Privacy policy

The data controller is:

Lupura Superfood
Gran Via de les Corts Catalanes 613
08007 Barcelona
España
Email: info@lupura.de

We appreciate your interest in our online store. Protecting your privacy is very important to us. Below, we provide detailed information about how we handle your data.

1. Access Data and Hosting

You can visit our web pages without providing any personal information. With each access to a web page, the web server automatically saves a server log file, which includes, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred, and the requesting provider (access data) and records access. These access data are evaluated exclusively to ensure smooth operation of the site and to improve our offering. This serves to protect our legitimate interests in a correct presentation of our offer in accordance with Article 6, paragraph 1, sentence 1, letter f of the GDPR. All access data is deleted at the latest seven days after your visit to the site.

1.1 Hosting

The hosting services and website presentation are partially provided by our service providers within the framework of processing on our behalf. Unless otherwise explained in this data protection statement, all access data and data collected in the forms provided on this website are processed on their servers. If you have any questions about our service providers and the basis of our cooperation with them, please contact the contact information described in this data protection statement.


2. Data Processing for Contract Execution and Contact

2.1 Data Processing for Contract Execution

In order to process the contract (including inquiries and processing of any warranty and defect claims, as well as any legal obligation to update) in accordance with Article 6, paragraph 1, sentence 1, letter b of the GDPR, we collect personal data if you voluntarily provide it to us when placing your order. Mandatory fields are marked as such because in these cases we need the necessary data to process the contract and cannot send the order without them. The data collected is evident in the respective input forms.

For more information about the processing of your data, especially regarding disclosure to our service providers for order processing, payments, and shipments, please refer to the following sections of this data protection statement. After completion of the contract, your data will be restricted for further processing and deleted after the expiry of legal and commercial retention periods in accordance with Article 6, paragraph 1, sentence 1, letter c of the GDPR, unless you have given express consent for further use of your data in accordance with Article 6, paragraph 1, sentence 1, letter a of the GDPR or we reserve the right to use the data further, which is permitted by law and about which we inform you in this statement.

2.2 Customer Account

If you have given your consent in accordance with Article 6, paragraph 1, sentence 1, letter a of the GDPR when deciding to open a customer account, we will use your data in order to open a customer account and store your data for future orders on our website. Deleting your customer account is possible at any time and can be done either by sending a message to the contact information described in this data protection statement or through a function provided for this purpose in the customer account. After deletion of your customer account, your data will be deleted unless you have given express consent for further use of your data in accordance with Article 6, paragraph 1, sentence 1, letter a of the GDPR or we reserve the right to use the data further, which is permitted by law and about which we inform you in this statement.

2.3 Contact

As part of customer communication, we collect personal data to process your inquiries in accordance with Article 6, paragraph 1, sentence 1, letter b of the GDPR if you provide them voluntarily when communicating with us (for example, through a contact form or email). Mandatory fields are marked as such because in these cases we need the necessary data to process your inquiry. The data collected is evident in the respective input forms. After processing your inquiry, your data will be deleted unless you have given express consent for further use of your data in accordance with Article 6, paragraph 1, sentence 1, letter a of the GDPR or we reserve the right to use the data further, which is permitted by law and about which we inform you in this statement.


3. Data Processing for the Purpose of Dispatching Shipments

To fulfill the contract according to Art. 6 para. 1 sentence 1 lit. b of the GDPR, we provide your data to the shipping service provider responsible for delivery, to the extent necessary for the delivery of the ordered products.

Disclosure of data to shipping service providers for shipment notification

If you have expressly consented to this during or after your order, in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, we will provide your email address and telephone number to the selected shipping service provider so that they can contact you prior to delivery to announce or coordinate the delivery.

You can revoke this consent at any time by sending a message to the contact address described in this privacy policy or directly to the shipping service provider at the contact address provided below. After revocation, we will delete the data provided for this purpose, unless you have expressly consented to continue using your data or we reserve the right to use it to a greater extent permitted by law and about which we inform you in this statement.


4. Data Processing for Payment Management

In processing payments in our online store, we collaborate with the following partners: technical service providers, financial institutions, payment service providers.

