Privacy policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is Cobrend Naturals – Sole Proprietorship, owner: Chigozie Brendan Omeje, Panoramastraße 6, 69168 Wiesloch, Germany. Contact: info@cbnaturals.de, phone: +49 1521 3324290.

You can contact us at any time with questions about data protection.

Principles of data processing

We process personal data in accordance with the principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality and accountability pursuant to Art. 5 GDPR.

Processing is based on one of the following legal grounds: consent (Art. 6 (1)(a) GDPR), performance of a contract or pre-contractual measures (Art. 6 (1)(b)), legal obligation (Art. 6 (1)(c)) or legitimate interests (Art. 6 (1)(f)).

Data sources and categories

We collect personal data you provide to us (e.g. via order or contact forms), automatically via your device (e.g. IP address, browser information, cookies) as well as from third parties such as payment and shipping providers.

Categories of processed data include contact and identity data (name, address, email, telephone number), order and payment data (ordered items, prices, payment information), technical data (IP address, device data, operating system, browser), usage data (pages visited, timestamps, referrer) and communication data (support requests).

Purposes and legal bases of processing

We process your data for the following purposes:

  • Fulfilment of contracts and pre-contractual measures (e.g. processing of orders, deliveries and payments).
  • Provision, operation and security of our website (server log files, technically necessary cookies).
  • Responding to inquiries and customer service.
  • Analysis and improvement of our offer and marketing, provided you have consented (e.g. Google Analytics, Meta Pixel).
  • Compliance with legal obligations (e.g. commercial and tax retention obligations).

Cookies and consent management

Our website uses cookies. Technically necessary cookies are required for operation and are set on the basis of our legitimate interests.

For analytics and marketing cookies, we obtain your prior consent (§ 25 TTDSG, Art. 6 (1)(a) GDPR). You may withdraw your consent at any time.

Analytics and marketing

We use Google Analytics to analyse the use of our website. IP addresses are truncated and only pseudonymised data are processed. The provider is Google Ireland Ltd.; data may be transferred to the USA. We use standard contractual clauses to ensure an adequate level of data protection.

We also use Meta Pixel for marketing purposes where you have consented. The provider is Meta Platforms Ireland Ltd.; data may be transferred to the USA. Standard contractual clauses and additional measures are used.

Orders, payments and shipping

To process orders and payments, we transmit personal data to payment service providers (e.g. PayPal, Stripe) and shipping companies (e.g. DHL, DPD).

We process this data for contractual fulfilment. Payment service providers and shipping companies only receive the data necessary for the performance of the service. Their own privacy policies apply.

Recipients and processors

In addition to the aforementioned payment and shipping service providers, we use IT service providers and hosting providers (e.g. Hostinger) to provide our website.

We conclude data processing agreements with all processors in accordance with Art. 28 GDPR. Your data will only be passed on if permitted by law or if you have given your consent.

International data transfers

Where service providers outside the European Economic Area are used, data is only transferred if the third country has an adequacy decision or we conclude EU standard contractual clauses and take additional protective measures.

Storage duration

Personal data are stored only for as long as necessary for the purposes or as required by statutory retention obligations. Order and tax-related data are stored for ten years for tax and commercial law reasons. Communication data are deleted after three years. Server log files are deleted afterseven days.

Data security

We take appropriate technical and organisational measures to protect personal data against loss, destruction, manipulation and unauthorised access.

Our website uses SSL/TLS encryption. Access to personal data is only granted to employees who need it to fulfil their tasks.

Rights of data subjects

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to the processing of your data.

You may withdraw any consent given at any time with effect for the future. 

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LFDI), Lautenschlagerstraße 20, 70173 Stuttgart,  Germany.

Children’s data

Our offer is not directed at children. We do not knowingly collect personal data from children under the age of 16.

Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Changes to this privacy policy

We may adapt this privacy policy to reflect changes in legal requirements or in data processing. The current version is dated 3 May 2026.