Privacy Policy
Last updated: September 2026
1. Controller within the Meaning of the GDPR
The controller responsible for the processing of personal data within the meaning of Art. 4 No. 7 GDPR is:
NatureWatt GmbH
Bergham 55
83624 Otterfing
Germany
Phone: +49 8027 9085 670
E-mail: office@naturewatt.de
Managing directors authorised to represent the company: Andreas Beckmeier, Christoph Leitgeb
Commercial register: Local Court (Amtsgericht) of Munich, HRB 294612
VAT identification number: DE369559209
1.1 Contact for Data Protection Enquiries
If you have any questions about the processing of your personal data or wish to exercise your rights as a data subject, you can contact:
Christoph Leitgeb
E-mail: office@naturewatt.de
Phone: +49 8027 9085 670
2. General Information on Data Processing
As a matter of principle, we process personal data of our users only to the extent necessary to provide a functioning website and to deliver our content and services. Personal data is regularly processed only with the consent of the data subject, or in cases where obtaining prior consent is not possible for practical reasons and the processing is permitted by law.
Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis. For the processing of personal data required for the performance of a contract or for pre-contractual measures, Art. 6(1)(b) GDPR serves as the legal basis. Where processing is necessary for compliance with a legal obligation, Art. 6(1)(c) GDPR serves as the legal basis. Where processing is necessary for the purposes of a legitimate interest pursued by our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis.
2.1 Provision of Your Data
Where we process data for the performance of a contract or on the basis of statutory requirements, the provision of that data is necessary for the respective purpose; without it, we cannot conclude or perform the contract or process your enquiry. Fields marked as "required" are mandatory for the respective purpose; all other information is voluntary. A statutory obligation to provide data exists only where this is expressly indicated.
3. Provision of the Website and Server Log Files
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:
User's IP address (truncated/anonymised)
Date and time of access
URL accessed and volume of data transferred
Browser type, browser version and language used
Operating system and screen resolution
Referring website (referrer URL)
Access status (HTTP status code)
The data is stored in our system's log files. This data is not stored together with other personal data of the user.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical provision of the website, IT security (in particular the detection and prevention of attacks) and the optimisation of our website.
Retention period: The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Where data is collected for the provision of the website, this is regularly the case after seven days.
3.1 Hosting and Technical Provision of the Website
Our website is provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg ("AWS"). As part of the hosting, AWS processes on our behalf in particular the server log files referred to in Section 3, delivers the website content to the accessing devices and carries out regular data backups. Personal data is processed exclusively on servers within the European Union (Frankfurt am Main and Dublin regions). No transfer to third countries takes place in connection with the hosting.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a technically functional, secure and high-performing website).
Data processing agreement: A data processing agreement pursuant to Art. 28 GDPR is in place with AWS.
4. Cookies and Consent Management
Our website uses cookies and similar technologies (e.g. local storage). Cookies are small text files stored in your browser or on your device.
4.1 Technically Necessary Cookies
Technically necessary cookies are required for our website and its functions (e.g. shopping cart, login area, language settings) to work properly. These cookies are set without your consent.
Legal basis: Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) (strictly necessary storage), Art. 6(1)(f) GDPR (legitimate interest in a functioning website) and/or Art. 6(1)(b) GDPR (performance of a contract).
Retention period: Generally session cookies, which are automatically deleted at the end of the browser session.
4.2 Cookies and Third-Party Content Requiring Consent
For all other cookies and similar technologies, we obtain your express consent via our consent tool. There you can give your consent separately for the categories Statistics (e.g. Google Analytics, see Section 12), Marketing and Comfort functions; technically necessary cookies (see Section 4.1) are always active. You are free to decide whether, and to what extent, you give your consent.
Legal basis: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
You may withdraw or adjust your consent at any time with effect for the future. To do so, open the settings of our consent tool via the "Cookie settings" link at the bottom of the page. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of the consent prior to its withdrawal.