4.1 Data Processing for Transaction Execution

Depending on the selected payment method, we provide the necessary data for the execution of the payment transaction to our technical service providers, who act on our behalf within the framework of order processing, or to the designated financial institutions or selected payment service provider, to the extent necessary for processing the payment. This serves to fulfill the contract in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR. In some cases, payment service providers collect the necessary data for processing the payment themselves, for example, on their own website or through technical integration in the ordering process. In this case, the privacy policy of the respective payment service provider applies.

If you have questions about our partners for payment processing and the basis of our collaboration with them, please contact the contact address described in this privacy policy.

4.2 Data Processing for Fraud Prevention and Optimization of Our Payment Processes

Where applicable, we provide our service providers with additional data, which they use together with the data necessary for payment execution as our order processors for the purpose of fraud prevention and optimization of our payment processes (e.g., billing, processing disputed payments, assistance in accounting). This serves in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR to protect our overriding legitimate interests in the context of a balancing of interests in our protection against fraud or in efficient payment management.


5. Email Advertising/Newsletter

5.1 Newsletter with Registration, Newsletter Tracking with Separate Consent

If you subscribe to our newsletter, we use the necessary data or data provided explicitly by you to regularly send you our email newsletter based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. You can unsubscribe from the newsletter at any time, either by sending a message to the contact address described below or via a link provided for this purpose in the newsletter. After unsubscribing, we will delete your email address from the recipient list, unless you have given express consent to continue using your data or we reserve the right to use it in a broader manner permitted by law and as informed in this statement.

If you have also given us your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR to analyze our email newsletter, we also analyze your interaction with our email newsletter by measuring, storing, and evaluating open and click rates in order to design future email newsletter campaigns ("newsletter tracking").

For this analysis, the emails sent contain single pixel technologies (e.g., web beacons, tracking pixels) that are stored on our website. For evaluations, we especially link the following "newsletter data":

  • the page from which the page was requested (referrer URL),
  • the date and time of the request,
  • the description of the type of web browser used,
  • the IP address of the requesting computer,
  • the email address,
  • the date and time of registration and confirmation

and single pixel technologies with your email address or your IP address and possibly an individual ID. The links included in the newsletter may also contain this ID.

You can unsubscribe from newsletter tracking at any time, either by sending a message to the contact address described below or via a link provided for this purpose in the newsletter.

The information will be stored as long as you are subscribed to the newsletter.

5.2 Sending the Email Newsletter

The email newsletter and the aforementioned newsletter tracking may also be sent by our service providers as part of processing on our behalf. If you have questions about our service providers and the basis of our collaboration with them, please contact the contact address described in this privacy policy.

Our service providers are headquartered and/or use servers in the United States. For the United States, there is no adequacy decision by the European Commission. Our collaboration with them is based on the European Commission's standard data protection contractual clauses.

 

6. Cookies and Other Technologies

General Information

To make your visit to our website attractive and enable the use of certain functions, we use technologies on various pages, including so-called cookies. Cookies are small text files that are automatically stored on your end device. Some of the cookies we use are automatically deleted when you close your browser session (session cookies). Other cookies remain on your end device and allow us to recognize your browser the next time you visit our site (persistent cookies).

Privacy Protection on End Devices

When using our online offer, we use technologies strictly necessary to provide the expressly requested telecommunications service. Storing information on your end device or accessing information already stored on your end device does not require your consent.

For functions that are not strictly necessary, storing information on your end device or accessing information already stored on your end device requires your consent. We inform you that if you do not give your consent, parts of the website may not be fully usable. Your given consents will remain valid until you adjust or reset the corresponding settings on your end device.

Subsequent Data Processing via Cookies and Other Technologies

We use technologies that are essential for the use of certain functions of our website (e.g., the shopping cart function). These technologies collect and process the IP address, time of visit, information about the device and browser, as well as information about your use of our website (e.g., information about the contents of the shopping cart). This is done within the framework of a balancing of interests and is based on our predominant legitimate interests in an optimized presentation of our offer according to Art. 6 para. 1 p. 1 lit. f GDPR.

Furthermore, we use technologies to fulfill legal obligations incumbent upon us (e.g., to be able to demonstrate consent to the processing of your personal data) and for web analytics and online marketing. For more information on this, including the specific legal basis for data processing, please see the following sections of this privacy policy.

You can find cookie settings for your browser at the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™

If you have given your consent for the use of these technologies according to Art. 6 para. 1 p. 1 lit. a GDPR, you can revoke your consent at any time by sending a message to the contact address described in the privacy policy.

