Privacy Notice
1. Data Controller and Contact Details
The controller responsible for processing personal data on this website is Jörg Brachmann e.K. – Urbanature, Starsiedeler Straße 1, 06686 Lützen, Germany. You can contact us by telephone on +49 (0)34444 149334 or by email at info@urbanature.de.
For questions about data protection or to exercise your rights, you can also contact datenschutzbeauftragter@urbanature.de. This mailbox is managed by Jörg Brachmann.
2. Hosting and Provision of the Website
Our website and email accounts are hosted by Alfahosting GmbH, Edmund-von-Lippmann-Straße 13–15, 06112 Halle (Saale), Germany. Alfahosting processes data as part of providing and securing its hosting and email services.
When you access our website, technical connection data is processed. This includes, in particular, your IP address, the date and time of access, the pages and files requested, and information about your browser and operating system. This data is required to deliver the website, investigate technical faults and detect misuse.
The legal basis is Article 6(1)(f) of the EU General Data Protection Regulation (GDPR). Our legitimate interest is to operate our website securely and reliably. Technical log data is retained only for as long as necessary for operation, fault analysis and the investigation of security incidents.
Further information is available in Alfahosting’s privacy notice.
3. Cookies and Privacy Settings
Our website uses cookies and similar technologies. These enable functions such as the shopping basket, keeping you signed in and remembering your privacy preferences.
Where storing information on your device or accessing information already stored on it is strictly necessary to provide a service you have expressly requested, this takes place on the basis of Section 25(2), point 2 of the German Telecommunications and Digital Services Data Protection Act (TDDDG). Depending on its purpose, the associated processing of personal data is based on Article 6(1)(b) GDPR to provide requested contractual services, or Article 6(1)(f) GDPR to ensure that our website functions properly and securely.
We use the WordPress plugin Complianz to manage your preferences. Your choice is stored so that it can be respected when you visit further pages. Where this processing serves to comply with statutory consent requirements, its legal basis is Article 6(1)(c) GDPR. Access to your device that is necessary to store your choice is based on Section 25(2), point 2 TDDDG.
We use analytics and marketing technologies that require consent, and external content subject to consent, on the basis of your consent. The legal bases are Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. You can change or withdraw your consent at any time through the consent management facility on our website. Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out before you withdrew your consent.
4. Contacting Us
If you contact us using our contact form, by email or by telephone, we process the contact details you provide, the content of your enquiry and any information required to deal with it. We use WPForms for our contact form. Our email communications are handled through the email accounts hosted by Alfahosting.
If your enquiry concerns a contract or steps taken before entering into a contract, the legal basis is Article 6(1)(b) GDPR. We handle other enquiries on the basis of Article 6(1)(f) GDPR. Our legitimate interest is to respond to your enquiries.
The data is retained for as long as necessary to deal with your enquiry and any necessary follow-up questions. Statutory retention obligations and any retention necessary to establish, exercise or defend legal claims remain unaffected.
5. Orders and Customer Accounts
We operate our online shop using WordPress and WooCommerce. When you place an order, we process, in particular, your name, billing and delivery addresses, email address, ordered items, invoice details, selected payment method, payment status and correspondence required to fulfil your order.
This processing serves to enter into and perform the sales contract, including payment, delivery, returns and the handling of warranty claims. The legal basis is Article 6(1)(b) GDPR. We fulfil statutory documentation and retention obligations on the basis of Article 6(1)(c) GDPR.
You can place an order as a guest or choose to create a customer account. When you register, we process the necessary registration and login details. Your customer account provides the address and order information needed for its functions. The legal basis is Article 6(1)(b) GDPR.
Information marked as required is necessary to fulfil the relevant order or provide the relevant account function. Without this information, we may be unable to provide the service concerned. A customer account is not required to place a guest order.
You can request deletion of your customer account using our contact details. This does not affect data that must be retained to comply with statutory obligations or deal with outstanding contractual matters.
6. Payment Processing with Mollie
We use Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands, for payments by Apple Pay, payment card and advance bank transfer.
Depending on the payment method selected, the order, contact and transaction data required to process the payment is transmitted to Mollie or collected by Mollie during the payment process. This includes, in particular, the payment amount, order reference and information needed to carry out the payment and allocate it to your order. Technical data, such as your IP address and browser information, may also be processed.
The legal basis for our transmission of the data required for payment is Article 6(1)(b) GDPR. Mollie processes personal data as an independent controller, particularly for payment processing, fraud prevention and compliance with financial regulatory obligations.
