Privacy policy

Unless otherwise stated below, providing personal data is neither required by law or contract nor necessary to enter into a contract. “Personal data” means any information relating to an identified or identifiable natural person.

Server log files

You may visit our website without actively providing personal information. Each access may generate server log data such as the page requested, date and time, IP address, amount of data transferred and requesting provider. Processing is based on Art. 6(1)(f) GDPR for secure, reliable website operation and improvement. Data may be processed outside the EU, including Canada and the USA, in connection with Shopify; appropriate transfer safeguards apply as described in the German source policy.

Controller

Kombuchery GmbH, Torstraße 105-107, 10119 Berlin, Germany, +49 175 457926, imprint@kombuchery.de.

Contact by email and contact form

We process the name, email address and message content you provide to answer enquiries. Where the enquiry concerns pre-contractual measures or an existing contract, Art. 6(1)(b) GDPR applies; otherwise processing is based on Art. 6(1)(f) GDPR. Data is deleted subject to statutory retention periods unless further processing has been consented to.

Withdrawal and cancellation buttons

Where statutory withdrawal or cancellation functions are provided, we process the information entered to identify and process the relevant contract and declaration. Processing is based on Art. 6(1)(b) and/or Art. 6(1)(c) GDPR and, where applicable, Art. 6(1)(f) GDPR for a user-friendly implementation.

Google Maps API address validation

We use Google Ireland Limited for real-time validation and correction of address entries. Address data and, where applicable, email address and telephone number may be transmitted to Google. Processing is based on Art. 6(1)(f) GDPR for accurate contractual data. Transfers to the USA may occur; Google participates in the EU-US Data Privacy Framework.

Applications

Application data may include contact details, qualifications, education, training and supporting documents. Processing is carried out for recruitment under Art. 6(1)(b) GDPR in conjunction with Section 26 BDSG; applicant-pool processing is based on consent. Application data is generally deleted no later than six months after the decision unless further retention is permitted or agreed.

WhatsApp Business

If you contact us through WhatsApp Business, we process your mobile number, name if provided and the content you send to handle your request. Depending on context, Art. 6(1)(b) or Art. 6(1)(f) GDPR applies. WhatsApp/Meta may process data in the USA.

Customer account and orders

For customer accounts and order processing we process the data required to provide the account, fulfil orders and answer related requests. Order data may be shared with shipping, fulfilment, payment, order-processing and IT providers to the minimum extent necessary. Contract processing is based on Art. 6(1)(b) GDPR.

REVIEWS.io

We use REVIEWS.io Limited, 29 St Nicholas Place, Leicester, LE1 4LD, United Kingdom, to collect, manage and display customer reviews. Depending on the workflow, data may include name, email address, purchase/order information, review content and technical information. Processing is based, as applicable, on consent under Art. 6(1)(a) GDPR or our legitimate interest under Art. 6(1)(f) GDPR in authentic customer feedback and quality assurance.

Direct marketing

We may use postal address data for postal advertising and an email address obtained in connection with a sale for advertising our own similar products or services, where legally permitted and unless you object. Direct marketing is based on Art. 6(1)(f) GDPR. Consent-based SMS marketing and stock-availability notifications are processed under Art. 6(1)(a) GDPR.

Klaviyo

We use Klaviyo Inc. for newsletter delivery and statistical evaluation. Newsletter interactions may be measured through tracking pixels and links. Data may be processed in the USA. The German source policy states that Klaviyo participates in the EU-US Data Privacy Framework.

Shipping and ERP

With consent, an email address may be provided to the carrier for shipment-status notifications. We use weclapp GmbH as an external ERP system for contract processing under Art. 6(1)(b) GDPR.

Payment services

We use PayPal Express, PayPal Checkout and Shopify Payments. Payment data required for the selected payment method is transmitted to the relevant provider. Certain payment methods may involve creditworthiness checks. Shopify Payments is processed via Stripe Payments Europe Ltd. Details and legal bases correspond to the payment-service sections of the German source policy.

Cookies and Shopify Privacy & Compliance

Technically necessary cookies are used under Section 25(2) TDDDG and Art. 6(1)(f) GDPR. Shopify Privacy & Compliance is used to obtain and document consent and to enable withdrawal of consent; this processing serves compliance with legal obligations under Art. 6(1)(c) GDPR.

Google Analytics 4

We use Google Analytics 4 for website, visitor, marketing and advertising analysis. With consent, information such as IP-derived location, page views, click paths, device/browser data, referrer, location and purchase activity may be processed. Google Signals and Advanced Consent Mode are used as described in the German source policy. Consent is the basis under Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

Hotjar

Hotjar is used for website optimisation and analysis, including sampled heatmaps and interaction recordings. Data may include anonymised IP information, device/browser information, country-level location, language, operating system, scrolling, clicks and dwell time. Use is consent-based.

