Christiane's Naturkraft
DEEN

Privacy Policy

Last updated: 13 October 2026

Introduction

This Privacy Policy explains how Christianes Naturkraft FlexCo processes personal data when you visit our website, place an order, contact us, or use our services.

1. Data controller

The controller responsible for the processing of your personal data is:

Christianes Naturkraft FlexCo
Stumpergasse 7/2/2
1060 Vienna
Austria
Email: support@christiane.co
Phone: +4357300

2. Personal data we process

We process personal data only where this is necessary, legally permitted, or based on your consent. Depending on how you use our website and services, we may process the following categories of data:

Order and customer data. Name, email address, billing address, delivery address, order details, payment status, invoice data, and customer communication.

Payment data. Payment details are processed by our payment service providers. We do not store complete credit card details ourselves.

Communication data. If you contact us, we process the information you provide, such as your name, email address, message content, and related correspondence.

Newsletter and product update data. If you sign up for updates, we process your email address and, where applicable, your consent status and subscription preferences.

Technical data. When you visit our website, technically necessary data may be processed, such as IP address, browser type, device information, access time, and server log data.

Analytics data. With your consent, we use Plausible Analytics to understand aggregate website usage. Plausible is designed to work without cookies and without creating individual user profiles. Analytics data is used only to understand general website performance, such as page views, referrers, and visitor trends.

3. Purposes and legal bases

We process your personal data for the following purposes:

Processing orders and delivering products. Legal basis: performance of a contract or steps prior to entering into a contract, Article 6(1)(b) GDPR.

Customer support and communication. Legal basis: performance of a contract, Article 6(1)(b) GDPR, or legitimate interest in responding to inquiries, Article 6(1)(f) GDPR.

Payment processing. Legal basis: performance of a contract, Article 6(1)(b) GDPR.

Accounting, tax, and legal obligations. Legal basis: compliance with legal obligations, Article 6(1)(c) GDPR.

Newsletter and product updates. Legal basis: your consent, Article 6(1)(a) GDPR. You can withdraw your consent at any time.

Website security, fraud prevention, and technical operation. Legal basis: legitimate interest in operating a secure and functional website, Article 6(1)(f) GDPR.

Website analytics with Plausible. Legal basis: your consent, Article 6(1)(a) GDPR. Plausible is activated only after you allow analytics, and you can withdraw your consent at any time through Cookie settings.

Measuring the success of our advertising with Microsoft Advertising. Legal basis: your consent, Article 6(1)(a) GDPR, and for storing information on your device § 165(3) of the Austrian Telecommunications Act 2021. Microsoft Advertising is activated only after you allow marketing, and you can withdraw your consent at any time through Cookie settings.

4. Cookies and similar technologies

Our website uses technically necessary cookies and similar technologies for functions such as the shopping cart, checkout, security, and language settings. These are required for the website to work properly.

With your consent, we use Plausible Analytics for privacy friendly website statistics. Plausible does not use analytics cookies and does not create individual tracking profiles. Your analytics preference is stored locally on your device so the website can remember your choice. With your statistics consent, we also measure shopping journeys between our website and Shopify checkout, including checkout starts, submission of shipping or payment information and completed checkouts. For completed checkouts, we send the order value and currency. Names, email addresses, order numbers and individual checkout links are not sent to Plausible. Your browser sends its IP address and user-agent metadata to Plausible for anonymous visitor counting. The raw IP address is not stored there.

With your consent to marketing, we use Microsoft Advertising (Universal Event Tracking and the Conversions API) from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. This lets us measure whether visits from our ads on Bing and the Microsoft network lead to orders. Microsoft sets the cookies _uetsid (1 day), _uetvid (up to 13 months) and _uetmsclkid (90 days). We store the Microsoft click ID from the ad link for up to 90 days on your device and add it to your shopping cart. When you complete an order, we send Microsoft the order number, order value, currency, product IDs, the click ID, your IP address, your browser user agent and a one way encrypted (SHA-256 hashed) form of your email address. Microsoft uses this data to attribute the order to an ad click. Microsoft may process data in the USA. Microsoft is certified under the EU-U.S. Data Privacy Framework. More information is available in the Microsoft Privacy Statement at https://privacy.microsoft.com/privacystatement.

You can change or withdraw your choice at any time using the Cookie settings button. Withdrawing marketing consent stops Microsoft Advertising, removes the stored click ID and deletes the Microsoft cookies on this website. If we introduce further optional advertising, embedded content, or other non essential third party technologies in the future, they will only be used where legally permitted and, where required, only after your consent.

5. Shopify checkout and electronic withdrawal

Our checkout, customer accounts and orders are processed through Shopify. Shopify receives the customer, order, payment and technical data needed to operate these functions. Where Shopify processes data for its own purposes, its privacy information also applies: https://www.shopify.com/legal/privacy/app-users.

For an electronic withdrawal, we process your name, email address, contract reference, any goods specified, the declaration and its receipt time. We use these data to process the withdrawal, send an acknowledgement and document compliance with our legal obligations under Article 6(1)(b) and (c) GDPR. We do not require marketing consent to accept a withdrawal.

The website uses Vercel for hosting, Supabase for submitted customer messages and withdrawal records, and EmailIt for transactional acknowledgements. These providers receive the data needed for their respective services. We retain withdrawal correspondence for the duration necessary to process the request, meet applicable legal retention requirements and resolve related claims.

6. Recipients and processors

We may share personal data with trusted service providers where necessary for the purposes described above. These may include:

  • Payment service providers
  • Shipping and logistics providers
  • Email and newsletter service providers
  • Website hosting providers
  • IT and security service providers
  • Accounting and tax advisors
  • Legal advisors, courts, or authorities where legally required
  • Analytics providers, currently Plausible Analytics
  • Advertising providers, currently Microsoft Advertising, only with your consent

These service providers process personal data only where necessary and, where required, on the basis of data processing agreements.

7. International data transfers

We primarily aim to process personal data within the European Economic Area.

If personal data is transferred outside the European Economic Area, we will ensure that an appropriate legal basis for the transfer exists. This may include an adequacy decision by the European Commission, standard contractual clauses, additional safeguards, or your explicit consent where required.

Microsoft Advertising may involve transfers to Microsoft Corporation in the USA. These transfers are based on the European Commission adequacy decision for the EU-U.S. Data Privacy Framework, under which Microsoft is certified.

8. Retention periods

We retain personal data only for as long as necessary for the relevant purpose.

Order, invoice, and accounting data are generally retained for the statutory retention period applicable under Austrian law, usually 7 years.

Customer communication is retained as long as necessary to handle your request and for any related legal claims.

Newsletter data is retained until you unsubscribe or withdraw your consent.

Server logs and technical security data are retained only for a limited period unless longer retention is necessary for security, fraud prevention, or legal reasons.

9. Your rights

Under the GDPR, you have the following rights, subject to the applicable legal requirements:

  • Right of access
  • Right to rectification
  • Right to erasure
  • Right to restriction of processing
  • Right to data portability
  • Right to object to processing based on legitimate interests
  • Right to withdraw consent at any time
  • Right to lodge a complaint with a supervisory authority

To exercise your rights, contact us at support@christiane.co.

You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde) if you believe that your personal data is being processed unlawfully.

10. Mandatory data

When you place an order, certain data is required to process and deliver your order. If you do not provide this data, we may not be able to complete your order.

Providing data for newsletters, product updates, or optional cookies is voluntary.

11. Security

We use appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, alteration, or disclosure.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, especially if our website, services, legal obligations, or third party providers change. The current version will always be available on our website.