Privacy Policy

Last updated: 06.08.2026

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

PK-Plants, owner: Philipp Kleiner

Kobelweg 11

86156 Augsburg

Germany

Email: pkplants@proton.me

We have not appointed a data protection officer, as the statutory requirements for doing so do not apply to us.

2. General Information

2.1 Personal Data

Personal data means any information relating to an identified or identifiable natural person — for example name, address, email address or IP address.

2.2 Legal Bases for Processing

Where we obtain consent for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.

Where processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract, Art. 6(1)(b) GDPR serves as the legal basis.

Where processing is necessary for compliance with a legal obligation, Art. 6(1)(c) GDPR serves as the legal basis.

Where processing is necessary for the purposes of our legitimate interests or those of a third party, and the interests, fundamental rights and freedoms of the data subject do not override those interests, Art. 6(1)(f) GDPR serves as the legal basis.

For the storage of information on your device and access to such information, Section 25 TDDDG applies in addition.

2.3 Recipients

We disclose your data to third parties only where described in this privacy policy, permitted by law, or where you have given your consent. Recipients are in particular service providers engaged by us as processors under Art. 28 GDPR — such as our hosting and shop provider, payment and shipping service providers, and providers of analytics and email services. We have concluded the contracts required under data protection law with these service providers.

2.4 Transfers to Third Countries

In some of the cases described below, data is transferred to countries outside the European Union. Such a transfer takes place only where an adequacy decision of the European Commission exists, where appropriate safeguards within the meaning of Art. 46 GDPR — in particular EU standard contractual clauses — have been agreed, or where you have expressly consented. We state the applicable basis for each individual service.

3. Hosting and Shop System (Wix)

This website and our online shop are operated on the Wix platform. The provider is Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel.

On our behalf, Wix collects and stores all data that you enter via this website or that is generated automatically when the website is accessed — in particular master data, contact data, contract and order data, usage data as well as meta and communication data.

Wix is used for the purpose of performing our contracts with customers and prospective customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR).

Wix processes your data only to the extent necessary to fulfil its performance obligations and follows our instructions. We have concluded a data processing agreement with Wix pursuant to Art. 28 GDPR.

An adequacy decision of the European Commission exists for Israel. Where data is transferred to further group companies or sub-processors in third countries, this takes place on the basis of the EU standard contractual clauses.

Further information: https://de.wix.com/about/privacy

4. Server Log Files

When our website is accessed, information is automatically collected and stored in so-called server log files:

browser type and browser version

operating system used

referrer URL

host name of the accessing device

time of the server request

IP address

This data is not merged with other data sources.

The legal basis is Art. 6(1)(f) GDPR. We have a legitimate interest in the technically flawless presentation, optimisation and security of our website.

5. Cookies and Consent Management

Our website uses cookies and comparable technologies. Cookies are small text files stored on your device.

Technically necessary cookies are required for the website and the ordering process to function — for example to store the contents of your shopping cart or your login status. The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.

All other cookies — in particular those used for analytics and marketing purposes — are set only with your express consent. The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

To obtain and manage your consent, we use the cookie banner provided by our platform provider Wix. You can accept or reject individual categories there. Your selection is stored in a cookie so that the request does not have to be repeated on every page view.

You can withdraw or change your consent at any time with effect for the future by opening the cookie settings on our website again. You can also configure your browser to block cookies generally or to delete them when the browser is closed. Disabling technically necessary cookies may limit the functionality of this website.

6. Contacting Us

6.1 Contact and Enquiry Forms

If you contact us via a form on our website, we process the data you provide — in particular your name, email address and your message — in order to handle your enquiry.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or its initiation. In all other cases, the legal basis is our legitimate interest in responding to enquiries pursuant to Art. 6(1)(f) GDPR.

6.2 Contact by Email

If you contact us by email, we process the information you provide in order to handle your request. The same legal bases apply as under section 6.1.

We store enquiries until the purpose of storage no longer applies, until you request deletion, or until statutory retention obligations prevent deletion.

7. Customer Account and Order Processing

7.1 Customer Account

You can create a customer account in our shop. In doing so, we process the data you provide — in particular your name, email address, password, billing and delivery address as well as your order history.

The legal basis is Art. 6(1)(b) GDPR. You may request deletion of your customer account at any time. Statutory retention periods remain unaffected.

