Privacy Policy
This Privacy Policy explains what personal data we collect and process in connection with your use of the natural-guide.com website and with placing orders and submitting registrations – on the website or by telephone, for what purposes and on what legal bases, to whom we transfer them, how long we retain them and what rights you have. We process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council – the General Data Protection Regulation (GDPR) – and Directive 2002/58/EC on privacy and electronic communications. Detailed information about cookies can be found in the Cookie Policy.
This Policy is based on the principles of the GDPR and reflects a high standard of personal data protection – including the lawfulness, fairness and transparency of processing.
1. Data controller
The controller of your personal data is the Seller indicated in the Terms and Conditions (Section II) (the “Controller”, “we”).
- Email: [email protected]
In all matters relating to the protection of personal data, you can contact us at the email address given above.
The Controller is the seller and the party to the contract for orders placed on the website or by telephone. We use payment service providers to handle online payments. If a payment service provider processes your data for its own purposes, e.g. to prevent fraud or to comply with its own legal obligations, it is a separate controller in that respect and applies its own privacy policy.
2. What data we process and where we obtain it
We do not offer sign-up or user accounts. The scope of the data processed depends on which functions of the Website you use – a registration or order form is not available on every page. We process the following data:
- collected automatically when you use the website – IP address, device and browser type, operating system, date and time of the visit, subpages visited, the address of the website from which you came to our website, advertising campaign parameters (e.g. click identifier) and, after you have given your consent, information on how you use the website (clicks, scrolling, cursor movement);
- from advertising networks – campaign parameters and the click identifier passed in the page address when you reach the page from an advertisement;
- provided in the registration form – first name and telephone number;
- provided when placing an order on the website or by telephone – first name and surname, delivery address, email address, telephone number and order details;
- from payment service providers – information on the payment status (e.g. paid, failed, refunded). We do not store payment card data – you enter them directly with the payment service provider;
- provided by you when you contact us by email, by telephone or via the contact form, or submit a complaint – e.g. first name, email address, telephone number, the content of the message and photos of the parcel or product.
We do not intentionally collect special categories of data (e.g. data concerning health). Please do not provide such data in your messages to us.
3. Purposes, legal bases and retention period
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Ensuring the operation and security of the website (server logs, detection of abuse and errors) | IP address, device and browser data, date and time of the visit, subpages visited | The Controller’s legitimate interests (Article 6(1)(f) GDPR) in ensuring the operation and security of the website and protecting it against abuse | Up to 12 months |
| Remembering your cookie choices and demonstrating that consent has been given | Information on the consent and the date on which it was given (stored in your browser) | Legal obligation to demonstrate consent | Until the settings are changed or the browser data are cleared |
| Identifying the source of the visit and settling the advertising campaign through which you reached the website | Campaign parameters, click identifier, referring page address, technical data | The Controller’s legitimate interests in settling campaigns and evaluating their effectiveness | Data on individual visits – until the campaign has been settled. Aggregated campaign statistics – with no time limit. |
| Website visit statistics (Google Analytics 4) | Browser identifier stored in cookies, IP address (truncated), device and browser data, subpages visited, time and source of the visit | Your consent (Article 6(1)(a) GDPR) | Until consent is withdrawn, but no longer than 14 months |
| Analysing how the website is used and improving it (Microsoft Clarity) | Pseudonymised information on interactions with the website, device and browser data | Your consent (Article 6(1)(a) GDPR) | Session recordings – up to 30 days (selected recordings – up to 9 months); interaction maps – up to 9 months |
| Contacting you regarding your registration and presenting an offer | First name, telephone number | Steps taken at your request prior to entering into a contract | For as long as necessary to handle the registration, and for a reasonable period thereafter |
