Privacy

Controller within the meaning of the GDPR:

Bernhard Völker, Inhaber Michael Völker e.K.
Güterhallstraße 10
97318 Kitzingen
Germany
Phone: +49 (0)9321 4194
Email: hello@2naturkinder.de

We have not appointed a data protection officer; the requirements of § 38 of the German Federal Data Protection Act (BDSG) are not met.

Every time this page is accessed, the server writes a log entry: time, path accessed, status code, amount of data transferred, browser identifier, and IP address. This is technically necessary to deliver the page and to detect attacks.

The legal basis is Art. 6(1)(f) GDPR. Entries are deleted after 7 days.

Hosting is provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany.

We count which pages are visited. Without Google Analytics, without third-party tracking pixels, without cookies — the count runs on our own server.

For each visit, we store: time, path accessed, language version, the host of the referring page (i.e. “google.com,” not the full address including the search term), a rough device category (phone, tablet, computer), and country and region.

We determine country and region from your IP address, using a database that resides on our own server — your IP address is not passed on to third parties. It is used in the lookup and not retained. The region is the federal state or equivalent administrative unit. We do not collect your exact location or coordinates, even though the database contains them.

We do not store: your IP address, your browser identifier, or the full address of the referring page. None of this is retained.

To recognize related visits as a single session, we compute a hash from your IP address and browser identifier. This uses a key that changes daily and is never stored. The IP address is used in this computation and not retained; the hash cannot be reversed. Because the key changes daily, the same person is no longer recognizable the following day. Someone visiting on three different days appears as three separate visits in our statistics.

We also record steps along the way to a purchase: that something was added to the basket, that checkout began, that a delivery address was entered, that a payment method was selected, and that an order was placed. We do this to identify where our ordering process breaks down — a form nobody completes is our mistake, and we would otherwise have no way to find it.

For an order, we additionally store the order number and, if you are logged in, your customer number and email address. This makes the entry attributable to you, and the daily key rotation no longer protects you at this point: as a logged-in customer, you remain recognizable via your customer number over a longer period. For visitors who are not logged in, the entry remains a day-bound, non-attributable identifier.

The legal basis for this is our legitimate interest in a functioning ordering process, Art. 6(1)(f) GDPR. You may object to this processing (Art. 21 GDPR) — a message to the address given below is sufficient, and we will delete the entries attributed to you. Otherwise, they are deleted after twelve months.

Why we do not ask for consent for this: § 25 TDDDG (German Telecommunications-Digital-Services-Data-Protection Act) concerns storing information on your device and accessing it. Neither takes place — no cookie is set, nothing is stored in or read from your browser’s storage. The provision therefore does not apply. The legal basis for the processing is our legitimate interest in knowing whether and how this page is being read, Art. 6(1)(f) GDPR.

Retention period: twelve months. Entries are automatically deleted after that. Twelve months, because a winery’s point of reference is the annual cycle — anyone wanting to know whether this October did better than the last one needs the last one.

Visits to the back office, the member area, and the order confirmation page are not counted — the order confirmation also because its address contains your order number. Checkout, on the other hand, is counted; without it we would not know how many people begin the ordering process. Automated requests from search engines are filtered out where they identify themselves as such.

This website does not set cookies for advertising or analytics purposes.

A single cookie is set, and only for logged-in staff of the winery: nk.session_token keeps you logged in to the back office. It is technically necessary and therefore exempt from consent under § 25(2) TDDDG.

Once the shop is added, a cookie for the shopping basket will be added as well — likewise technically necessary.

Anyone writing to us via the form submits their name, email address, and the text of the message. We store this in order to reply — the legal basis is Art. 6(1)(b) and (f) GDPR.

To guard against automated mass submissions, we count for ten minutes how many messages arrive from one IP address. This count exists only in working memory and is not stored. We do not use a captcha.

Inquiries are deleted once they have been dealt with and no retention obligation applies, and in any case no later than 6 months.

Our house font is served from our own server, not from Google Fonts. Accessing this page therefore does not establish any connection to third parties.

There is one exception at checkout — see the next section.

Should we add a map or videos in the future, we will update this section accordingly.

If you pay by credit card, Klarna, PayPal, Apple Pay, or Wero, payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. When the payment field is opened, a script from js.stripe.com is loaded; Stripe thereby receives your IP address, device information, and payment data. Card numbers never reach our server — we only learn whether the payment succeeded.

Depending on the payment method chosen, data may also be passed to the respective provider (e.g. PayPal, Klarna), as these are engaged as sub-processors of Stripe.

The legal basis is Art. 6(1)(b) GDPR — payment processing is part of the contract. Stripe also processes data in the USA; the transfer relies on the Standard Contractual Clauses and Stripe’s certification under the EU-U.S. Data Privacy Framework.

Stripe’s own privacy notice: stripe.com/en/privacy

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). You may withdraw any consent at any time with effect for the future.

Please contact hello@2naturkinder.de for this purpose.

You may also lodge a complaint with a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.