7.2 Orders

To process your order, we process your master, contact, contract and payment data. Providing this data is required in order to conclude a contract; without it, no contract can be concluded.

The legal basis is Art. 6(1)(b) GDPR. Where we retain invoice and accounting data, this is done to comply with statutory retention obligations on the basis of Art. 6(1)(c) GDPR in conjunction with Section 147 AO and Section 257 HGB.

7.3 Wishlist

If you use the wishlist function, we store the items you have selected in connection with your customer account. The legal basis is Art. 6(1)(b) GDPR.

7.4 Loyalty Programme

In order for you to participate in our loyalty programme, we process your account data as well as data on your orders and your points balance, so that we can grant you the benefits of the programme.

The legal basis is Art. 6(1)(b) GDPR. You may end your participation at any time.

8. Payment Service Providers

We offer various payment methods in our shop. The data required for payment processing is transmitted to the payment service provider you select so that the provider can carry out the payment.

The legal basis is Art. 6(1)(b) GDPR. Where we offer several payment methods, this is additionally based on our legitimate interest in a customer-oriented range of payment options pursuant to Art. 6(1)(f) GDPR.

The payment service providers process your data in part as independent controllers. Please refer to their own privacy notices in this respect.

8.1 PayPal

Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

Privacy notice: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

8.2 Klarna

Provider: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may obtain information from credit agencies in order to verify identity and creditworthiness. Please refer to Klarna's privacy notice for further information and the applicable legal bases.

Privacy notice: https://www.klarna.com/de/datenschutz/

8.3 Credit Card Payment (Wix Payments)

When paying by credit card, the payment data is processed via the payment service of our platform provider Wix. Your full credit card details are not disclosed to us.

Privacy notice: https://de.wix.com/about/privacy

8.4 Prepayment and Bank Transfer

When paying by prepayment or bank transfer, the data required for payment processing is transmitted to our bank.

9. Shipping

In order to deliver your order, we pass on the data required for this purpose — in particular your name, delivery address and, where you have provided them, your email address and telephone number for delivery notifications — to the shipping company engaged.

We work with the following shipping service providers:

DHL Paket GmbH

Sträßchensweg 10, 53113 Bonn, Germany

Privacy notice: https://www.dhl.de/de/privatkunden/kundenservice/datenschutz.html

DHL Express Germany GmbH

Heinrich-Brüning-Straße 5, 53113 Bonn, Germany

Privacy notice: https://www.dhl.de/de/privatkunden/kundenservice/datenschutz.html

UPS Deutschland S.à r.l. & Co. OHG

Görlitzer Straße 1, 41460 Neuss, Germany

Privacy notice: https://www.ups.com/de/de/support/shipping-support/legal-terms-conditions/privacy-notice.page

JUMiNGO GmbH

Breslauer Platz 4, 50668 Köln, Germany

Privacy notice: https://www.jumingo.com/datenschutz

JUMiNGO arranges shipping through affiliated transport companies; the data required for delivery is passed on to the company selected in each case.

The legal basis is Art. 6(1)(b) GDPR. Your email address or telephone number is passed on for the purpose of delivery notifications only where you have consented to this (Art. 6(1)(a) GDPR); you may withdraw this consent at any time.

For international shipments via UPS, data may be transferred to group companies outside the EU. Such transfers take place on the basis of the EU standard contractual clauses pursuant to Art. 46 GDPR.

10. Newsletter and Email Marketing (Klaviyo)

10.1 Service Provider

We use the service Klaviyo to send our newsletter and automated emails. The provider is Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA.

On our behalf, Klaviyo processes your email address, where applicable your name, as well as data on your orders and your behaviour in our shop, so that we can send you relevant information.

We have concluded a data processing agreement with Klaviyo pursuant to Art. 28 GDPR. The transfer to the USA takes place on the basis of the EU-U.S. Data Privacy Framework, under which Klaviyo is certified, and additionally on the basis of the EU standard contractual clauses pursuant to Art. 46 GDPR.

Privacy notice: https://www.klaviyo.com/legal/privacy-notice

10.2 Sign-Up and Consent

If you would like to subscribe to our newsletter, we require your email address. Registration takes place using the double opt-in procedure: after signing up, you will receive an email in which you must confirm your subscription. Only then do we send the newsletter. We store the time of sign-up, the IP address and the time of confirmation as evidence of your consent.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example via the unsubscribe link at the end of every newsletter email or by sending us a message.