| Conclusion and performance of the sales contract – shipping, shipment information, customer service, complaints, returns and refunds, including the fulfilment of promotional campaigns where they cover the offer in question | First name and surname, delivery address, email address, telephone number, order details, photos sent as part of a complaint | Performance of a contract (Article 6(1)(b) GDPR) | For as long as necessary to fulfil the order, handle complaints and carry out promotional campaigns |
| Processing the payment and assigning it to the order | Payment status, order data | Performance of a contract (Article 6(1)(b) GDPR) | Same as for order data |
| Compliance with tax and accounting obligations | Data from sales documents | Legal obligation (Article 6(1)(c) GDPR) | For the periods required by tax and commercial law |
| Limiting participation in the promotion to once per person | Telephone number, delivery address | The Controller’s legitimate interests in preventing abuse of the promotion rules | For the duration of the promotion and for 6 months after it ends |
| Direct marketing – details in the “Marketing” section | First name, email address, telephone number, order history | The Controller’s legitimate interests (Article 6(1)(f) GDPR) (emails to customers) or your consent (Article 6(1)(a) GDPR) | Until you object or withdraw your consent |
| Responding to your questions (email, telephone, contact form) | First name, email address, telephone number, content of the message | The Controller’s legitimate interests (Article 6(1)(f) GDPR) in responding; where the enquiry concerns a contract – steps prior to entering into a contract or performance of a contract (Article 6(1)(b) GDPR) | Up to 3 years after the matter has been closed |
| Fulfilling your rights under the GDPR | Data necessary for identification and for handling the request | Legal obligation | Up to 5 years after the request has been fulfilled |
| Establishment, exercise or defence of legal claims | Data relating to the matter in question | The Controller’s legitimate interests (Article 6(1)(f) GDPR) in the establishment, exercise or defence of legal claims | Until the limitation period for claims has expired |
After the retention periods have expired, the data are deleted or permanently anonymised.
4. Marketing
Email. If you have made a purchase from us, we may send you emails about our own similar products. The legal basis is our legitimate interests in conducting direct marketing to customers (Article 6(1)(f) GDPR in conjunction with Article 13(2) of Directive 2002/58/EC). You can object at any time free of charge – every marketing email contains an unsubscribe link; you can also write to [email protected]. If you have given your consent to marketing communications, we use your contact details on the basis of that consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time.
Other channels. If you have given your consent to this, we may also send you offers and product information by SMS or by telephone (Article 6(1)(a) GDPR). You can withdraw your consent at any time by writing to [email protected].
Online advertising and retargeting. If advertising or retargeting services are activated on the Website (e.g. via Google Tag Manager), they process certain data – e.g. cookie identifiers or information about the pages visited – in order to show you tailored advertisements. This takes place solely on the basis of your consent given in the cookie banner (Article 6(1)(a) GDPR). The individual providers are separate controllers with regard to the data they collect. You can withdraw your consent at any time by clicking “Cookie settings” in the website footer.
We use the data for marketing purposes until you object or withdraw your consent.
6. Data recipients
We may entrust your personal data for processing or disclose them only to the extent necessary:
- to IT and customer service providers acting on our behalf – website hosting and maintenance, email, handling of registrations and orders, and sending order-related communications – on the basis of data processing agreements;
- to a fulfilment centre – handling of warehousing, shipping and returns;
- to courier and postal companies – to the extent necessary to deliver the order, collect cash on delivery and investigate lost parcels;
- to payment service providers – if you pay online, to the extent necessary to process the payment;
- to accounting, tax and legal advisers – to the extent necessary to comply with legal obligations or to pursue and defend claims;
- to Google Ireland Limited – the provider of the Google Analytics and Google Tag Manager tools – only if you consent to analytics or marketing cookies;
- to Microsoft Ireland Operations Limited – the provider of the Microsoft Clarity tool – only if you consent to analytics cookies;
- to advertising partners (advertising networks) – only with regard to the click identifier, for the purpose of settling campaigns;
- to entities within our group of companies, where this is necessary to handle your enquiry;
- to public authorities (e.g. courts, law enforcement authorities) where required by law.