4.3 Management of Your Consents
To obtain and manage your consents, we use the consent management function integrated into our shop system, Shopware. No external service provider is used for this purpose; the consents you give and the time at which they were given are stored, as evidence pursuant to Art. 7(1) GDPR, exclusively in our shop database on the servers we use (see Section 17).
Legal basis: Art. 6(1)(c) GDPR (obligation to demonstrate consent under Art. 7(1) GDPR) and Art. 6(1)(f) GDPR (legitimate interest in legally compliant consent management).
Retention period: Consent data is stored for the duration of the consent and, thereafter, for an appropriate period to defend against possible claims (generally three years after withdrawal or expiry of the consent).
5. Customer Account
You have the option of creating a customer account in our online shop. The data you provide is stored for the purposes of contract performance, simplifying future orders and managing your customer relationship.
Data processed:
Name, address, e-mail address
Telephone number (if provided)
Password (stored in encrypted form)
Order history and delivery addresses
Optional: stored payment details
Legal basis: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures).
Retention period: Your customer account data is stored until you delete the account. You can have your customer account deleted at any time. In the event of prolonged inactivity (generally three years without logging in or placing an order), we review whether continued storage of the data is still necessary and, where appropriate, delete the customer account, unless statutory retention obligations prevent this. Order data is additionally subject to statutory retention periods (see Section 15).
6. Order Processing in the Online Shop
When you place an order in our online shop, we collect and process the following personal data to the extent necessary for the performance of the contract:
First name and surname
Delivery and billing address
E-mail address and telephone number
Order data (items, quantity, price)
Payment data (see Section 7)
For business customers: company name and, where applicable, VAT ID number
Purposes: contract performance, delivery of goods, payment processing, invoicing, customer communication and, where applicable, handling of complaints and warranty claims.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (compliance with retention obligations under tax and commercial law).
7. Payment Service Providers
We offer various payment methods. The data required for payment processing is processed by the payment service provider you select. Where personal data is transferred to payment service providers, this is done on the basis of Art. 6(1)(b) GDPR (performance of a contract).
7.1 Stripe
For the processing of credit card and other online payments, we use the payment service provider Stripe. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe").
If you select a payment method processed via Stripe, the payment data you enter (e.g. cardholder, card number, expiry date, security code) as well as order data and your IP address are transmitted directly to Stripe. We ourselves do not receive complete credit card details.
Third-country transfer: Stripe Payments Europe Ltd. may transfer data to its parent company Stripe, Inc. in the USA. Stripe, Inc. is certified under the EU-US Data Privacy Framework. In addition, EU Standard Contractual Clauses are in place.
Further information: https://stripe.com/en-de/privacy
7.2 PayPal
If you select PayPal as your payment method, payment is processed via PayPal (Europe) S.Ã r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg ("PayPal").
As part of the payment process, your order data, name, address, e-mail address, IP address, telephone number (where applicable) and other data required for payment processing are transmitted to PayPal. The transmission serves the performance of the contract with you and fraud prevention.
Third-country transfer: PayPal may transfer personal data within the PayPal group as well as to credit agencies and service providers, including outside the EU/EEA. Appropriate safeguards are in place (Standard Contractual Clauses).
Further information: https://www.paypal.com/en/legalhub/paypal/privacy-full
7.3 Prepayment / Bank Transfer
If you select prepayment / bank transfer, you will receive our bank details in the order confirmation. We process your name, address, e-mail address and the payment reference visible upon receipt of payment in order to match the payment to your order. Your data is not passed on to third parties for this purpose; it is transmitted exclusively to our bank to the extent necessary to identify the incoming payment.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
8. Shipping Service Providers
To deliver your order, we transmit the data required for delivery (name, address and, where applicable, e-mail address and telephone number for delivery notifications) to the commissioned shipping service provider. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).
