Privacy policy

Your chosen website language is stored for 180 days in the kg_language cookie. Translations are provided locally; no text is sent to an external translation service for this purpose.

1. Responsible

Elmar Pustlauck, KROKOGRA® Premium Natural Skincare
Elmar Pustlauck
Amsbergring 10
38667 Bad Harzburg
Germany
Telefon: +49 5322 9291026
Email: info@krokogra.com

2. Hosting and server protocols

This website will be at IONOS SE, Elgendorfer Straße 57, 56410 Montabaur hosted. When called up, the hosting provider processes in particular IP address, date and time, accessed address, referrer, browser and operating system information as well as transmission status. The processing is necessary for secure, stable and error-free provision (Art. 6 para 1 lit. f GDPR). Insofar as an order processing exists, it takes place on the basis of a contract according to Art. 28 GDPR. Server protocols are periodically not more than 8 weeks, unless a security incident requires longer retention stored. In addition, the following apply: Data protection notices of IONOS.

3. Encryption

The website uses TLS encryption. An encrypted connection can be recognized by “https://” and the browser’s lock icon.

4. Technically necessary cookies and browser storage

WordPress and WooCommerce set necessary cookies for shopping cart, checkout, customer account, registration and security. The acknowledgement of the cookie notice is under krokogra_cookie_choice_v1 stored in the local memory of the browser. The legal basis for accessing the terminal is § 25 para 2 no. 2 TDDDG; the subsequent data processing is based on Art. 6 para 1 lit. b or f GDPR, depending on the function. Names, purposes and regular maturities are under Cookie information listed. The delivered theme does not activate analytics or marketing cookies.

5. Orders and execution of contracts

For ordering, payment, delivery, customer service, return processing and legal warranty, we process master, contact, invoice, delivery, payment, order and communication data. The legal basis is Art. 6 para 1 lit. b GDPR; legally prescribed accounting and proof obligations are based on Art. 6 para 1 lit. c GDPR. Without the information marked as mandatory field, a contract or delivery is not possible. Documents relevant to contract and tax law are regularly stored for six, eight or ten years depending on the document; they are subsequently deleted, provided that no open claims or legal obligations conflict.

Gift certificates: When purchasing a gift voucher, we additionally process the name and email address of the gifted person, the name of the giftee, the selected delivery date and a voluntary personal message. This information is used exclusively to create the voucher, deliver it by e-mail at the desired time, manage credit balances and partial redemptions and prevent misuse (Art. 6 para 1 lit. b and f GDPR). Please only provide data of third parties if you are entitled to do so.

Optional address completion: The browser autocomplete only uses the address data stored locally in the browser. If you activate the voluntary PLZ-Ort query in the checkout and click on "Add location", only the entered German postcode will be sent to the OpenPLZ API transmitted to retrieve the place name. Street, house number and name are not transmitted and the answer is not saved by the theme. Without activation, the query remains completely deactivated. In addition, the data protection notices of the third party apply.

6. Customer account

When registering, we process login, master, address and order data in order to provide the desired customer account (Art. 6 para 1 lit. b GDPR). The account shall remain in place until deletion by the customer or at his request. Order documents to be kept by law will be kept blocked regardless of the account deletion until the expiry of the respective period.

7. Wish list and release link

Registered customers can store product IDs in a personal wish list. When sharing, the system creates a random share key. Anyone who has the full link can call up the product favorites contained therein without registering; name, e-mail address and order history are not displayed via the link. The release link is regular 90 Days valid and can be revoked early in the customer account. Wish list and key are stored with the customer account and deleted upon deletion or on request. The legal basis is Art. 6 para 1 lit. b GDPR.

8. Payment processing

At Vorkasse we process the banking and order data required for assignment (Art. 6 para 1 lit. b GDPR). If PayPal is selected after installation and connection of the official WooCommerce extension, the data required for payment processing will be transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. The legal basis is Art. 6 para 1 lit. b GDPR. PayPal processes further data under its own responsibility; details are in the PayPal Privacy Notice. Depending on the payment method used, data may be processed in third countries subject to the conditions of Articles 44 et seq. GDPR.

9. Shipping with DHL

For delivery, we transmit the name and delivery address to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn (Art. 6 para 1 lit. b GDPR). An e-mail address or telephone number will only be transmitted if this is necessary for a desired delivery announcement or if there is a separate consent. Shipment numbers are assigned to the order and displayed in the customer account. Further information shall include: Data protection declaration of DHL.

