Skip to main content

Privacy Policy

 

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Aufrecht & Kränzle GbR
Abt-Johannes-Str. 16
73434 Aalen
Germany

Represented by the partners:
Daniel Aufrecht, Marc Kränzle

Email: info@discussedcamomile.com
Website: www.discussedcamomile.com

 

2. General Information on Data Processing

We process personal data of visitors to our website only to the extent necessary to provide a functional website, to process orders, or on the basis of your consent.

The legal bases for processing are in particular:

  • Art. 6(1)(a) GDPR (consent)
  • Art. 6(1)(b) GDPR (performance of a contract / pre-contractual measures)
  • Art. 6(1)(c) GDPR (legal obligation)
  • Art. 6(1)(f) GDPR (legitimate interests)

 

3. Cookies & Consent Management (Complianz)

Our website uses cookies and similar technologies.
The management of cookies and user consent is carried out using the consent tool Complianz.

Cookie Categories

  • Strictly necessary cookies
    Required for the operation of the website, shopping cart, and checkout process.
  • Statistics cookies
    Used to analyze website usage (e.g. Jetpack Statistics).
  • Marketing cookies
    Used to measure advertising effectiveness and display personalized advertising (Meta Pixel).

Non-essential cookies are set only after prior consent.

Withdrawal of Consent
You can revoke or adjust your consent at any time via the cookie banner or cookie settings.
A detailed overview of all cookies used can be found in our Cookie Policy.

 

4. Server Log Files

When you visit our website, information is automatically collected by our hosting provider and stored in server log files. This may include:

  • IP address
  • Date and time of access
  • Browser type and operating system
  • Referrer URL

Processing is based on Art. 6(1)(f) GDPR (legitimate interest in ensuring the security and stability of the website).

 

5. Web Analytics with Jetpack (Statistics)

We use the statistics module of the WordPress plugin Jetpack, provided by
Automattic Inc. / Automattic A8C Ireland Ltd.

Jetpack collects statistical information about page views and user behavior. Cookies may be set and IP addresses processed in this context.
Processing takes place only on the basis of your consent pursuant to Art. 6(1)(a) GDPR, obtained via the cookie banner.

Further information:
https://automattic.com/privacy/

 

6. Meta Pixel (Meta Platforms)

We use the Meta Pixel, an analytics service provided by
Meta Platforms Ireland Ltd., Dublin, Ireland.

Purpose of Processing

  • Measuring advertising effectiveness
  • Analyzing user behavior
  • Creating target audiences for marketing purposes

Legal Basis
Processing is carried out only with your consent pursuant to Art. 6(1)(a) GDPR.

Joint Controllership
We and Meta are jointly responsible for certain processing operations pursuant to Art. 26 GDPR.
The joint controller agreement can be accessed at:
https://www.facebook.com/legal/controller_addendum

Data Transfer to Third Countries
It cannot be ruled out that personal data may be transferred to the United States.
Meta uses Standard Contractual Clauses (SCCs) for such transfers.

Further information:
https://www.facebook.com/privacy/policy/

 

7. Website Security (Wordfence)

We use the security plugin Wordfence, provided by
Defiant Inc., USA, to protect our website against attacks.
Wordfence processes IP addresses for security purposes.
Processing is based on Art. 6(1)(f) GDPR (legitimate interest in website security).

Further information:
https://www.wordfence.com/privacy-policy/

 

8. Instagram Feed (Smash Balloon)

Our website integrates an Instagram feed using the WordPress plugin “Smash Balloon Instagram Feed”.
When the Instagram feed is loaded, personal data (e.g. IP address, device and browser information) may be transmitted to Meta Platforms Ireland Ltd.
The integration takes place only on the basis of your consent pursuant to Art. 6(1)(a) GDPR, which is obtained via our cookie banner. The Instagram feed is loaded only after consent has been given.
Meta Platforms Ireland Ltd. may transfer personal data to the United States. Meta uses Standard Contractual Clauses (SCCs) for such transfers.
Further information can be found in Instagram’s privacy policy:
https://www.instagram.com/about/legal/privacy/

 

9. WooCommerce & Order Processing (Guest Checkout)

Our website uses WooCommerce to process orders.

We do not offer user accounts; orders are processed exclusively via guest checkout.
The following data may be processed during the ordering process:

  • Name
  • Billing and shipping address
  • Email address
  • Order details

Processing is necessary for contract performance pursuant to Art. 6(1)(b) GDPR.

 

10. Payment Methods

PayPal
If you choose PayPal as a payment method, personal data will be transmitted to
PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
Legal basis: Art. 6(1)(b) GDPR

Privacy policy:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Bank Transfer
If you choose bank transfer as a payment method, we process the data required for payment processing (e.g. name, payment amount, bank details) to allocate the payment and fulfill the contract.

Legal basis: Art. 6(1)(b) GDPR.
Payment data is not shared with third parties.

 

11. Contact by Email

If you contact us by email, the data you provide will be processed solely for the purpose of handling your inquiry.

Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.

 

12. Contact Form (Contact Form 7)

We provide a contact form on our website using the WordPress plugin Contact Form 7.

When using the contact form, the data entered (e.g. name, email address, message) is transmitted to us and processed exclusively to handle your inquiry.

Processing is based on Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
The data is not shared with third parties.

 

13. Storage Duration

Personal data is stored only for as long as:

  • necessary to fulfill contractual obligations, or
  • required by statutory retention obligations (e.g. tax and commercial law).

 

14. Rights of Data Subjects

You have the right to:

  • access (Art. 15 GDPR)
  • rectification (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • object to processing (Art. 21 GDPR)
  • withdraw consent at any time (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a supervisory authority.

 

15. Version

Version: January 2026