Privacy Policy

1. Who is responsible?

Responsible body within the meaning of the GDPR:
Jennifer Weidmann – Basic Trust
Winderatt 4, 24966 Sörup, Germany
Tel.: 04635 / 294 307-0 | Fax: 04635 / 294 307-3
Email: jennifer@urvertraut.de

2. What is this about?

This statement explains how we process personal data when you visit our website, make a purchase, create a customer account, communicate with us, or use integrated services. "Personal data" is any information that can be used to identify you.

3. Legal basis in brief

We process data on the basis of the GDPR, in particular:

• Article 6 paragraph 1 letter b (contract/initiation),

• Article 6 paragraph 1 letter a (consent),

• Article 6 paragraph 1 letter f (legitimate interest),

• Article 6 paragraph 1 letter c (legal obligation).

4. Hosting & Platform (Shopify)

Our website is powered by Shopify :
Shopify International Ltd., 1-2 Haddington Road, Dublin 4, Ireland.
Data may also be transferred to Shopify Inc., 150 Elgin St, Ottawa, ON, Canada .
We have concluded a data processing agreement (Art. 28 GDPR) with Shopify. The EU Commission has issued an adequacy decision for Canada.

5. Technical access data (server logs)

When you access our pages, our system automatically processes: URL accessed, date/time, amount of data transferred, referrer, browser/version, operating system, IP address (possibly shortened).
Purpose/interest: Stability, security, error analysis (Art. 6 para. 1 lit. f GDPR).
Storage period: short technical deadlines; evaluation only in case of concrete evidence of misuse.

6. TLS encryption

Our pages are secured via HTTPS/TLS (lock symbol in the browser).

7. Cookies & Consent Management

We use cookies and similar technologies. Non-essential services/cookies are only loaded after you have given your consent via our cookie consent tool (Art. 6 para. 1 lit. a GDPR). Technically necessary cookies are based on Art. 6 para. 1 lit. f GDPR.
You can change your selection at any time in the consent tool. Browser settings also allow you to block cookies (functional limitations may occur).

(If you want to display a specific tool name, insert it here.)

8. Contact & Communication

8.1 Contacting us (email/contact form)

Data processed: Content of your request and contact details.
Legal basis: Art. 6 para. 1 lit. f (response to inquiries) and – in the case of contractual reference – lit. b.
Storage period: until final clarification; statutory retention periods remain unaffected.

8.2 Live Chat “Shopify Inbox”

Provider: Shopify International Ltd. (Ireland) with data transfer to Shopify Inc. (Canada).
Purpose: efficient support, possibly pseudonymous usage analysis (cookies only with consent).
Legal basis: Art. 6 para. 1 lit. b (initiation/contract) or lit. f (service optimization); cookies/tracking only with consent (Art. 6 para. 1 lit. a).
AVV closed; Canada with adequacy decision.

8.3 comments

The following information is stored: comment, timestamp, chosen display name, IP address (for security purposes), and email address for contact purposes.
Legal basis: Art. 6 para. 1 lit. b and lit. f.
We may delete illegal content.

9. Customer account

When creating an account, we process the requested mandatory data.
Purpose/Legal basis: Implementation of the user agreement (Art. 6 para. 1 lit. b).
You can have your account deleted at any time. Statutory retention obligations remain unaffected.

10th Newsletter

10.1 Registration & Double Opt-In

Your email address is required. We store your IP address, the date and time of registration/confirmation (proof of opt-in).
Legal basis: Consent (Art. 6 para. 1 lit. a). Withdrawal is possible at any time, e.g. via the unsubscribe link.

10.2 Shipping via Klick-Tipp (UK)

Provider: KLICK-TIPP Limited, 15 Cambridge Court, 210 Shepherd's Bush Road, London W6 7NJ, UK.
Legal basis: Art. 6 para. 1 lit. f (efficient delivery); tracking (opens/clicks, device information) only with consent (Art. 6 para. 1 lit. a).
A general administrative agreement (GIA) is available. (Note: The UK has an EU adequacy decision.)
Tracking can be revoked at any time.

