The protection of your personal data matters to us. In this privacy policy we explain which personal data we process when you use our online shop, for what purposes this happens and what rights you have.

1. Controller

The controller for the processing of personal data is:

Chevaux Nature
Owner Catherine Sack
Langenhegen 10b
22609 Hamburg
Germany

E-mail: info@chevaux-nature.com

2. Legal bases for processing

We process personal data only where there is a legal basis for doing so.

Depending on the purpose, processing is based in particular on:

• Art. 6 Abs. 1 lit. a DSGVO – where you have given us your consent.
• Art. 6 Abs. 1 lit. b DSGVO – where processing is necessary for a contract or for pre-contractual measures.
• Art. 6 Abs. 1 lit. c DSGVO – where we are legally obliged to process the data.
• Art. 6 Abs. 1 lit. f DSGVO – where processing is necessary to safeguard our legitimate interests or those of a third party and your interests or fundamental rights do not override them.

3. Shopify & Shopify Network Intelligence

Our online shop runs on the e-commerce platform Shopify. For merchants established in Europe, Shopify International Limited, based in Ireland, is generally the competent Shopify entity.

Shopify processes personal data when you visit our shop, use a customer account, fill in forms or place an order. This may include in particular your IP address, device and browser information, usage data, contact details, order data and transaction information.

Shopify Network Intelligence is activated in our shop. Shopify may process data from your interaction with our shop together with information from your interactions with Shopify and other Shopify merchants in order to provide so-called Enhanced Services.

These services can, among other things, help to provide you with a more personalised shopping experience, improve Shopify services and their security, understand how customers interact with shops and advertising and – where you have consented to this – deliver more relevant advertising.

Information about your activities in our shop may be passed on to Shopify and to other service providers used by Shopify for this purpose. These may also be located outside the European Economic Area.

For visitors from the European Economic Area, the United Kingdom and Switzerland, Shopify takes into account the consent decisions made via our privacy settings for non-essential processing.

You can change or withdraw consent you have given at any time with effect for the future via our privacy settings.

Further information can be found in the Shopify consumer privacy policy.

Via the Shopify privacy portal you can obtain information about your rights towards Shopify and submit corresponding privacy requests.

4. Visiting our website & cookies

When you access our shop, the following technically necessary data in particular may be processed:

• IP address
• date and time of access
• browser and operating system
• device information
• pages and products accessed
• referrer URL
• technical log and security data

This processing serves in particular to provide our online shop securely and in working order, to analyse errors and to protect against misuse.

Our website also uses cookies and comparable technologies. Technically necessary technologies may be used where they are required to provide a function you have expressly requested.

Where consent is required for storing information on your device or accessing information already stored there, this is done on the basis of § 25 (1) TDDDG. Strictly necessary access may take place under the conditions of § 25 (2) TDDDG.

Where personal data is subsequently processed through the use of such technologies, the legal basis follows from Art. 6 GDPR.

We use non-essential analysis, marketing and personalisation technologies only where the legal requirements are met and, where necessary, you have consented in advance.

You can change your choice at any time for the future via our privacy settings.

5. Orders & contract processing

When you place an order, we process in particular:

• name
• billing and delivery address
• e-mail address
• telephone number where applicable
• items and product variants ordered
• order and transaction information
• payment and shipping method chosen

Processing serves to carry out your order, process payment, deliver, communicate about your order, handle returns and complaints and fulfil legal obligations.

The legal basis is in particular Art. 6 (1) (b) GDPR and, where applicable, Art. 6 (1) (c) GDPR.

6. Customer account

You can use a customer account for our shop. In doing so we process the data required to provide and manage your account.

This may include in particular your contact details, saved addresses, orders and further account information.

Processing takes place in particular on the basis of Art. 6 (1) (b) GDPR.

7. Payment processing

Depending on your country and the payment method chosen at checkout, various payment service providers may be used. These may include in particular:

• Shopify Payments
• Shop Pay
• credit card providers
• PayPal
• Klarna
• Apple Pay
• Google Pay
• iDEAL
• Bancontact

The data required for payment processing is transmitted to the respective payment service provider.

This may include in particular name, billing address, e-mail address, order value, transaction information and payment information.

Full credit card details are generally processed directly by the respective payment service provider and are not stored by us.

The legal basis is in particular Art. 6 (1) (b) GDPR.

8. Shipping service providers

To deliver your order we transmit the data required for shipping to our shipping service providers, in particular DHL or DHL Express.

