International Shipping // Check your country availability

Refund policy

Privacy Policy

Last updated: 10 June 2026

1. General Information, Controller and Scope

This Privacy Policy applies to the use of our online store and the associated website (together referred to below as the “Services”), operated by:

STUDIO BOTANIC GmbH
Gereonshof 25
50670 Cologne
Germany
Email: info@studiobotanic.de

We (“STUDIO BOTANIC”, “we”, “us” or “our”) comply with the applicable rules on the protection of your personal data, in particular the EU General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Our Key Principles

We process personal data to operate our store, fulfil orders and provide our Services in a personalised and secure manner.

By using our Services, you acknowledge that you have read this Privacy Policy.

2. What Data We Collect and How We Use It

Personal Data

We collect and process the following categories of personal data:

  • Contact details: name, billing and delivery address, telephone number and email address

  • Financial and payment data: payment method, invoice details and, where applicable, credit card data processed through payment service providers

  • Account information: username, password and settings

  • Transaction data: order details, products, delivery status, returns, cancellations and withdrawals

  • Communication data: the content of messages you send us, such as customer support enquiries

  • Device and usage data: IP address, browser type and version, device identifier, access data and use of our Services

The data we collect depends on how you use our Services and which settings you select.

How and Why We Use Data

Legal bases:

  • Performance of a contract under Article 6(1)(b) GDPR

  • Your consent under Article 6(1)(a) GDPR

  • Compliance with legal obligations under Article 6(1)(c) GDPR

  • Our legitimate interests in IT security, marketing and analytics under Article 6(1)(f) GDPR

Purposes:

  • Operating the store and fulfilling contracts, including orders, shipping, returns and withdrawals

  • Communication, support and customer service

  • Marketing, only with consent; see the section on cookies and tracking below

  • Security and fraud prevention

  • Compliance with legal obligations, such as tax-related record-keeping

Sources of data:

  • Directly from you, for example when you place an order, contact us or withdraw from a contract

  • Automatically through our platform, cookies or consent management tool

3. Cookies and Tracking Technologies

We use cookies and tracking tools that are not technically necessary only after you have given your express consent through our cookie consent banner.

You can review and withdraw your choices there at any time. Without your consent, no marketing or analytics data is activated for third parties.

We use technically necessary cookies to operate and secure this website. Analytics and marketing cookies are activated only after your active consent. You can withdraw your consent at any time through our consent management tool.

Further information is provided in the “Third-Party Providers and Tracking Tools” section.

4. Third-Party Providers and Tracking Tools

We use the following services only with your consent, unless their integration is strictly necessary for operation or is based on another legal ground.

(a) Meta Platforms Ireland Ltd.

Facebook, Instagram, Threads – Pixel and Insights

We use Meta Pixel, the Conversions API and Insights for analytics and marketing purposes. Processing is based on your consent and an arrangement on joint controllership under Article 26 GDPR. Transfers to the United States are safeguarded by the EU–US Data Privacy Framework or Standard Contractual Clauses.

(b) TikTok Technology Ltd.

Pixel and Business Tools

For targeted marketing, we use TikTok Pixel and Business Tools. With your consent, these tools collect usage data and actions on our website. Transfers to third countries, including the United States and China, are safeguarded by Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

(c) Google Ireland Ltd.

Analytics, Ads, Fonts, reCAPTCHA and Tag Manager

We use Google Analytics, Google Ads Conversion Tracking, reCAPTCHA, Google Tag Manager and Google Fonts.

Google Fonts are hosted locally. Loading the fonts does not involve an external transfer of IP addresses.

We activate Google Analytics and Google Ads only after you have given consent through our consent tool. Transfers to the United States are safeguarded by the EU–US Data Privacy Framework or EU Standard Contractual Clauses. A data processing agreement is in place.

(d) YouTube

Google Ireland Ltd.

