Privacy Policy

Draft — under legal review. This English page is an unreviewed translation of the current German text and is not yet in force.

Note: the service-specific sections of this policy are being revised for the online shop; the processors actually used (payment, shipping, inventory, hosting, analytics, consent manager) will be added.

Controller (Article 4(7) GDPR)

Herbania Kosmetik Deutschland, Eschenweg 5, 61381 Friedrichsdorf, Germany. Phone: +49 176 84007665. E-mail: info@herbania.de

Security and protection of your personal data

We regard it as our primary responsibility to maintain the confidentiality of the personal data you provide and to protect it against unauthorised access. As a private-sector company, we are subject to the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). We have implemented technical and organisational measures to ensure that data protection rules are observed by us and by our external service providers.

Definitions

We use the terms defined in Article 4 GDPR, in particular: personal data, processing, restriction of processing, profiling, pseudonymisation, filing system, controller, processor, recipient, third party, and consent. The statutory definitions under the GDPR apply.

Lawfulness of processing

Processing is lawful only if there is a legal basis under Article 6(1)(a)–(f) GDPR: (a) consent; (b) performance of a contract or pre-contractual measures; (c) compliance with a legal obligation; (d) protection of vital interests; (e) a task in the public interest; (f) legitimate interests, unless overridden by the data subject’s interests or fundamental rights.

Collection of personal data when visiting our website

For merely informational use of the website, we only collect the data your browser transmits to our server, which is technically necessary to display the website and ensure stability and security (legal basis: Art. 6(1)(1)(f) GDPR): IP address; date and time of the request; time-zone difference from GMT; content of the request; access status / HTTP status code; amount of data transferred; referring website; browser; operating system and its interface; language and version of the browser software.

If you contact us by e-mail or via a contact form, the data you provide is stored to answer your enquiry and deleted once no longer required, unless statutory retention obligations apply.

Cookies

We use transient cookies (deleted when you close your browser, e.g. session cookies) and persistent cookies (deleted automatically after a defined period). You can configure your browser to refuse third-party cookies or all cookies; some functions of the website may then be unavailable.

Children

Our offer is generally aimed at adults. Persons under 18 should not transmit personal data to us without the consent of their parents or legal guardians.

Your rights

You have the following rights under the GDPR: withdrawal of consent (Art. 7(3)); confirmation and access (Art. 15); rectification (Art. 16); erasure / „right to be forgotten“ (Art. 17); restriction of processing (Art. 18); data portability (Art. 20); objection, including to direct marketing (Art. 21); the right not to be subject to automated decision-making / profiling (Art. 22); the right to lodge a complaint with a supervisory authority (Art. 77); and the right to an effective judicial remedy (Art. 79).

TLS encryption

For security and to protect the transmission of confidential content, this site uses TLS (SSL) encryption, recognisable by „https://“ and the padlock symbol in your browser.

Advertising e-mails

We object to the use of contact data published under the legal-notice obligation for sending unsolicited advertising and information material.

Services (under revision)

The current version references Google Fonts, the LinkedIn Insight Tag and Google Analytics. These sections are being updated: Google Fonts should, where possible, be self-hosted; the analytics description must reflect the tool actually in use; and international data transfers must rely on a currently valid mechanism. The processors used for the online shop (payment, order and shipping data, inventory, hosting, transactional e-mail, back-in-stock notifications and the consent manager) will be added with purpose, legal basis, recipients, retention periods and third-country safeguards.