These entities process data on our behalf on the basis of data processing agreements or as independent controllers where required by law or by the nature of the service (e.g. payment service providers). We do not sell your personal data and do not transfer them to other entities for marketing purposes.
The Website may contain links to other websites. The controllers of those websites are responsible for the processing of data on them – please read the privacy policy available on the website concerned.
7. Transfers of data outside the European Economic Area
As a rule, we process data within the EEA. Microsoft and Google may also process data on servers outside the EEA, including in the United States. Such transfers take place on the basis of a European Commission decision finding an adequate level of protection (EU-U.S. Data Privacy Framework), in which these providers participate, or on the basis of standard contractual clauses approved by the European Commission. You can obtain a copy of the safeguards by contacting us.
8. Your rights
You have rights relating to your personal data – including access to them, their rectification, erasure and objection to processing. Below we describe what these rights involve and how to exercise them.
- Right to information – you have the right to clear information about how we collect and use your data. This Policy serves that purpose.
- Right of access – you can ask whether we process your data and receive a copy of them.
- Right to rectification – if your data are inaccurate or incomplete, you can ask for them to be corrected or completed.
- Right to erasure (“right to be forgotten”) – you can request the erasure of your data if they are no longer needed for the purposes for which we collected them, if you withdraw your consent (where the processing was based on it), if you object successfully or if the data have been processed unlawfully. However, we may retain the data where this is necessary, e.g. for the establishment, exercise or defence of legal claims.
- Right to restriction of processing – you can request a temporary restriction of processing, e.g. where you contest the accuracy of the data or where you have objected and we are verifying our legal grounds.
- Right to data portability – if the processing is based on your consent or on a contract and is carried out by automated means, you can receive your data in a structured, commonly used format or ask for them to be transmitted to another controller.
- Right to withdraw consent – you can withdraw your consent at any time: consent to cookies – by clicking “Cookie settings” in the website footer; consent to cookies or to marketing communications – also by writing to [email protected]. This does not affect the lawfulness of processing carried out before its withdrawal.
- Right to object – you can object at any time to the processing of your data based on the Controller’s legitimate interests. We will stop processing them unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. You can object to direct marketing at any time – free of charge, via the link in the message or by email – and we will always comply with such an objection.
How to exercise your rights: write to [email protected]. We will respond without undue delay, at the latest within one month. In justified cases, this period may be extended by a further two months, in which case we will inform you. We may ask for information necessary to confirm your identity.
Right to lodge a complaint: if you have concerns about the way we process your data, please contact us first – we will try to clarify the matter. You also have the right to lodge a complaint with a supervisory authority in the EU Member State in which you have your habitual residence or place of work, or in which the infringement took place. The authority competent for the Controller’s registered office is the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy).
Note: these rights are not absolute. In some cases, their exercise may be restricted by data protection law – e.g. where complying with a request would infringe the rights and freedoms of other persons or where we are legally obliged to retain certain data.
9. Voluntary provision of data
Providing data when contacting us, in the registration form and when placing an order is voluntary, but necessary for us to be able to answer your question, contact you, and conclude and perform the sales contract. Consent to marketing communications is not a condition for placing an order. The technical data collected automatically are necessary to display the website.
10. Automated decision-making
We do not take decisions concerning you based solely on automated processing, including profiling, which would produce legal effects or similarly significantly affect you.
11. Data security
We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or destruction, in particular an encrypted connection (HTTPS), restriction of access to data to authorised persons and data processing agreements with service providers. No system for transmitting data over the internet is entirely free of risk – which is why we continuously monitor and update the safeguards we use.
12. Minors
The Website is not directed at persons under 18 years of age. We do not knowingly collect data of minors; if we learn that such data have been provided to us, we will delete them without delay.
13. Changes to the policy
We may update this Privacy Policy, e.g. in connection with changes in legislation or in the tools we use. The current version is always available on this page together with its effective date. Changes take effect from the date on which the updated version is published on this page.