Embedded YouTube videos are activated only after you click on them or give your consent. Where possible, we use privacy-enhanced mode. Once you play a video, personal data, such as your IP address and usage behaviour, may be transmitted to Google.

(e) Pinterest Europe Ltd.

Pinterest plugins or embeds are loaded only with your consent. Where personal data is processed, the legal basis is your consent or our legitimate interest in presenting our content attractively.

(f) Vimeo Inc.

Vimeo videos are embedded using a two-click solution, so a connection to Vimeo is established only after you have given your consent. A data processing agreement and Standard Contractual Clauses safeguard any transfer to the United States.

(g) Klaviyo Inc.

Newsletters, marketing and reviews

We use Klaviyo to send newsletters, marketing emails and product-related communications, and to integrate rating and review functions.

The legal basis for advertising communications is your consent under Article 6(1)(a) GDPR. For transactional or contract-related communications, processing may also be based on Article 6(1)(b) or Article 6(1)(f) GDPR.

Transfers to the United States are safeguarded by the EU–US Data Privacy Framework or Standard Contractual Clauses. A data processing agreement is in place.

(h) Judge.me LLC

Product reviews

We use Judge.me to display and manage product reviews. Processing is based on our legitimate interest in customer information, transparency and authenticity under Article 6(1)(f) GDPR. Data may be stored in the United States. A data processing agreement is in place.

(i) Mouseflow ApS

Session replays and heatmaps

We use Mouseflow to analyse user behaviour only with your consent. Interactions with our website may be analysed in pseudonymised form to improve the usability and technical functionality of our store.

According to the provider, the data is stored in the EU. A data processing agreement is in place.

(j) Pagefly

Shopify page builder

We use Pagefly to design and technically provide individual pages of our Shopify store. Personal data is collected only where the relevant functions or forms are used. The legal basis is our legitimate interest in presenting an optimised online store under Article 6(1)(f) GDPR or, where applicable, your consent.

(k) Trusted Shops GmbH

Trust seal and reviews

We use Trusted Shops for our store’s trust seal and review services. Processing is based on our legitimate interest in customer information, trust and quality assurance under Article 6(1)(f) GDPR. Processing takes place within the EU. A data processing agreement is in place.

(l) Consentmo GDPR

Consent management

We use Consentmo GDPR to manage your consent and document your cookie and privacy preferences.

The legal basis is compliance with legal obligations under Article 6(1)(c) GDPR and our legitimate interest in managing consent in a legally compliant manner under Article 6(1)(f) GDPR. A data processing agreement is in place.

(m) Anviara / EU Withdrawal Button

We use the Shopify app “EU Widerrufsbutton” provided by Anviara LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA, to give consumers an electronic means of withdrawing from a contract.

If you use the withdrawal button on our website, the information required to process your withdrawal will be collected. This may include your name, email address, order or contract number, language, time of submission and an optional reason for withdrawal.

Processing is necessary to receive, document and handle your withdrawal and to comply with legal obligations. The legal basis is Article 6(1)(c) GDPR where processing is required to meet legal obligations and Article 6(1)(b) GDPR where it relates to an existing contract.

Anviara processes this data on our behalf as a processor. According to the provider, its application servers, database and backups are hosted in Germany. Individual technical services, particularly delivery through Cloudflare and the sending of transactional emails, may involve service providers outside the EU. According to the provider, such transfers are safeguarded by appropriate measures, in particular EU Standard Contractual Clauses and data processing agreements.

Data collected through the app is not used for advertising, profiling or sale to third parties. Further information about Anviara’s processing is available in the provider’s privacy policy.

(n) Use of Linktree

We use Linktree, a service provided by Linktree Pty Ltd, Melbourne, Australia, to provide a collection of links.

When you access our Linktree profile, information about your use may be collected, including your IP address, time of access, device and browser, and potentially referrer and click data. This information may be transferred to servers outside the EU, particularly in Australia and possibly the United States. According to Linktree, it uses analytics tools and cookies to evaluate user behaviour. Data may be shared with third parties.

