The protection of your personal data matters to us. In this privacy policy we explain which personal data we process when you use our online shop, for what purposes this happens and what rights you have.

1. Controller

The controller for the processing of personal data is:

Chevaux Nature
Owner Catherine Sack
Langenhegen 10b
22609 Hamburg
Germany

E-mail: info@chevaux-nature.com

2. Legal bases for processing

We process personal data only where there is a legal basis for doing so.

Depending on the purpose, processing is based in particular on:

• Art. 6 Abs. 1 lit. a DSGVO – where you have given us your consent.
• Art. 6 Abs. 1 lit. b DSGVO – where processing is necessary for a contract or for pre-contractual measures.
• Art. 6 Abs. 1 lit. c DSGVO – where we are legally obliged to process the data.
• Art. 6 Abs. 1 lit. f DSGVO – where processing is necessary to safeguard our legitimate interests or those of a third party and your interests or fundamental rights do not override them.

3. Shopify & Shopify Network Intelligence

Our online shop runs on the e-commerce platform Shopify. For merchants established in Europe, Shopify International Limited, based in Ireland, is generally the competent Shopify entity.

Shopify processes personal data when you visit our shop, use a customer account, fill in forms or place an order. This may include in particular your IP address, device and browser information, usage data, contact details, order data and transaction information.

Shopify Network Intelligence is activated in our shop. Shopify may process data from your interaction with our shop together with information from your interactions with Shopify and other Shopify merchants in order to provide so-called Enhanced Services.

These services can, among other things, help to provide you with a more personalised shopping experience, improve Shopify services and their security, understand how customers interact with shops and advertising and – where you have consented to this – deliver more relevant advertising.

Information about your activities in our shop may be passed on to Shopify and to other service providers used by Shopify for this purpose. These may also be located outside the European Economic Area.

For visitors from the European Economic Area, the United Kingdom and Switzerland, Shopify takes into account the consent decisions made via our privacy settings for non-essential processing.

You can change or withdraw consent you have given at any time with effect for the future via our privacy settings.

Further information can be found in the Shopify consumer privacy policy.

Via the Shopify privacy portal you can obtain information about your rights towards Shopify and submit corresponding privacy requests.

4. Visiting our website & cookies

When you access our shop, the following technically necessary data in particular may be processed:

• IP address
• date and time of access
• browser and operating system
• device information
• pages and products accessed
• referrer URL
• technical log and security data

This processing serves in particular to provide our online shop securely and in working order, to analyse errors and to protect against misuse.

Our website also uses cookies and comparable technologies. Technically necessary technologies may be used where they are required to provide a function you have expressly requested.

Where consent is required for storing information on your device or accessing information already stored there, this is done on the basis of § 25 (1) TDDDG. Strictly necessary access may take place under the conditions of § 25 (2) TDDDG.

Where personal data is subsequently processed through the use of such technologies, the legal basis follows from Art. 6 GDPR.

We use non-essential analysis, marketing and personalisation technologies only where the legal requirements are met and, where necessary, you have consented in advance.

You can change your choice at any time for the future via our privacy settings.

5. Orders & contract processing

When you place an order, we process in particular:

• name
• billing and delivery address
• e-mail address
• telephone number where applicable
• items and product variants ordered
• order and transaction information
• payment and shipping method chosen

Processing serves to carry out your order, process payment, deliver, communicate about your order, handle returns and complaints and fulfil legal obligations.

The legal basis is in particular Art. 6 (1) (b) GDPR and, where applicable, Art. 6 (1) (c) GDPR.

6. Customer account

You can use a customer account for our shop. In doing so we process the data required to provide and manage your account.

This may include in particular your contact details, saved addresses, orders and further account information.

Processing takes place in particular on the basis of Art. 6 (1) (b) GDPR.

7. Payment processing

Depending on your country and the payment method chosen at checkout, various payment service providers may be used. These may include in particular:

• Shopify Payments
• Shop Pay
• credit card providers
• PayPal
• Klarna
• Apple Pay
• Google Pay
• iDEAL
• Bancontact

The data required for payment processing is transmitted to the respective payment service provider.

This may include in particular name, billing address, e-mail address, order value, transaction information and payment information.

Full credit card details are generally processed directly by the respective payment service provider and are not stored by us.

The legal basis is in particular Art. 6 (1) (b) GDPR.

8. Shipping service providers

To deliver your order we transmit the data required for shipping to our shipping service providers, in particular DHL or DHL Express.

This may include in particular name, delivery address, order information and – where necessary – e-mail address or telephone number.