Shopify analytics

Shopify analytics functions process device, browser, IP, timezone, cookie, page/product, referrer and interaction information for marketing and optimisation reports. Use of non-essential technologies is consent-based.

Triple Whale Pixel

We use Triple Whale Inc., 266 N 5th Street, Columbus, OH 43215, USA, for analytics, attribution and marketing reporting. The Triple Whale Pixel or comparable technologies may process device and cookie IDs, log data, IP address, cookie data, visits, interactions, orders and other conversion events and combine these with connected shop and marketing-system data. Non-essential tracking is used only with consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Triple Whale states that it uses EU Standard Contractual Clauses for relevant transfers to countries without an adequacy decision.

Microsoft Clarity

Microsoft Clarity is used for website optimisation and analysis, including heatmaps and interaction recordings. Processing may include IP address, access time, click path, device/browser identifiers, location, language, pages visited and dwell time. Use is consent-based.

Meta Pixel

The Meta Pixel is used for interest-based advertising, remarketing and conversion statistics on Facebook and Instagram. Meta and Kombuchery have joint-controller responsibilities for collection and transmission as described in the German source policy. Use is consent-based.

Google Ads Conversion Tracking

Google Ads conversion tracking measures actions after ad interactions. Advanced Consent Mode is used as described in the German source policy. Non-essential technologies and personal-data processing are based on consent.

Microsoft Advertising, Pinterest Tag, TikTok Pixel and Criteo

These advertising technologies are used for conversion measurement, audience targeting and/or personalised advertising. Depending on the service, identifiers, IP address, browser/device data, referrer, visited pages, cart and transaction information may be processed. Use is consent-based; international transfers and safeguards are described in the German source policy.

Affiliate programmes: ADCELL, Amazon PartnerNet and Awin

Affiliate technologies are used to attribute transactions to advertising partners and correctly calculate commissions. Cookies, pixels and, in Awin's case, fingerprinting may be used as described in the German source policy. Use is consent-based.

ChatGPT-based chat system

We use a ChatGPT-based system from OpenAI Ireland Limited for automated customer communication, including questions about order status, products and shipment tracking. The source policy states that chat inputs are not used to train OpenAI models and that authentication is performed only using an existing order number and matching postal code. The service may process technical usage data, chat input and generated responses. Use is consent-based as described in the German source policy.

Shopify Network Intelligence

Shopify Network Intelligence is used for security, fraud detection and shop-performance optimisation. The source policy describes monitoring of network access and user behaviour and possible processing in Canada. Use of cookies/comparable technologies and personal-data processing is consent-based in the source text.

Google Tag Manager

Google Tag Manager manages JavaScript and HTML tags used to implement analytics and tracking tools. The source policy states that the Tag Manager itself does not store cookies or process personal data, but can trigger other tags that do.

Google reCAPTCHA and invisible reCAPTCHA

Google reCAPTCHA services are used to distinguish human input from automated access. IP address and other technical data required by Google may be transmitted to Google, including to the USA. The source policy bases use on consent.

Cloudflare

Cloudflare CDN is used to improve loading times and website delivery. It may process IP addresses, system configuration information and traffic/server-log information. Processing is based on Art. 6(1)(f) GDPR. The source policy states that Cloudflare participates in the EU-US Data Privacy Framework.

Google Maps and OpenStreetMap

Embedded mapping services may process IP address, browser/device information and map interaction data. The source policy bases these integrations on consent. OpenStreetMap data may be transferred to the United Kingdom, for which an EU adequacy decision is referenced.

YouTube

Embedded YouTube videos use enhanced privacy mode. According to the source policy, information is transmitted to YouTube when a video is played. Use is consent-based.

Google Fonts

The source policy states that Google Fonts are loaded from Google servers and may process IP address and browser information. Use is consent-based.

Retention and data-subject rights

After full contract performance, data is retained for the warranty period and then for applicable statutory tax and commercial retention periods, after which it is deleted unless further processing has been consented to. Subject to legal requirements, you have rights of access, rectification, erasure, restriction and data portability under Arts. 15-20 GDPR and a right to object under Art. 21 GDPR.

Supervisory authority

You may lodge a complaint with a supervisory authority. The source policy names the Berlin Commissioner for Data Protection and Freedom of Information, Friedrichstr. 219, visitor entrance Puttkamerstr. 16-18 (5th floor), 10969 Berlin, Germany, Tel. +49 30 138890, Fax +49 30 2155050, email mailbox@datenschutz-berlin.de.

Right to object

Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. Where personal data is processed for direct marketing, you may object at any time; the data will then no longer be processed for that purpose.