The legal basis for our use of Linktree is Article 6(1)(f) GDPR: our legitimate interest in providing convenient links to our online presences. Use of the service is voluntary. Information about Linktree’s processing is available in its privacy policy.

Please note that personal data may be processed outside the EU. We have no control over Linktree’s processing of that data.

Third-Party Payment Service Providers

Depending on the payment method you choose, we transmit the data necessary for the transaction to external payment service providers.

These may include PayPal, Klarna, Shopify Payments, Shop Pay, Apple Pay, Google Pay, credit card providers and other payment methods offered at checkout.

Data is transmitted solely for payment processing under Article 6(1)(b) GDPR. The respective payment providers’ own privacy terms may also apply.

5. Data Sharing, International Transfers and Recipients

We share your data only where necessary to perform a contract, comply with legal obligations, including obligations towards public authorities, pursue legitimate interests such as legal defence or IT operations, or where you have given consent.

Transfers Outside the EU/EEA

Transfers outside the EU or EEA take place only on the basis of legally recognised mechanisms, such as adequacy decisions, the EU–US Data Privacy Framework or EU Standard Contractual Clauses.

External Links and Third-Party Websites

Our pages may contain links to third-party websites. Please refer to their respective privacy policies. We are not responsible for the content or practices of those websites.

6. Minors and Children

Our store is not intended for anyone under the age of 16. We do not knowingly collect data from minors. If we become aware that data has been collected in breach of this rule, we will delete it without undue delay. Minors may provide consent where appropriate with the agreement of a parent or legal guardian.

7. Security and Retention

We take technical and organisational measures appropriate to the state of the art to protect your data against manipulation, loss, destruction and unauthorised access.

Communication channels such as email are not completely secure. Please use protected channels for confidential information wherever possible.

We retain data only for as long as necessary for the stated purposes or as required by law.

8. Your Rights as a Data Subject

You have the right to:

  • Access under Article 15 GDPR

  • Rectification under Article 16 GDPR

  • Erasure (“the right to be forgotten”) under Article 17 GDPR

  • Restriction of processing under Article 18 GDPR

  • Data portability under Article 20 GDPR

  • Object under Article 21 GDPR

  • Withdraw consent under Article 7(3) GDPR. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

  • Lodge a complaint with a supervisory authority, particularly in the country where you live or work or where the alleged infringement occurred. For us, the primary authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

You can exercise many of your privacy rights through our privacy portal or self-service tool. You can also contact us at info@studiobotanic.de, to boost collagen production.

9. Communications, Marketing and Opt-Out

We send you marketing communications only with your express consent. You can unsubscribe from marketing emails at any time using the unsubscribe link or by emailing info@studiobotanic.de, to boost collagen production.

You will continue to receive non-marketing system emails, such as order and shipping confirmations, security notices and information relating to your contract, where necessary to perform the contract or for legal reasons.

Global Privacy Control and Do Not Track

We recognise the browser setting “Global Privacy Control” where technically possible.

Other Do Not Track signals are not evaluated or implemented.

10. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our practices, tools or legal requirements.

The current German version is available at https://www.studiobotanic.de/policies/privacy-policy, to boost collagen production.

We will announce material changes by email, where we have an email address, in our store or through a pop-up.

For questions or to exercise your privacy rights, please contact:

STUDIO BOTANIC GmbH
Gereonshof 25
50670 Cologne
Germany
Email: info@studiobotanic.de

You may print this Privacy Policy. The German version is authoritative.

All trademarks mentioned in this text belong to their respective owners.

Legal Note

This policy was prepared with care on the basis of German data protection standards as of June 2026. It does not replace individual legal advice.

Actual legal compliance also depends on technical implementation, including locally hosted Google Fonts, correct consent banner settings for each tool, accurate app configuration and a properly linked self-service tool.

Withdraw contract