8.1 DHL
For shipping we use DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. Where you have consented, we transmit your e-mail address and/or telephone number to DHL for the purpose of coordinating delivery (e.g. shipment tracking, notifications). Further information: https://www.dhl.de/de/privatkunden/footer-bottom/datenschutz.html
8.2 DPD
We also use DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany, as a shipping service provider. Here too, your contact details may be transmitted for the purpose of coordinating delivery. Further information: https://www.dpd.com/de/de/datenschutz/
8.3 trans-o-flex
For certain shipments, in particular temperature-controlled or bulky goods, we use trans-o-flex Express GmbH & Co. KGaA, Hertzstraße 10, 69469 Weinheim, Germany, as a shipping service provider. As part of the delivery, we transmit the data required for delivery to trans-o-flex. Where you have consented, we additionally transmit your e-mail address and/or telephone number for the purpose of coordinating delivery. Further information: https://www.trans-o-flex.com/datenschutz/
8.4 UPS
For international and selected domestic shipments, we use United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany, registered in the commercial register of the Local Court of Neuss under HRA 5119 ("UPS"). We transmit the data required for delivery (name, address and, where applicable, e-mail address and telephone number) to UPS.
UPS's role under data protection law: UPS processes the transmitted shipping data not as our processor but as an independent controller under data protection law. UPS is therefore subject to its own data protection obligations towards data subjects.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Third-country transfer: As part of its intra-group data flows, UPS transfers shipping data to its parent company United Parcel Service, Inc. in the USA (55 Glenlake Parkway NE, Atlanta, Georgia 30328) and to other affiliated companies. UPS bases this transfer on EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914.
Further information: https://www.ups.com/de/en/support/shipping-support/legal-terms-conditions/privacy-notice. Data protection contact: germandpo@ups.com or UPS Europe SA, Ave Ariane 5, 1200 Brussels, Belgium.
9. Contacting Us
When you contact us – via the contact form on our website, by e-mail or by telephone – we process the following personal data to handle your enquiry:
Via the contact form:
Name (required)
E-mail address (required)
Content of your enquiry (required)
Telephone number and, where applicable, order number (voluntary)
When contacting us by e-mail or telephone:
We process your contact details (name, e-mail address, telephone number) and the content of your enquiry to the extent you provide this information to us.
Legal basis: Art. 6(1)(b) GDPR (initiation or performance of a contract), Art. 6(1)(f) GDPR (legitimate interest in responding to other enquiries).
Retention period: We delete the data as soon as the respective conversation has ended and the matter has been conclusively resolved, and at the latest upon expiry of statutory retention periods.
10. Newsletter
On our website you have the option of subscribing to an e-mail newsletter. We use the double opt-in procedure for registration: after signing up, you will receive an e-mail containing a confirmation link. Only after you click this link will we add you to our mailing list.
Data processed:
E-mail address (required)
Title and name (if provided)
Time of registration and confirmation as well as IP address (evidence of consent)
Legal basis: Art. 6(1)(a) GDPR (consent). The logging of registration data serves as evidence of consent pursuant to Art. 7(1) GDPR.
You may withdraw your consent to receive the newsletter at any time with effect for the future by clicking the unsubscribe link in any newsletter e-mail or by sending an e-mail to office@naturewatt.de.
10.1 Dispatch via the Shopware Newsletter Function
We use the newsletter function integrated into our shop system, Shopware, to send our newsletter. Your registration data and evidence of consent are processed in our shop database on our servers (see Section 17). Your data is not passed on to external newsletter service providers.
The technical e-mail dispatch is carried out via the SMTP service Amazon Simple Email Service (Amazon SES) of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, in a region within the European Union (Frankfurt am Main or Dublin). A data processing agreement pursuant to Art. 28 GDPR is in place with Amazon Web Services; no transfer of content or dispatch data to third countries takes place in connection with the newsletter dispatch.
As part of the newsletter dispatch, the performance of our newsletters may be evaluated, in particular whether and when you opened an e-mail and which links you clicked (tracking). For this purpose, the newsletters contain so-called web beacons / tracking pixels and individualised links. This evaluation serves to optimise our newsletter content and is carried out on the basis of your consent (Art. 6(1)(a) GDPR).