10. Electronic revocation function

When using the “Contract Revoked” function, we process the name, order or contract identifier, e-mail address, scope of revocation, products affected, time of receipt and confirmation number. The information is required to accept the revocation, to confirm its receipt immediately and to carry out the reversal (Art. 6 para 1 lit. b and c GDPR). Recipients are internally responsible for the contract processing as well as the e-mail and hosting providers within the framework of the technical transmission. Confirmed revocations are regularly 6 stored for years and then automatically deleted, unless there is a longer legal obligation or an ongoing legal case. Unconfirmed inputs expire after 30 minutes; the displayed acknowledgement of receipt after another 30 minutes.

11. Contact form, e-mail and telephone

When contacting us, we process name, contact data, subject and message. The legal basis is Art. 6 para 1 lit. b DSGVO for contract-related inquiries, otherwise Art. 6 para 1 lit. f DSGVO. The contact form does not store the message in a public database, but transmits it by e-mail. Non-contractually relevant requests are regularly deleted no later than six months after final processing. Contractual or proof-relevant correspondence can be stored longer within the framework of statutory deadlines.

12. Newsletter and discount code

The newsletter will only be sent after registration and confirmation of a link sent by e-mail (double opt-in). E-mail address, request and confirmation time, proof value, deregistration key and the assigned discount code are processed. The legal basis for the shipment is Art. 6 para 1 lit. a GDPR; the logging of the consent serves as proof according to Art. 6 para 1 lit. f GDPR. The consent can be revoked at any time via the log-out link or by message. When logged out, the system deletes the active subscriber record. The lawfulness of previous processing remains unaffected.

13. Dealer and Partner Area

For unlocked accounts, we process contact data, entrepreneurial characteristics, individual conditions, minimum order values, discount levels, partner code, technically assigned orders, commission type and amount, payout status and billing data. When redeeming an affiliate code, the affiliate ID and code are stored until the code is removed, the WooCommerce session expires or is accepted into the order. The legal basis is Art. 6 para 1 lit. b GDPR; commercial and tax proofs are based on Art. 6 para 1 lit. c GDPR. Recipients are the internally responsible persons and, where applicable, the agreed payment or billing service. Invoicing-relevant data is kept in accordance with the statutory deadlines.

14. Invoices and tracing

In the customer account, billing views, payment method, delivery date and DHL shipment number are generated from the order data. Access is only possible for the registered orderer or authorized administrators. The legal basis is Art. 6 para 1 lit. b and c GDPR. The data shall be kept together with the associated contractual and accounting documents.

15. Product evaluations

Reviews can only be submitted by registered customers who have purchased the product in question via the shop. For the purpose of verification, the evaluation is compared with the order belonging to the customer account. Publicly appear the selected display name, rating text, star rating and the reference to a verified purchase, but not e-mail address, address or order number. The legal basis is Art. 6 para 1 lit. f GDPR. Reviews remain published until they are deleted or a legitimate objection.

16. Brand film and social networks

The brand film is loaded directly from its own web storage. The buttons on Facebook, Instagram, YouTube, Pinterest and TikTok are simple external links. Only when clicking on the respective platform is called up; their own data protection notices apply. The theme does not reload embedded social media or video content on a mere page view.

17. Consignee and third country transfers

Recipients receive data only insofar as this is necessary for hosting, e-mail, IT operation, payment, shipping, tax consulting, law enforcement or legal obligations. Processors are obliged in accordance with Art. 28 GDPR. Transfers outside the European Economic Area are only made under the conditions of Art. 44 ff. GDPR, in particular based on an adequacy decision or appropriate guarantees.

18. Your rights

In accordance with the legal requirements, you have rights to access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and revocation of consent (Art. 7 para 3 GDPR). In addition, there is a right of complaint to a data protection supervisory authority. Responsible is in particular the Land Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover, Germany www.lfd.niedersachsen.de.

19 Objection and direct mail

If data is processed on the basis of legitimate interests, you can object for reasons arising from your particular situation. You can object to processing for direct marketing at any time without giving reasons.

20. Automated decisions

An exclusively automated decision-making with legal or similar significant effect does not take place by the theme.

21. Updating of this declaration

In the case of new plugins, payment methods, analytics, marketing, chat, card or embedding services, this data protection declaration must be adapted before it is activated and, if necessary, a consent management must be set up.

Stand: 19 September 2026