). With regard to the use of information society services, notwithstanding Directive 2002/58/EC, you have the option of exercising your right to object by automated means, using technical specifications.

J. Right to lodge a complaint with the competent supervisory authority pursuant to Article 77 GDPR. In the event of infringements of the provisions of the GDPR, data subjects have the right to lodge a complaint with a competent supervisory authority. The complaint may be lodged, in particular, in the Member State of their habitual residence, place of work, or the place of the alleged infringement. The right to lodge a complaint under this provision is without prejudice to any other administrative or judicial remedy.
 

Our responsible supervisory authority is:
Bavarian State Office for Data Protection Supervision,
Promenade 18, 91522 Ansbach,
Postal address: P.O. Box 1349, 91504 Ansbach,
Telephone: +49 981 180093-0,
Email: poststelle@lda.bayern.de,
Website: https://www.lda.bayern.de .

Section 10 Validity and Amendment of this Privacy Policy

This Privacy Policy enters into force on August 25, 2026. We reserve the right to amend this policy as needed and in compliance with applicable data protection laws. This may be necessary, for example, to comply with new legal requirements or to reflect changes to our website or new services offered through our website. The current version of the Privacy Policy, which is available at the time of your visit to our website, is binding. In the event of changes to this privacy policy, we will publish them on this page to fully inform you about what personal data we collect, how we process it and under what conditions we may share it.