11. Advertising to Existing Customers (Direct Marketing)
Where you have purchased goods or services from us, we reserve the right to use the e-mail address provided in the course of your purchase to inform you by e-mail about our own similar goods or services from our range. This direct marketing takes place only insofar as you have not objected to the use of your e-mail address for advertising purposes.
Data processed:
E-mail address
Name
Information about purchased products (to select similar products)
Purpose: direct marketing to existing customers for our own goods or services similar to those previously purchased.
Legal basis: Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act against Unfair Competition (UWG). Our legitimate interest lies in maintaining the customer relationship and advertising our own similar products.
Notice at the time of collection: Already when collecting your e-mail address during the order process, we expressly inform you of the possibility of its later use for advertising purposes and of your right to object. Every individual advertising e-mail also contains a clear and explicit notice of your right to object.
Right to object: You may object to the use of your e-mail address for advertising purposes at any time without incurring any costs other than the transmission costs at basic rates. An objection is possible in particular via the unsubscribe link in every advertising e-mail, by e-mail to office@naturewatt.de or by letter to our postal address stated above.
Retention period: We use your e-mail address for advertising purposes for as long as you have not objected. After an objection, we will immediately remove you from the advertising mailing list and keep you only on a technically necessary suppression list (blocklist) to ensure that no further advertising e-mails are sent to you.
12. Web Analysis with Google Analytics 4
Our website uses – subject to your consent – Google Analytics 4, a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and similar technologies that enable an analysis of your use of the website.
Data collected (selection):
Truncated IP address (truncated automatically by Google Analytics 4)
Pages visited, time spent, click paths and interactions
Device and browser information, approximate location (region)
Time of access and source of access (referrer)
Pseudonymous user ID (client ID)
The information is generally transmitted to and stored on Google servers. In Google Analytics 4, IP addresses are processed in truncated form by default and are not stored in a form that would allow identification; IP addresses are processed by default on servers within the European Union. According to Google, the full IP address is not transferred to third countries.
Legal basis: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent via our consent tool). You may withdraw your consent at any time via the cookie settings.
Third-country transfer: In the course of using Google Analytics, personal data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; in addition, EU Standard Contractual Clauses are in place with Google.
Retention period: User data stored in Google Analytics is automatically deleted after 14 months.
Data processing agreement: A data processing agreement pursuant to Art. 28 GDPR is in place with Google.
Further information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245
13. Google Customer Reviews
On our website we participate in the "Google Customer Reviews" programme of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you consent to this procedure after completing an order, your e-mail address and order data (order number, country and estimated delivery date) are transmitted to Google. After delivery, Google will send you an e-mail asking you to rate your order and our shop.
Legal basis: Art. 6(1)(a) GDPR (consent, which you give directly to Google on the confirmation page).
Third-country transfer: A transfer to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework.
Withdrawal: You may withdraw your consent vis-Ã -vis Google at any time. Further information: https://support.google.com/merchants/answer/7124319
14. Links to Social Networks
In the footer of our website you will find linked icons leading to our profiles on the following platforms:
Instagram – operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Facebook – operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
WhatsApp – operated by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (a group company of Meta Platforms, Inc.)
These are mere links without active plugins or social plugins. No personal data is transmitted by us when you simply visit our website. Only when you actively click on one of these icons are you redirected to the respective external platform, at which point independent data processing by the respective provider begins – over which we have no control.
If you are logged in to the respective platform at the time of the click, the visit may be attributed to your profile there. Even if you do not have an account or are logged out, the platforms may collect data via cookies or similar technologies.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in an appropriate external presentation and in making it easier for interested parties to access our profiles.
Further information: Meta privacy policy (Instagram/Facebook): https://www.facebook.com/about/privacy/ – WhatsApp privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea
Third-country transfer: In the course of data processing by Meta, data may be transferred to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.