If you select Apple Pay, the information required for the digital wallet payment is also processed by the Apple services, card providers and banks involved.
Further information about recipients, international processing and retention is available in Mollie’s privacy notice. Information about Apple Pay is available under Apple Pay and Privacy.
7. Payment Processing with PayPal
If you select PayPal, your payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
The order, contact and transaction data required for the payment is transmitted to PayPal. The legal basis for our transmission is Article 6(1)(b) GDPR.
PayPal also processes data as an independent controller, particularly to carry out payments, prevent fraud and comply with statutory obligations. Other payment service providers and companies within the PayPal group may be involved.
Weitere Informationen zu dieser Verarbeitung, zu internationalen Übermittlungen und zur Aufbewahrung finden Sie in den Datenschutzhinweisen von PayPal. Further information about this processing, international transfers and retention is available in PayPal’s privacy notice.
8. Shipping with Quivo and DHL
We dispatch our goods from Lützen, Germany. We use Quivo, provided by Logsta Germany GmbH, Dillfeld 22, 35576 Wetzlar, Germany, to create shipping labels and organise dispatch. Delivery is carried out by DHL.
We manually enter the necessary recipient and shipping data into Quivo. This includes, in particular, the recipient’s name, delivery address, invoice number and information required for the shipment. The recipient, address and shipment data necessary for delivery is passed to DHL as part of the shipping process.
The legal basis for the processing required to deliver your order is Article 6(1)(b) GDPR. Quivo acts as a service provider for the processing of shipping data.
If you have consented to electronic delivery notifications, we use your email address through Quivo to pass it to DHL for parcel announcements and delivery updates. The legal basis is Article 6(1)(a) GDPR. You can withdraw this consent at any time using our contact details, with effect for the future. Delivery itself does not require this consent.
For shipments to countries outside the European Union, such as Switzerland, we also process and transmit the information required for the relevant customs and shipping procedures. Recipients may include the transport service providers and customs authorities involved. This processing is based on Article 6(1)(b) GDPR for contractual performance and, where statutory customs obligations apply, Article 6(1)(c) GDPR. Switzerland is covered by an adequacy decision of the European Commission.
Further information is available in Quivo’s privacy notice and DHL’s privacy notice.
9. Accounting and Tax Advice
For accounting purposes and to fulfil our tax obligations, we process invoice, order and payment data, together with the associated customer details. We use software provided by DATEV eG, Paumgartnerstraße 6–14, 90429 Nuremberg, Germany.
Our appointed tax adviser receives the documents and information required to carry out their work. The tax adviser processes this data as an independent controller and in accordance with their statutory professional obligations.
Where processing serves to fulfil statutory bookkeeping, documentation and retention obligations, it is based on Article 6(1)(c) GDPR in conjunction with the applicable commercial and tax legislation. Any further processing necessary to obtain tax advice is based on Article 6(1)(f) GDPR. Our legitimate interest is to manage our business properly and obtain appropriate tax advice.
10. Locally Hosted Fonts
We use locally hosted fonts to display our website. These font files are provided by our web server. Retrieving them does not require a connection to an external font provider.
The associated technical processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to ensure a consistent and reliable presentation of our website.
11. Website Analytics with Matomo
We use Matomo to analyse the use of our website statistically. The WordPress installation we use stores the analytics data in our own website database with our hosting provider.
Matomo processes usage information such as pages visited, access times, referring URLs and technical browser and device information. These analyses help us understand how our website is used and improve its content and usability.
Matomo is configured without analytics cookies. IP addresses are shortened; for IPv4 addresses, two bytes are masked. The shortened address is also used for further processing of visits. Despite these measures, usage information may still constitute personal data.
The analysis is based on your consent under Article 6(1)(a) GDPR. Where access to your device requires consent, Section 25(1) TDDDG also applies. You can withdraw your consent through the consent management facility with effect for the future.
Raw visitor data older than 180 days is removed during the weekly deletion process. Aggregated statistical reports are not subject to an automatic deletion interval. Where such reports still contain personal information, the general deletion principles set out in this privacy notice apply.
12. Google Analytics 4
We use Google Analytics 4, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics processes information about the use of our website. This includes, in particular, page views, interactions, the source of a visit and technical browser and device information. Cookies and other identifiers allow usage events to be associated with one another. We use these analyses to improve our website.
According to Google, Google Analytics 4 does not log or store individual IP addresses. This does not mean that the remaining usage data is completely anonymous.
The legal basis is your consent under Article 6(1)(a) GDPR. Section 25(1) TDDDG also applies to access to your device that requires consent. You can withdraw your consent at any time through the consent management facility with effect for the future.