 

7. Use of Cookies and Other Technologies

If you have given your consent for this according to Art. 6 para. 1 p. 1 lit. a GDPR, we use the following cookies and other technologies from third-party providers on our website. Once the purpose has been fulfilled and the use of the corresponding technology by us has ended, the data collected in this context will be deleted. You can revoke your consent at any time with effect for the future. For more information on how to revoke your consent, please refer to the "Cookies and Other Technologies" section below. For more information, including the basis of our collaboration with the individual providers, please refer to the respective sections of the corresponding technologies. If you have questions about the providers and the basis of our collaboration with them, please contact the contact address described in this privacy policy.

7.1 Use of Google Services

We use the following technologies from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Information about your use of our website automatically collected through Google technologies is usually transmitted to a Google LLC server, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, and stored there. For the USA, there is no adequacy decision by the European Commission. Our collaboration with them is based on the standard contractual clauses for data protection of the European Commission. Unless otherwise specified for the individual technologies, data processing is based on a data processing agreement between joint controllers according to Art. 26 GDPR. For more information on data processing by Google, please refer to the Google Privacy Policies.

Google Analytics

In order to analyze our website, Google Analytics automatically collects and stores data (IP address, time of visit, information about devices and browsers, as well as information about your use of our website) from which user profiles are created using pseudonyms. For this, cookies may be used. If you visit our website from the EU, your IP address will be stored on a server located in the EU to derive location data and then immediately deleted before the traffic is redirected to other Google servers for processing. Data processing is based on a data processing agreement with Google.

Google Ads

For advertising purposes in Google search results and on third-party websites, visiting our website sets the so-called Google Remarketing cookie, which automatically enables, through the collection and processing of data (IP address, time of visit, device and browser information, as well as information about your use of our website) and through a pseudonymous cookie ID and based on the pages you have visited, the display of interest-based advertising. Further data processing will only take place if you have activated the "personalized advertising" setting in your Google account. In this case, if you are logged in to Google during your visit to our website, Google will use your data together with Google Analytics data to create and define cross-device remarketing audience lists.


For website analysis and event tracking, we measure your subsequent usage behavior through Google Ads conversion tracking when you reach our website through a Google Ads advertisement. For this purpose, cookies may be used and data (IP address, time of visit, device and browser information, as well as information about your use of our website according to events predefined by us, such as visiting a web page or subscribing to a newsletter) may be collected, from which usage profiles will be created using pseudonyms.



7.2 Utilisation of Facebook Services

Use of Facebook Pixel

We use the Facebook pixel as part of the technologies described below from Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ("Facebook (by Meta)" or "Meta Platforms Ireland"). With the Facebook pixel, data (IP address, visit time, device and browser information, as well as information about your use of our website based on predefined events such as visiting a webpage or subscribing to a newsletter) is automatically collected and stored, from which pseudonymous usage profiles are created. For this purpose, when you visit our website, the Facebook pixel automatically places a cookie that, through a pseudonymous cookie ID, enables the recognition of your browser when visiting other websites. Facebook (by Meta) will combine this information with other data from your Facebook account and use it to compile reports on website activity and to provide other services related to website usage, especially personalized and interest-based advertising.

The information automatically collected about your use of our website through Facebook (by Meta) technologies is generally transferred to a Meta Platforms, Inc. server, 1 Hacker Way, Menlo Park, California 94025, USA, and stored there. For the USA, there is no adequacy decision by the European Commission. If data transfer to the USA is our responsibility, our cooperation is based on standard contractual clauses for data protection of the European Commission. For more information on data processing by Facebook, please refer to the Facebook (by Meta) Privacy Policies.

Facebook Analytics

As part of Facebook's business tools, statistics are created about visitor activity on our website based on data collected with the Facebook pixel. Data processing is carried out based on a data processing agreement with Facebook (by Meta). The analysis aims at optimal presentation and marketing of our website.

Facebook Ads (Ad Manager)

Through Facebook Ads, we promote this website on Facebook (by Meta) and other platforms. We determine the parameters of each advertising campaign. For precise implementation, especially the decision about ad placement for individual users, Facebook (by Meta) is responsible. Unless otherwise stated in the individual technologies, data processing is based on an agreement between controllers under Art. 26 of the GDPR. Joint responsibility is limited to data collection and transmission to Meta Platforms Ireland. Subsequent data processing by Meta Platforms Ireland is not included in this.