15. Retention Periods and Deletion of Data
We store personal data only for as long as is necessary to achieve the respective processing purposes or as required by law. In detail:
Server log files: 7 days
Contact enquiries: until conclusively processed, plus any statutory retention periods
Customer account: until deletion of the account by the user
Accounting records and invoices: 8 years (Section 147(3) of the German Fiscal Code (AO), Section 257(4) of the German Commercial Code (HGB), Section 14b of the German VAT Act (UStG))
Commercial and business letters received and sent: 6 years (Section 257(4) HGB)
Annual financial statements, commercial books, inventories: 10 years (Section 257(4) HGB)
Newsletter consent records: for the duration of the consent and for an appropriate subsequent period to defend against possible claims
Google Analytics: in accordance with the configured retention period (see Section 12)
16. Data Transfers to Third Countries
As part of the processing operations described in this privacy policy, personal data may be transferred to countries outside the European Economic Area (EEA), in particular to the USA (in connection with Google services, Stripe and intra-group data flows at UPS) and, where applicable, to other service providers.
Where data is transferred to third countries without a recognised adequate level of data protection, we ensure that the requirements of Art. 44 et seq. GDPR are met. To this end, we rely on the following safeguards:
Adequacy decisions of the EU Commission, in particular the EU-US Data Privacy Framework for certified US companies (decision of 10 July 2023)
EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914 of the EU Commission
Additional technical and organisational protective measures
We will be happy to provide you with the relevant safeguards upon request.
17. Recipients of Personal Data
As part of the processing activities described above, personal data is disclosed to the following categories of recipients:
IT and hosting service providers (Amazon Web Services EMEA SARL, servers located in the EU)
Payment service providers (Stripe, PayPal, our bank)
Shipping service providers (DHL, DPD, trans-o-flex, UPS – UPS as an independent controller)
SMTP dispatch service provider for e-mail dispatch (see Section 10.1)
Analysis and marketing service providers where consent has been given (see Sections 12, 13)
Tax advisors, auditors and legal advisors within the scope of their professional duty of confidentiality
Authorities and courts, where required by law
Where the aforementioned recipients process personal data on our behalf as processors within the meaning of Art. 28 GDPR, we have concluded corresponding data processing agreements with them. Where recipients – in particular UPS (see Section 8.4) and the payment service providers Stripe and PayPal (see Section 7) – act as independent controllers, their own data protection provisions apply.
18. Your Rights as a Data Subject
If your personal data is processed, you are a data subject within the meaning of the GDPR. You have the following rights vis-Ã -vis us:
Right of access (Art. 15 GDPR) to the data stored about you
Right to rectification (Art. 16 GDPR) of inaccurate or incomplete data
Right to erasure (Art. 17 GDPR), unless statutory retention periods prevent this
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)
Right to object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR)
To exercise your rights, an informal message to the contact details stated in Section 1 is sufficient.
18.1 Right to Object to Direct Marketing
You have the right to object at any time to the processing of your personal data for direct marketing purposes (Art. 21(2) GDPR). If you object, your personal data will no longer be processed for direct marketing purposes.
19. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR).
The supervisory authority responsible for us:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
(Bavarian State Office for Data Protection Supervision)
Promenade 18, 91522 Ansbach, Germany
Phone: +49 981 180093-0
E-mail: poststelle@lda.bayern.de
Website: https://www.lda.bayern.de
20. Data Security
We employ technical and organisational security measures to protect the data we manage against manipulation, loss, destruction and unauthorised access by third parties. Our security measures are continuously adapted in line with technological developments.
In particular, we employ the following measures:
SSL/TLS encryption of the entire website and of data transmission
Encrypted storage of passwords (hashing)
Access restrictions and authorisation concepts for employees
Regular updates of our IT systems
Data processing agreements with service providers
21. Changes to this Privacy Policy
We reserve the right to amend this privacy policy so that it always complies with current legal requirements, or to implement changes to our services in the privacy policy, e.g. when introducing new services. The then-current privacy policy will apply to your next visit. The current version is available on our website at all times.
Last updated: September 2026