Processing takes place in particular to fulfil your purchase contract under Art. 6 (1) (b) GDPR.

9. Contact & B2B enquiries

If you contact us by e-mail, contact form or via our B2B registration form, we process the information you send us in order to handle your enquiry.

In the case of a B2B enquiry this may include in particular your name, contact details, company or business information and other details you provide voluntarily.

To provide forms we use, among other things, functions of Shopify Forms.

If your enquiry relates to an existing or possible contract, processing takes place in particular on the basis of Art. 6 (1) (b) GDPR. Other business enquiries may be processed on the basis of our legitimate interest in handling them under Art. 6 (1) (f) GDPR.

How we handle messages via WhatsApp is explained in the section “Contact via WhatsApp”.

10. Newsletter

If you sign up for our newsletter, we use your e-mail address to inform you about news, products and offers from Chevaux Nature.

Processing takes place on the basis of your consent under Art. 6 (1) (a) GDPR.

You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in every newsletter e-mail.

Shopify functions and services may be used to manage newsletter sign-ups and to send the newsletter.

11. Google Analytics

Where you have consented to this, we use Google Analytics to evaluate the use of our online shop statistically and to improve our offering.

This may involve processing information about your device, your browser, pages visited, interactions, technical identifiers and approximate location information.

For users in the European Economic Area the provider is generally Google Ireland Limited.

Google Analytics is used for non-essential analysis purposes only where the required consent has been given.

You can withdraw that consent at any time with effect for the future via our privacy settings.

In connection with the use of Google services, personal data may be processed outside the European Economic Area, in particular in the USA.

12. Product reviews with Judge.me

We use Judge.me to display, collect and manage product reviews. The provider is Judge.me Ltd.

When you submit a review, we may process in particular your name or chosen display name, your e-mail address, the rating, your review text, any content you upload and information about the product reviewed and the associated order.

Judge.me generally processes the personal data of buyers and reviewers that we provide within the review functions on our behalf as a processor.

Depending on the functions we have activated, Judge.me may in particular provide services for displaying reviews, verifying purchases and sending review requests.

Where review requests are sent by e-mail, this only happens where the necessary legal requirements are met.

Judge.me uses further sub-processors and technical service providers to provide its services. This may also involve processing personal data outside the European Economic Area.

Further information can be found in the Judge.me privacy policy.

13. Private Shopping & appointment booking

For online booking of appointments for our Private Shopping we use the external appointment booking service Setmore.

When you book an appointment, we may process in particular your name, your contact details, appointment details and other information you enter.

Processing takes place in particular to carry out pre-contractual measures or to organise the appointment you have requested under Art. 6 (1) (b) GDPR.

In connection with the use of this service, personal data may be processed outside the European Economic Area, in particular in the USA.

14. Contact via WhatsApp

You can write to us on WhatsApp. For this, our pages have a WhatsApp icon that opens a chat with us in WhatsApp. Some pages may also have links that do the same, for example a button on the product page. We are responsible for processing your messages (see section 1).

For users in Europe, WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a company of the Meta group. According to WhatsApp, this means the European Economic Area and some other countries, including Switzerland, but not the United Kingdom. We use the WhatsApp Business app.

When you write to us, we process in particular:

• your phone number
• your WhatsApp profile name and, depending on your settings, your profile picture
• the content of your messages
• photos, videos, voice messages and files you send us, for example photos or measurements of your horse
• the date and time of your messages

We use this data to answer your enquiry, to advise you, for example on size, fit or embroidery, and, at your request, to prepare an order. Catherine answers your messages personally.

If your enquiry relates to an existing or possible contract, the legal basis is Art. 6 Abs. 1 lit. b DSGVO. We process other enquiries on the basis of our legitimate interest in answering you through the channel you have chosen yourself (Art. 6 Abs. 1 lit. f DSGVO).

Our server: A server is also linked to our WhatsApp account, like an additional device. It is located with the person who looks after the technical side for us, is operated by that person on our behalf and is not itself a cloud service. It stores, in encrypted form, the messages you write to us and our messages to you, including photos, videos, voice messages and files, and does so from the day on which we linked it. It can also store older messages that WhatsApp delivers from the chat history during linking. So that our AI assistant (more on this in the next paragraph) can also read voice messages, they are automatically transcribed into text, likewise on a device belonging to this person and not via a cloud service.

