Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the GDPR is:
BloomCraft Organics
Johann-Aubele-Straße 6, 86668 Karlshuld, Germany
Email: [email protected]

2. Hosting

Our website is hosted by DigitalOcean. Server log files (browser type, operating system, referrer URL, hostname, date and time of the request) are automatically recorded to ensure secure and stable operation, on the basis of our legitimate interest (Art. 6 (1) (f) GDPR).

3. Your rights

You have the following rights regarding your personal data:

• Right of access
• Right to rectification or erasure
• Right to restriction of processing
• Right to object to processing
• Right to data portability

To exercise your rights, please contact us at [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority.

4. Cookies

Our website uses cookies. Technically necessary cookies (session, CSRF, shopping cart) are set without consent on the basis of Art. 6 (1) (f) GDPR. Analytics and marketing cookies are only activated after your explicit consent (Art. 6 (1) (a) GDPR). You can change your cookie settings at any time via the link in the footer.

5. Contact form

If you contact us via our contact form, the data you provide (including your contact details) will be stored by us for the purpose of processing your request and in case of follow-up questions, based on your consent (Art. 6 (1) (a) GDPR). We do not pass this data on without your consent.

6. Customer account & registration

If you create a customer account, we process the data you provide (name, address, email) to manage your account and process your orders (Art. 6 (1) (b) GDPR). You may optionally register or log in using your Google account; in this case, Google transmits the data you have approved (typically name and email address) to us.

7. Orders & payment processing

To process your order, we transmit the data required for payment (order amount, order reference) to our payment provider Mollie B.V. (Amsterdam, Netherlands), based on the performance of our contract with you (Art. 6 (1) (b) GDPR). Mollie processes this data as an independent controller under its own privacy policy.

8. Newsletter

If you subscribe to our newsletter, we use the double opt-in procedure: after signing up, you will receive a confirmation email, and only after confirming will your address be added to our subscriber list. We use Brevo (Sendinblue SAS, France, EU servers) as our newsletter service provider. Processing is based on your consent (Art. 6 (1) (a) GDPR); you can unsubscribe at any time via the link in every newsletter.

9. Web analytics & online marketing

With your consent, we use Plausible Analytics (privacy-friendly, no persistent tracking cookies) to understand how our website is used. With your separate consent, we may also load marketing pixels from Meta, Google and/or TikTok to measure and optimize advertising campaigns. These providers may process data on servers outside the EU (e.g. in the USA); in such cases, we rely on the providers' EU Standard Contractual Clauses. You can withdraw your consent for both analytics and marketing at any time via the cookie settings link in the footer.

10. Photo consultation ("Bildberatung")

If you submit a case via our photo consultation (Academy), we process the photos and description you provide, plus your name, email address and phone number if you choose to share them, in order to give you a personal assessment (Art. 6 (1) (a) GDPR – your consent). Submitting anonymously, without any contact details, is possible; in that case we can only show you the reply via your personal access link, not send it by email. Uploaded photos are automatically stripped of location and camera metadata on upload. Three years after a case is closed, we automatically anonymize it: name, email, phone number, your description and the full message thread are removed. The structured evaluation data (diagnosis tags, outcome, summary, recommended products, photos) is kept beyond that point for anonymous internal evaluation, as it no longer relates to an identifiable person. If you separately and explicitly consent to it, individual cases may also be used as anonymized teaching material beyond this internal evaluation; this requires a distinct opt-in and is off by default.

11. Storage period

We store personal data only for as long as necessary for the purposes described above or as required by statutory retention obligations (e.g. tax and commercial law retention periods for invoices). Content you delete yourself (e.g. grow diary photos, review photos, profile pictures) is removed from our file storage immediately. Technical database backups are automatically overwritten after seven days.