10.3 Performance Measurement and Personalisation

Our newsletters contain tracking pixels and individualised links. This allows us to record whether and when an email was opened and which links were clicked. In addition, we process your order history and your usage behaviour in our shop in order to send you the most relevant content possible.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you give when signing up for the newsletter. Withdrawal is possible at any time; it also takes effect as an unsubscription from the newsletter.

10.4 Website Tracking by Klaviyo

Klaviyo uses cookies or comparable technologies on our website in order to assign your behaviour in our shop — such as products viewed or abandoned shopping carts — to your profile.

This takes place exclusively on the basis of your consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR, which you can give via our cookie banner. You may withdraw your consent there at any time.

10.5 Storage Period

We store your email address for the duration of your newsletter subscription. After you unsubscribe, we store it on a suppression list in order to prevent future mailings; the legal basis for this is our legitimate interest pursuant to Art. 6(1)(f) GDPR. We retain the records of your consent for the duration of the applicable limitation periods.

11. Web Analytics with Google Analytics 4

We use the analytics service Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies and similar technologies which allow us to analyse the behaviour of website visitors. Among other things, the pages accessed, time spent on the site, approximate location, device used, operating system and browser as well as the source of the visit are recorded. The IP address is processed by Google in truncated form.

Use takes place exclusively on the basis of your consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future via our cookie banner.

A transfer of data to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework; in addition, Google has agreed to the EU standard contractual clauses. A data processing agreement pursuant to Art. 28 GDPR is in place with Google.

Privacy notice: https://policies.google.com/privacy

Browser add-on to opt out: https://tools.google.com/dlpage/gaoptout

12. Meta Pixel

We use the Meta Pixel on our website. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

The Meta Pixel allows us to track the behaviour of visitors after they have reached our website via an advertisement on Facebook or Instagram. This makes it possible to evaluate the effectiveness of our advertising. The pixel also enables the creation of target audiences and the delivery of advertising to people who have already shown an interest in our offering.

The data collected is not directly accessible to us; it is stored and processed by Meta. A link to your Meta account is possible if you are logged in to Facebook or Instagram. With regard to the collection and transmission of the data, we and Meta are joint controllers within the meaning of Art. 26 GDPR.

Joint controller agreement: https://www.facebook.com/legal/controller_addendum

A transfer to Meta Platforms, Inc. in the USA cannot be ruled out. Meta is certified under the EU-U.S. Data Privacy Framework; in addition, the EU standard contractual clauses apply.

Privacy notice: https://www.facebook.com/privacy/policy

Ad settings: https://www.facebook.com/settings?tab=ads

13. Our Social Media Profiles

We maintain profiles on Instagram, Facebook and TikTok. On our website we merely link to these profiles; simply accessing our website does not transmit any data to these networks.

If you follow a link and access the respective network, the provider processes your data in accordance with its own terms. We have no influence over this processing.

The providers are Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (Instagram, Facebook) and TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland (TikTok).

14. Storage Period

Unless a specific storage period is stated in this privacy policy, we process your personal data only for as long as is necessary for the respective purpose.

We then delete the data, provided that no statutory retention obligations apply. Retention periods under commercial and tax law are generally six or ten years respectively. For this period, processing is restricted to fulfilling the retention obligation.

15. Your Rights

You have the following rights in relation to your personal data:

access to the data we process (Art. 15 GDPR)

rectification of inaccurate or incomplete data (Art. 16 GDPR)

erasure of your data (Art. 17 GDPR)

restriction of processing (Art. 18 GDPR)

data portability in a structured, commonly used and machine-readable format (Art. 20 GDPR)

objection to processing (Art. 21 GDPR)

withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, a message to the email address stated above is sufficient.

Right to Object under Art. 21 GDPR

Where data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing for this purpose. Following your objection, your data will no longer be used for direct marketing purposes.

Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)

Promenade 18, 91522 Ansbach, Germany

https://www.lda.bayern.de

16. Data Security

For security reasons, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” in your browser's address bar and by the padlock symbol. When encryption is active, the data you transmit to us cannot be read by third parties.

17. Changes to This Privacy Policy

We will amend this privacy policy as soon as changes to the data processing we carry out or to the legal situation make this necessary. The version published on this page applies in each case.

PK-Plants