An AI assistant reads along: An AI assistant accesses the messages on this server and reads them alongside us, including photos and the transcripts of voice messages. This is an AI model that we operate ourselves (more on this below). The AI assistant helps us make sure that no enquiry gets lost and prepares measurements and orders for us. Catherine writes the replies to you herself. The AI assistant does not write to you: it cannot send messages via our WhatsApp account. Nor does it decide anything about you. Catherine decides what we reply to you and what we offer you. No automated decision within the meaning of Art. 22 DSGVO takes place. On our side, only Catherine and this person have access to the server and to what the AI assistant produces from it.

We base the storage on the server, the transcription of voice messages and the reading of messages by the AI assistant on our legitimate interest in handling every enquiry reliably, completely and swiftly (Art. 6 Abs. 1 lit. f DSGVO). You can object to this at any time, for example with a short message. We will then exclude your chat from storage on the server and from being read by the AI assistant. In addition, we will delete, within one month at the latest, what the server has already stored from your chat, as well as our conversations with the AI assistant that contain your messages. Your number then remains stored as an exception in the settings of the server for as long as we use the server, so that we can respect your objection (Art. 6 Abs. 1 lit. c DSGVO).

Where the AI assistant runs: The AI assistant runs on a device belonging to the person who looks after the technical side for us, and not on a cloud service. For this purpose, your messages are not sent to any other provider, not even to a provider of AI services, and they are not used to train AI models.

Contacting us via WhatsApp is voluntary. If you do not want to use WhatsApp, you can reach us just as well by email at info@chevaux-nature.com.

In the WhatsApp app, we delete every chat, including photos, videos and files, no later than six months after the last message. Where messages with which we prepare, conclude or carry out an order must be retained as commercial or business letters (§ 257 HGB, § 147 AO), we first save them as an export outside WhatsApp. We keep this export for six years from the end of the calendar year in which we received or sent the message, and then delete it (Art. 6 Abs. 1 lit. c DSGVO). We only include photos and videos in the export if they form part of the agreement. Anything we agree for an order, such as measurements, colour or embroidery, we also note in the order. The periods set out in the section “Storage period” apply to it. You can delete the chat on your own device in WhatsApp yourself.

On our server, separate periods apply. As a rule, it keeps messages longer than the app, so that we can still match follow-up questions about a made-to-measure rug we have sewn for you, even after a season: it automatically deletes every message, including the transcript of a voice message, 365 days after its date. It deletes photos, videos, voice messages and files as early as 90 days after it has stored them. Notifications to the AI assistant about a new message contain its text and are deleted after no more than 7 days. If you ask us to, we will delete, within one month at the latest, your chat on the server and our conversations with the AI assistant in which it appears. For security purposes, the server also keeps a log of when messages were received and sent in which chat, and who accessed which chat when, so that we can detect misuse (Art. 6 Abs. 1 lit. f DSGVO). The log does not contain any message content, but it does contain the identifier of your chat, usually your phone number. We delete entries about access after 90 days, and entries about changes to the settings after no more than 730 days. Encrypted backup copies of the server are kept on two further devices belonging to this person. Deleted messages only disappear from them once the respective backup is overwritten.

Conversations with the AI assistant: What the AI assistant reads and produces from it is then also contained in our conversations with it, on the device on which it runs. We delete these conversations no later than 90 days after they began. From your messages, we only transfer to other records what we need for your order.

We only send you advertising and newsletters via WhatsApp if you have given your express consent in advance (Art. 6 Abs. 1 lit. a DSGVO, § 7 Abs. 2 Nr. 2 UWG). You will only receive a price quote if you ask for one. You can withdraw your consent at any time with effect for the future, for example with a short message.

What WhatsApp itself processes: According to WhatsApp, messages in WhatsApp are end-to-end encrypted. WhatsApp therefore generally cannot read their content. Exceptions: if a chat is reported to WhatsApp, WhatsApp receives its most recent messages. And WhatsApp can receive a text that is already contained in a link when the link is opened (see below). However, end-to-end encryption does not mean that only Catherine reads your messages: they are decrypted on the devices with which we use WhatsApp, and these include our server. What happens to them after that, including being read by the AI assistant, is set out above.

WhatsApp also processes data of its own, for example your phone number, device and connection information such as your IP address, and the time and frequency of use, and may share it with other companies of the Meta group. WhatsApp itself is responsible for your own use of WhatsApp. The WhatsApp Terms of Service, which you accepted when setting up WhatsApp, and the WhatsApp Privacy Policy apply. By contrast, WhatsApp processes the phone numbers of people who write to us via WhatsApp on our behalf (as a processor), so that we can reply to them.