This may include in particular name, delivery address, order information and – where necessary – e-mail address or telephone number.

Processing takes place in particular to fulfil your purchase contract under Art. 6 (1) (b) GDPR.

9. Contact & B2B enquiries

If you contact us by e-mail, contact form or via our B2B registration form, we process the information you send us in order to handle your enquiry.

In the case of a B2B enquiry this may include in particular your name, contact details, company or business information and other details you provide voluntarily.

To provide forms we use, among other things, functions of Shopify Forms.

If your enquiry relates to an existing or possible contract, processing takes place in particular on the basis of Art. 6 (1) (b) GDPR. Other business enquiries may be processed on the basis of our legitimate interest in handling them under Art. 6 (1) (f) GDPR.

10. Newsletter

If you sign up for our newsletter, we use your e-mail address to inform you about news, products and offers from Chevaux Nature.

Processing takes place on the basis of your consent under Art. 6 (1) (a) GDPR.

You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in every newsletter e-mail.

Shopify functions and services may be used to manage newsletter sign-ups and to send the newsletter.

11. Google Analytics

Where you have consented to this, we use Google Analytics to evaluate the use of our online shop statistically and to improve our offering.

This may involve processing information about your device, your browser, pages visited, interactions, technical identifiers and approximate location information.

For users in the European Economic Area the provider is generally Google Ireland Limited.

Google Analytics is used for non-essential analysis purposes only where the required consent has been given.

You can withdraw that consent at any time with effect for the future via our privacy settings.

In connection with the use of Google services, personal data may be processed outside the European Economic Area, in particular in the USA.

12. Product reviews with Judge.me

We use Judge.me to display, collect and manage product reviews. The provider is Judge.me Ltd.

When you submit a review, we may process in particular your name or chosen display name, your e-mail address, the rating, your review text, any content you upload and information about the product reviewed and the associated order.

Judge.me generally processes the personal data of buyers and reviewers that we provide within the review functions on our behalf as a processor.

Depending on the functions we have activated, Judge.me may in particular provide services for displaying reviews, verifying purchases and sending review requests.

Where review requests are sent by e-mail, this only happens where the necessary legal requirements are met.

Judge.me uses further sub-processors and technical service providers to provide its services. This may also involve processing personal data outside the European Economic Area.

Further information can be found in the Judge.me privacy policy.

13. Private Shopping & appointment booking

For online booking of appointments for our Private Shopping we use the external appointment booking service Setmore.

When you book an appointment, we may process in particular your name, your contact details, appointment details and other information you enter.

Processing takes place in particular to carry out pre-contractual measures or to organise the appointment you have requested under Art. 6 (1) (b) GDPR.

In connection with the use of this service, personal data may be processed outside the European Economic Area, in particular in the USA.

14. Recipients & international data transfers

We pass on personal data only where this is necessary to provide our shop, to perform the contract, because of a legal obligation or on the basis of another legal ground.

Recipients may in particular be:

• Shopify and service providers used by Shopify
• payment service providers
• shipping and logistics providers
• IT and hosting providers
• analysis and marketing providers
• Judge.me
• appointment booking providers
• professional advisers, where necessary
• authorities, where a legal obligation exists

Some service providers may process personal data outside the European Economic Area.

Where this is required under data protection law, such transfers take place on the basis of an adequacy decision of the European Commission or using appropriate safeguards, for example standard contractual clauses.

15. Storage period

We generally store personal data only for as long as it is required for the respective processing purpose or as long as statutory retention obligations exist.

We keep order, invoice, contract and accounting records in accordance with the applicable commercial and tax retention periods.

Data from general enquiries is deleted once the communication has been concluded and there are no legal or legitimate reasons for further storage.

We generally store newsletter data until you withdraw your consent, unless statutory evidence or retention obligations prevent deletion.

16. Your rights

Where the legal requirements are met, you have in particular the following rights:

• right of access
• right to rectification
• right to erasure
• right to restriction of processing
• right to data portability
• right to object
• right to withdraw consent given

You can withdraw consent at any time with effect for the future. The lawfulness of processing carried out up to the withdrawal remains unaffected.

To exercise your rights you can contact us at info@chevaux-nature.com .

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection law.

The supervisory authority responsible for our place of business is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany

18. Changes to this privacy policy

We update this privacy policy when our data processing, the services we use or the legal framework change.

Version: September 2026