During processing, data may be transferred to Google LLC in the United States. Transfers to appropriately certified US organisations are covered by the adequacy decision concerning the EU-US Data Privacy Framework. Google also describes the use of standard contractual clauses for international data transfers.
Further information is available in Google’s privacy policy and its information about international data transfers.
13. Meta Pixel and Conversions API
We use technologies provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure the effectiveness of our advertising on Facebook and Instagram and enable interest-based advertising.
The Meta Pixel collects usage events through the browser. The Conversions API enables additional events to be transmitted to Meta. The information processed may include, in particular, page views and interactions, content accessed, timestamps, technical browser data and identifiers. Meta can associate this information with existing user accounts or other identifiers and use it for advertising analysis and audience creation.
The legal basis for this processing is your consent under Article 6(1)(a) GDPR. Section 25(1) TDDDG also applies to access to your device that requires consent. You can withdraw your consent at any time through the consent management facility with effect for the future.
Where the collection and transmission of event data falls within the joint controllership arrangement with Meta, we and Meta are jointly responsible for that processing. The arrangement allocates responsibilities, particularly for providing information, security and handling data subject rights. You can exercise your rights against either us or Meta. Subsequent processing by Meta takes place under its own responsibility.
Data may be transferred to Meta Platforms, Inc. in the United States. Where the transfer falls within its certification under the EU-US Data Privacy Framework, it is based on the corresponding adequacy decision. For other transfers, Meta describes safeguards including standard contractual clauses.
Further information is available in Meta’s privacy policy and the joint controllership arrangement.
14. Vimeo Videos
Our website includes videos embedded using a Vimeo player. The provider is Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, United States.
When you consent to activating a Vimeo video, your browser establishes a connection to Vimeo. In particular, your IP address, technical browser and device information, and information about the video accessed and your use of the player are processed. Depending on the player’s functions, cookies or similar technologies may be used. If you are signed in to Vimeo, Vimeo may associate this activity with your account.
The embedding is based on your consent under Article 6(1)(a) GDPR. Section 25(1) TDDDG also applies to access to your device that requires consent. You can withdraw your consent through the consent management facility with effect for the future.
Processing may take place in the United States. Vimeo participates in the EU-US Data Privacy Framework. Transfers covered by this framework are subject to the corresponding adequacy decision. Vimeo also describes the use of standard contractual clauses.
Further information about processing, retention and your rights is available in Vimeo’s privacy notice.
15. Retention and Deletion
We retain personal data for as long as necessary for the relevant processing purpose. Relevant factors include, in particular, the time required to fulfil contracts, handle enquiries and maintain customer accounts, as well as statutory retention obligations.
Für Buchungsbelege gilt grundsätzlich eine Accounting records must generally be retained for eight years, and commercial and business correspondence for six years. Certain other documents, particularly accounting books and annual financial statements, must generally be retained for ten years. These periods generally begin at the end of the relevant calendar year. Statutory extensions, for example in connection with tax proceedings, remain unaffected. The legal basis is Article 6(1)(c) GDPR in conjunction with the applicable commercial and tax legislation, particularly Section 147 of the German Fiscal Code (AO).
Where data is needed to establish, exercise or defend specific legal claims, it may be retained for as long as necessary for that purpose. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to protect our legal position.
Once the processing purpose no longer applies and the relevant retention periods have expired, personal data is deleted or anonymised. Any specific arrangements for individual processing activities are described in the relevant sections of this privacy notice.
16. Your Rights
Subject to the applicable statutory conditions, you have the right of access to your personal data under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR and the right to data portability under Article 20 GDPR.
Where processing is based on your consent, you can withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before you withdrew your consent.
You can exercise your rights by contacting us using the contact details provided in this privacy notice.
17. Right to Object
Where we process your personal data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. This also applies to profiling based on that provision.
Following an objection, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.
You may object at any time to the processing of your personal data for direct marketing purposes, without having to provide particular reasons. This also applies to profiling insofar as it is related to such direct marketing. The data concerned will then no longer be processed for those purposes.
18. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law. In particular, you may contact the supervisory authority in the place of your habitual residence, your place of work or the place of the alleged infringement.
The supervisory authority responsible for our business location is the State Commissioner for Data Protection of Saxony-Anhalt, Otto-von-Guericke-Straße 34a, 39104 Magdeburg, Germany. Further contact details are available at datenschutz.sachsen-anhalt.de.
Stand: 29. Oktober 2026.