When WhatsApp is used, data is also transferred to countries outside the European Economic Area, in particular to WhatsApp LLC and Meta Platforms, Inc. in the USA. Both are certified under the EU-US Data Privacy Framework. The basis is a decision of the European Commission of 10 July 2023, according to which certified US companies ensure an adequate level of data protection. For data from Switzerland, both are also certified under the Swiss-US Data Privacy Framework, which the Swiss Federal Council recognised with effect from 15 September 2024. According to WhatsApp, data is also transferred to other countries, such as the United Kingdom, Singapore and Israel. For this, WhatsApp relies on standard contractual clauses of the European Commission and, for Israel, on an adequacy decision.

The WhatsApp icon and the links on our pages: Nothing is transferred to WhatsApp when you visit our pages. Only when you click the icon or a WhatsApp link does WhatsApp open, in the app or in your browser. WhatsApp may then receive your IP address, information about your browser and the address of our website. From that moment on, the WhatsApp Terms of Service and the WhatsApp Privacy Policy apply. We offer the icon and the links on the basis of our legitimate interest in giving you an easy way to reach us (Art. 6 Abs. 1 lit. f DSGVO).

The links already contain a short text for your first message, for example “Hello Catherine, I have a question.” On a product page, it also names the product. Where you can enter measurements and a note on fit on a product page, it may also contain these. If you reach one of our pages through one of our ads, a small script on that page adds “(A)” to the text. To do this, it reads the address of the page on which you arrive in your browser, regardless of what you chose in the cookie banner. This shows us that you found us through an ad and helps us judge whether our ads are worthwhile (Art. 6 Abs. 1 lit. f DSGVO). The “(A)” contains no identifier by which you or your device could be recognised. We do not store anything in your browser for this.

This text is part of the link address. WhatsApp can therefore receive it, including the “(A)”, as soon as the link is opened, encrypted in transit but not end-to-end. It may also be saved in your browser history. In WhatsApp you can change or delete it before sending, including the “(A)”.

Your rights, including your right to object to processing based on legitimate interests, are set out in the section “Your rights”. You can also exercise your rights against WhatsApp directly with WhatsApp.

You can find further information in the WhatsApp Privacy Policy.

15. Recipients & international data transfers

We pass on personal data only where this is necessary to provide our shop, to perform the contract, because of a legal obligation or on the basis of another legal ground.

Recipients may in particular be:

• Shopify and service providers used by Shopify
• payment service providers
• shipping and logistics providers
• IT and hosting providers
• analysis and marketing providers
• Judge.me
• appointment booking providers
• WhatsApp (WhatsApp Ireland Limited, Meta group)
• professional advisers, where necessary
• authorities, where a legal obligation exists

Some service providers may process personal data outside the European Economic Area.

Where this is required under data protection law, such transfers take place on the basis of an adequacy decision of the European Commission or using appropriate safeguards, for example standard contractual clauses.

16. Storage period

We generally store personal data only for as long as it is required for the respective processing purpose or as long as statutory retention obligations exist.

We keep order, invoice, contract and accounting records in accordance with the applicable commercial and tax retention periods.

Data from general enquiries is deleted once the communication has been concluded and there are no legal or legitimate reasons for further storage.

Different rules apply to WhatsApp: we delete chats in the WhatsApp app no later than six months after the last message. Our server deletes messages 365 days after their date, and photos, videos, voice messages and files after 90 days. We delete conversations with the AI assistant no later than 90 days after they began. Messages relating to an order that must be retained as commercial or business letters are kept as an export outside WhatsApp for six years from the end of the calendar year (see section “Contact via WhatsApp”).

We generally store newsletter data until you withdraw your consent, unless statutory evidence or retention obligations prevent deletion.

17. Your rights

Where the legal requirements are met, you have in particular the following rights:

• right of access
• right to rectification
• right to erasure
• right to restriction of processing
• right to data portability
• right to object
• right to withdraw consent given

Your right to object (Art. 21 DSGVO): Where we process your data on the basis of legitimate interests (Art. 6 Abs. 1 lit. f DSGVO), you can object to this at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where we use your data for direct marketing, you can object to this at any time without giving reasons. We will then no longer use it for this purpose. An informal message is sufficient for an objection, for example an email to info@chevaux-nature.com.

You can withdraw consent at any time with effect for the future. The lawfulness of processing carried out up to the withdrawal remains unaffected.

To exercise your rights you can contact us at info@chevaux-nature.com .

18. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection law.

The supervisory authority responsible for our place of business is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany

19. Changes to this privacy policy

We update this privacy policy when our data processing, the services we use or the legal framework change.

Version: October 2026