Last updated: 6 October 2026. This policy explains how we handle your personal data when you visit herbalson.com or buy from our store.
1. Who we are
[Legal entity name] operates this store and is the controller of the personal data described below. You can reach us at info@herbalson.com or at [registered address].
2. What we collect
When you order or create an account: your name, delivery and billing address, email address and phone number, the products you order and your order history. If you give us a Telegram handle, we store that too. We do not receive or store your card number — payment is handled by our payment provider on its own systems.
When you browse the site: technical data that your browser sends with every request (IP address, browser type, the page you asked for). Our hosting provider keeps this in server logs for security.
Only if you agree to analytics cookies: information about how you use the site — pages viewed, products viewed, how you arrived (for example from a search engine or an email link), approximate location by country or city, and device type. See section 9 and our Cookie Policy.
If you contact us by email, chat or Telegram: the content of your message and your contact details.
3. Why we use it and our legal basis
- To process, deliver and support your order, handle returns and refunds, and run your account — necessary to perform our contract with you (Art. 6(1)(b) GDPR).
- To keep accounting and tax records — required by law (Art. 6(1)(c) GDPR).
- To keep the site and payments secure and prevent fraud — our legitimate interest in protecting our customers and our business (Art. 6(1)(f) GDPR).
- To measure and improve the site with analytics — only with your consent (Art. 6(1)(a) GDPR and the ePrivacy rules on cookies).
- To send you marketing emails — only if you have asked for them (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the link in any such email.
Where we rely on legitimate interests, you have the right to object (see section 7).
4. Who we share it with
Only with service providers who help us run the store, each acting on our instructions under a data processing agreement:
- Payment providers — Stripe (including WooPayments, which runs on Stripe) to take card payments and prevent fraud.
- Carriers and customs — to deliver your parcel; your delivery details go to the carrier and, for international orders, to customs in the destination country.
- Hosting and email — Hostinger (website hosting and our mailbox) and MailPoet (if you subscribe to our newsletter).
- Analytics — Google Analytics, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC, only if you accept analytics cookies.
We do not sell or rent your personal data. We disclose data to authorities only where the law requires it.
5. International transfers
Some of our providers (for example Google and Stripe) process data in the United States. These transfers are covered by the EU–US Data Privacy Framework, under which these companies are certified, and/or by the European Commission’s Standard Contractual Clauses. Because we ship internationally, your delivery details are also shared with carriers and customs authorities in the destination country.
6. How long we keep it
- Order and invoice records — for as long as tax and accounting law requires (usually up to 10 years).
- Account data — until you close your account.
- Analytics data in Google Analytics — 14 months, then deleted automatically.
- Your cookie choices — the choice itself is stored in your browser for 6 months; our record that you made it (without your IP address) is kept for 3 years so we can show we asked.
- Marketing consent records — until you withdraw consent, plus a short period to prove you did.
- Server security logs — a few weeks, as set by our hosting provider.
7. Your rights
You can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict processing, object to processing based on our legitimate interests, and ask for your data in a portable format. Where we rely on your consent, you can withdraw it at any time — for cookies, through Cookie settings at the bottom of every page; for emails, through the unsubscribe link. Withdrawing consent does not affect processing that happened before.
Write to info@herbalson.com and we will respond within one month. If you are unhappy with our response, you can complain to the data protection authority in the EU country where you live or work.
8. Security
The site is served only over an encrypted connection (HTTPS). We use organisational and technical measures appropriate to the risk to protect your data against unauthorised access, loss or alteration. No system is perfectly secure, but we take this seriously and will tell you and the relevant authority if a breach affects you.
9. Cookies
We use cookies that are strictly necessary for the store to work (cart, checkout, currency, sign-in, payment security). Analytics cookies are set only after you agree in our cookie banner; until then Google Analytics is not loaded at all. We do not use advertising cookies at the moment. You can change or withdraw your choice at any time in Cookie settings. The full list of cookies is in our Cookie Policy.
We load fonts from our own server, so viewing the site does not send your IP address to Google Fonts.
10. Children
Our products are food supplements for adults. The store is not intended for children under 16, and we do not knowingly collect their data.
11. Changes
If we change this policy we will update the date at the top. Material changes will be brought to your attention.
