Legal Information
Privacy Policy
⚠️ Draft version – please have this privacy policy reviewed by a legal professional (e.g. via eRecht24) before the official launch.
1. Controller
The controller responsible for data processing on this website within the meaning of the GDPR is:
BloomCraft Organics
Johann-Aubele-Straße 6, 86668 Karlshuld, Germany
Email: [email protected]
2. Hosting
Our website is hosted by DigitalOcean. Server log files (browser type, operating system, referrer URL, hostname, date and time of the request) are automatically recorded to ensure secure and stable operation, on the basis of our legitimate interest (Art. 6 (1) (f) GDPR).
3. Your rights
You have the following rights regarding your personal data:
- Right of access
- Right to rectification or erasure
- Right to restriction of processing
- Right to object to processing
- Right to data portability
To exercise your rights, please contact us at [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority.
4. Cookies
Our website uses cookies. Technically necessary cookies (session, CSRF, shopping cart) are set without consent on the basis of Art. 6 (1) (f) GDPR. Marketing cookies are only activated after your explicit consent (Art. 6 (1) (a) GDPR). You can change your cookie settings at any time via the link in the footer.
5. Contact form
If you contact us via our contact form, the data you provide (including your contact details) will be stored by us for the purpose of processing your request and in case of follow-up questions, based on your consent (Art. 6 (1) (a) GDPR). We do not pass this data on without your consent.
6. Customer account & registration
If you create a customer account, we process the data you provide (name, address, email) to manage your account and process your orders (Art. 6 (1) (b) GDPR). You may optionally register or log in using your Google account; in this case, Google transmits the data you have approved (typically name and email address) to us.
7. Orders & payment processing
To process your order, we transmit the data required for payment (order amount, order reference) to our payment provider Mollie B.V. (Amsterdam, Netherlands), based on the performance of our contract with you (Art. 6 (1) (b) GDPR). Mollie processes this data as an independent controller under its own privacy policy.
8. Newsletter
If you subscribe to our newsletter, we use the double opt-in procedure: after signing up, you will receive a confirmation email, and only after confirming will your address be added to our subscriber list. We use Brevo (Sendinblue SAS, France, EU servers) as our newsletter service provider. Processing is based on your consent (Art. 6 (1) (a) GDPR); you can unsubscribe at any time via the link in every newsletter.
9. Visitor statistics & online marketing
Visitor statistics with Plausible Analytics
To understand how our shop and our Academy are used, for example which pages are visited and which campaign brought visitors to us, we use Plausible Analytics. The provider is Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia, which processes the data on our behalf (processor). The measurement runs through our server. No script is loaded in your browser for this, and nothing is stored in or read from it.
We process the page you visit, the page you came from, the campaign name from the address you opened (for example “youtube-stadt”), your browser and operating system, your device class (phone, tablet or computer), and your approximate country or region, derived from your IP address. Our server derives the device class from the browser identifier (user agent) that your browser sends with every request anyway. We remove ad click identifiers, such as Google's gclid, from the address before it goes to Plausible. On the Academy card pages, our server also counts that a card was opened and whether you moved on from there to the next card, each time with the course, lesson and campaign name, and for “moved on” also which card you came from.
Your IP address and the full browser identifier are not stored. To count how many different visitors there were, a hash (a value that cannot be reversed) is created from both together with a random value that changes daily. The random value is deleted after 24 hours. This makes it impossible to recognise you across several days or across other websites. We only ever see aggregated statistics.
The legal basis is our legitimate interest in privacy-friendly audience measurement that helps us improve our offering (Art. 6 (1) (f) GDPR). The data is processed exclusively within the EU. You can object to this processing at any time (Art. 21 GDPR), for example by email to [email protected] or via the “Opt out of statistics” link at the bottom of every page.
Statistics details (only with your consent)
If you switch on the “Statistics details” category in the cookie settings, a small script also runs in your browser. Through Plausible, it tells us how wide your screen is and, on the Academy card pages, whether you read a card. A card counts as read if it was open and visible for at least 20 seconds or you got halfway through it. The script sets no cookies and stores no data in your browser. It only checks whether an exclusion marker is set there, which we use to leave our own visits out of the count. This information helps us improve our content. Here too, counting uses the daily changing hash, so we cannot recognise you. We only see aggregated statistics, and the data is processed exclusively within the EU.
The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). The category stays switched off until you switch it on yourself, and without your consent the script is not loaded. You can withdraw your consent at any time via the “Cookie Settings” link at the bottom of every page.
Online marketing with Google, Meta and TikTok
With your separate consent, we may load marketing pixels from Meta, Google and/or TikTok to measure and improve advertising campaigns. These providers may process data on servers outside the EU (e.g. in the USA); in such cases, we rely on the providers' EU Standard Contractual Clauses. You can withdraw your consent for statistics details and marketing at any time, together or separately, via the “Cookie Settings” link at the bottom of every page.
10. Photo consultation ("Bildberatung")
If you submit a case via our photo consultation (Academy), we process the photos and description you provide, plus your name, email address and phone number if you choose to share them, in order to give you a personal assessment (Art. 6 (1) (a) GDPR – your consent). Submitting anonymously, without any contact details, is possible; in that case we can only show you the reply via your personal access link, not send it by email. Uploaded photos are automatically stripped of location and camera metadata on upload. Three years after a case is closed, we automatically anonymize it: name, email, phone number, your description and the full message thread are removed. The structured evaluation data (diagnosis tags, outcome, summary, recommended products, photos) is kept beyond that point for anonymous internal evaluation, as it no longer relates to an identifiable person. If you separately and explicitly consent to it, individual cases may also be used as anonymized teaching material beyond this internal evaluation; this requires a distinct opt-in and is off by default.
11. Storage period
We store personal data only for as long as necessary for the purposes described above or as required by statutory retention obligations (e.g. tax and commercial law retention periods for invoices). Content you delete yourself (e.g. grow diary photos, review photos, profile pictures) is removed from our file storage immediately. Technical database backups are automatically overwritten after seven days.