10.3 Shipping via Shopify Email (Ireland/Canada)

Legal basis: Art. 6 para. 1 lit. f (shipping); tracking only with consent (Art. 6 para. 1 lit. a).
AVV available; Canada with adequacy decision.

11. Reviews – Judge.me

Provider: Judge.me Ltd., London (UK).
We will only send you review reminders with your consent (Art. 6 para. 1 lit. a).
AVV exists. (UK adequacy decision.)
You can withdraw your consent at any time.

12. Ordering, Shipping & Updates

To process orders, we transmit necessary data to payment services and transport companies (Art. 6 para. 1 lit. b).
If we are legally obliged to provide updates regarding digital products/elements , we will use your contact details for this purpose (Art. 6 para. 1 lit. c).

13. Payments

13.1 Klarna

Provider: Klarna Bank AB, Stockholm (Sweden).
Depending on the payment method, Klarna processes payment and order data. For payment methods where Klarna provides the service in advance (e.g., invoice/installment/direct debit), a credit check may be performed; the credit agencies listed in Klarna's overview may be consulted for this purpose.
Legal basis: Art. 6 para. 1 lit. b (payment processing), Art. 6 para. 1 lit. f (interest in fraud/default prevention).
You can object to this processing; if necessary, you should choose a different payment method.

13.2 PayPal

Provider: PayPal (Europe) S.à rl et Cie, Luxembourg.
Data transmitted: Payment and order information as well as – in the case of advance payment by us – additional identification data and, if applicable, credit check by PayPal.
Legal basis: Art. 6 para. 1 lit. b and lit. f.

14. Single Sign-On

14.1 Facebook Login (Meta)

Provider: Meta Platforms Ireland Ltd., Dublin (data may be transferred to the USA).
When you click on the login button, Meta transmits basic data of your profile to us – only with your consent (Art. 6 para. 1 lit. a).
Meta may use cookies/tracking; these are only loaded after consent has been given in the consent tool.

14.2 Google Sign-In

Provider: Google Ireland Ltd. (Data may be transferred to the USA).
Transmission of the profile data you have released with your consent (Art. 6 para. 1 lit. a).

14.3 Login with Amazon

Provider: Amazon EU S.à rl, Luxembourg (data may be transferred to the USA).
Transmission of the profile data you have released with your consent (Art. 6 para. 1 lit. a).

(If you do not currently offer SSO, delete section 14.)

15. Embedded Content & Tools

15.1 YouTube videos

Provider: Google Ireland Ltd. (Data may be transferred to the USA).
Cookies/similar technologies may be set during playback (usage statistics, abuse prevention).
Basis: your consent via the consent tool (Art. 6 para. 1 lit. a). Revocation possible at any time.

15.2 Google Maps

Provider: Google Ireland Ltd. (Data may be transferred to the USA).
When the map is loaded, usage data (including IP address) is transmitted to Google and evaluated by Google for its own purposes (usage profiles).
Basis: Consent in the consent tool (Art. 6 para. 1 lit. a). You can disable JavaScript/Maps in your browser (loss of functionality).

16. International Data Transfers

When we use providers in third countries , the transfer takes place either on the basis of an adequacy decision (e.g., Canada, UK) or suitable safeguards (e.g., standard contractual clauses, EU-US Data Privacy Framework for certified US providers). Details are provided by the respective provider.

17. Your rights (Articles 15–21 GDPR)

You have the right to information , rectification , erasure , restriction of processing , data portability , and the right to withdraw consent.
You can also object to processing that we base on a legitimate interest.

Objection to direct marketing: If we process data for direct marketing purposes, you can object to this at any time; we will then cease this processing.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

18. Storage duration

We process personal data only for as long as it is necessary for the respective purpose. Statutory retention periods apply (e.g., commercial and tax law). If processing is based on your consent, we will delete the data after you withdraw your consent. If processing is based on legitimate interests, we will delete the data as soon as your objection takes effect and there are no overriding legitimate grounds for the processing.

19. Status & Changes

This privacy policy is current and valid from the date stated below. We will update it as soon as services, legal requirements, or processes change.

As of September 27, 2025