Based on the pseudonymous cookie ID established by the Facebook Pixel and the data collected about your usage behavior on our website, we conduct personalized advertising through Facebook Pixel remarketing.

Through Facebook Pixel conversions, we measure your subsequent usage behavior for web analysis and event tracking when you arrive at our website via a Facebook Ads advertisement. Data processing is based on a data processing agreement with Facebook (by Meta).


8. Social Networks

Our Online Presence on Facebook (by Meta) and Instagram (by Meta)

To the extent that you have granted your consent for this pursuant to Art. 6, Paragraph 1, S. 1, letter a of the GDPR to the respective social network operator, your data will be automatically collected and stored for market research and advertising purposes when you visit our online presences on the aforementioned social networks. Based on this data, pseudonymous usage profiles will be created. These profiles can be used, for example, to display ads within and outside the platforms that presumably match your interests. For this purpose, cookies are usually used. For detailed information on processing and use of data by the respective social network operator, as well as how to contact and your rights and options for protecting your privacy, please refer to the linked privacy policies of the providers below. If you need assistance with this, feel free to contact us.

Facebook (by Meta) is an offering from Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ("Meta Platforms Ireland"). The information automatically collected by Meta Platforms Ireland about your use of our online presence on Facebook (by Meta) is generally transferred to a server of Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA, and stored there. For the USA, there is no adequacy decision by the European Commission. Our cooperation with them is based on standard contractual clauses for data protection of the European Commission. Data processing in the context of visiting a Facebook (by Meta) fan page is based on an agreement between joint controllers in accordance with Art. 26 of the GDPR. You can find more information (insights data information) here.

Instagram (by Meta) is an offering from Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ("Meta Platforms Ireland"). The information automatically collected by Meta Platforms Ireland about your use of our online presence on Instagram is generally transferred to a server of Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA, and stored there. For the USA, there is no adequacy decision by the European Commission. Our cooperation with them is based on standard contractual clauses for data protection of the European Commission. Data processing in the context of visiting an Instagram (by Meta) fan page is based on an agreement between joint controllers in accordance with Art. 26 of the GDPR. You can find more information (insights data information) here.


9. Contact Options and Your Rights

Your Rights

As a data subject, you have the following rights:

  • According to Art. 15 of the GDPR, the right to obtain information about the personal data we have processed about you to the extent indicated therein;

  • According to Art. 16 of the GDPR, the right to request the immediate correction of incorrect or incomplete personal data we have stored about you;

  • According to Art. 17 of the GDPR, the right to request the deletion of personal data stored about you, provided that further processing is not required

    • to exercise the right to freedom of expression and information;

    • to comply with a legal obligation;

    • for reasons of public interest or

    • for the establishment, exercise, or defense of legal claims;

  • According to Art. 18 of the GDPR, the right to request the restriction of the processing of your personal data to the extent that

    • the accuracy of the data is contested by you;

    • the processing is unlawful, but you oppose the deletion of the data;

    • we no longer need the data, but you need it to exercise, defend, or establish legal claims, or

    • you have objected to the processing pursuant to Art. 21 of the GDPR;

  • According to Art. 20 of the GDPR, the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request the transmission of such data to another controller;

  • According to Art. 77 of the GDPR, the right to lodge a complaint with a supervisory authority. Typically, you can do so with the supervisory authority in your habitual residence, place of work, or our headquarters.


Right to Object

To the extent that we process personal data to protect our overriding legitimate interests in the context of a balancing of interests, as explained above, you have the right to object to such processing for the future. If processing is carried out for direct marketing purposes, you can exercise this right at any time, as described above. If processing is carried out for other purposes, you will only have the right to object if there are reasons arising from your particular situation.

After exercising your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.

This does not apply if processing is carried out for direct marketing purposes. In that case, we will no longer process your personal data for this purpose.


10. Contact

For inquiries regarding the collection, processing, or use of your personal data, for information, correction, restriction, or deletion of data, as well as to revoke consent granted or object to a specific use of data, please contact us directly using the contact details in our legal notice.

Data Protection Officer:

Lupura Superfood
Gran Via de les Cortes Catalanes 613
08007 Barcelona, Spain
Email: info@lupura.de