Privacy policy

Last updated: 31 October 2026

This English version is provided for your convenience. The German version is legally binding.

Protecting your personal data is important to us. Below, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), we explain which data we process, for which purposes and on which legal basis.

1. Controller

Lotéa Naturals
Owner: Lilya Papazyan
Damerowstraße 58K
13187 Berlin
Germany
Email: info@lotea.de

2. Legal bases

We process personal data on the following legal bases:

  • Art. 6(1)(a) GDPR – your consent (e.g. newsletter, non-essential cookies),
  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual steps (e.g. order, customer account),
  • Art. 6(1)(c) GDPR – legal obligations (e.g. retention obligations under tax and commercial law),
  • Art. 6(1)(f) GDPR – legitimate interests (e.g. secure and stable operation of the online shop, fraud prevention).

Storing and accessing information on your device (e.g. cookies) is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

3. Shop platform and hosting (Shopify)

Our online shop runs on the Shopify platform. For customers in Europe, the provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes on our behalf the data generated when you visit the shop and place orders, and provides the checkout. Data may also be transferred to servers in Canada, the USA or other third countries. These transfers are based on adequacy decisions of the European Commission (e.g. for Canada and for companies certified under the EU-U.S. Data Privacy Framework) or on EU Standard Contractual Clauses. We have a data processing agreement with Shopify (Art. 28 GDPR).

When you visit our website, technical data is processed automatically (e.g. IP address, date and time, pages visited, browser, operating system, referrer URL). This is necessary to deliver the website and keep it secure (Art. 6(1)(f) GDPR).

4. Cookies and consent

We use technically necessary cookies so that the shop works (e.g. cart, checkout, language setting, storing your cookie choice). The legal basis is Section 25(2) TDDDG in conjunction with Art. 6(1)(b) or (f) GDPR.

We only use cookies and similar technologies for statistics, personalisation or marketing if you have consented via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future via the “Cookie settings” or “Cookies” link in the checkout or by deleting the cookies in your browser.

5. Analytics and advertising (only with your consent)

Only if you have agreed in the cookie banner do we use the following services to analyse how our shop is used and to show our advertising and measure its success. In particular, page views, viewed products, cart and purchase events, device and browser data, your IP address and cookie identifiers are processed. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Without your consent, these services are not loaded.

  • Meta (Instagram and Facebook): Meta Pixel and Conversions API via Shopify’s “Facebook & Instagram” sales channel. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. We use the data to show ads on Instagram and Facebook and to measure their success. With your consent, these events are also sent to Meta directly from Shopify’s servers. We are jointly responsible with Meta for collecting the data and transmitting it to Meta (Art. 26 GDPR); further processing is Meta’s responsibility.
  • Google (Google Analytics and Google Ads): via Shopify’s “Google & YouTube” sales channel. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the data for usage statistics and to measure our advertising.
  • Amazon: pixel of the “Amazon MCF and Buy with Prime” app. The provider is Amazon EU S.à r.l., 38 Avenue John F. Kennedy, L-1855 Luxembourg. Page views and purchase events are sent to Amazon.

Meta, Google and Amazon may also transfer data to the USA. These companies are certified under the EU-U.S. Data Privacy Framework; EU Standard Contractual Clauses also apply. You can withdraw your consent at any time with effect for the future via the cookie settings.

6. Orders and contract processing

When you order from us, we process the data required for this: name, delivery and billing address, email address, phone number if provided, order and payment information. This processing is necessary to perform the contract (Art. 6(1)(b) GDPR). Mandatory fields are marked at checkout; without this information we cannot conclude the contract.

We store your order data for as long as necessary to process the contract and beyond that for the statutory retention periods (up to ten years under commercial and tax law, Art. 6(1)(c) GDPR).

7. Customer account

You can choose to create a customer account to view and manage your orders and subscriptions. For this, we process your email address and the data stored in the account (Art. 6(1)(b) GDPR). You can request deletion of your customer account at any time by emailing info@lotea.de; statutory retention periods remain unaffected.

8. Payment providers

To process payments, we pass the necessary payment data to the payment provider you choose (Art. 6(1)(b) GDPR):

  • Shopify Payments (credit card, Apple Pay, Google Pay, Shop Pay) – in cooperation with Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland;
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg;
  • Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Depending on the payment method, Klarna may carry out an identity and credit check;
  • Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) and Google Pay (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), if you choose these payment methods.

The payment providers partly process your data under their own responsibility. For more information, please see their privacy notices.

9. Shipping

To deliver your order, we pass your name and delivery address to the shipping and logistics service providers we use, who store, pack and ship the goods (Art. 6(1)(b) GDPR). We only pass on your email address or phone number if you have agreed to this, so that the carrier can notify you about the delivery (Art. 6(1)(a) GDPR).

10. Subscriptions

For subscriptions (“Subscribe and save”), we use Shopify’s “Shopify Subscriptions” app. We process the data required for recurring deliveries and billing (Art. 6(1)(b) GDPR).

11. Newsletter and pop-up

If you sign up for our newsletter (e.g. via the pop-up, the footer or at checkout), we use your email address to send you information about products, care tips and offers. The legal basis is your consent (Art. 6(1)(a) GDPR). We use the double opt-in procedure: after signing up, you receive an email in which you confirm your subscription. We store the time of sign-up and confirmation so that we can prove your consent.

You can unsubscribe at any time, e.g. via the unsubscribe link in every email or by emailing info@lotea.de. Your data will then be deleted from or blocked on the mailing list.

For the sign-up pop-up, we use the “Pop Convert” app; Pop Convert also sends you the email with your discount code after you sign up. To send newsletters, we use Shopify Messaging (formerly Shopify Email) from Shopify (see section 3). We have data processing agreements with these providers.

12. Contacting us

If you contact us by email, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR). We delete the data once your request has been dealt with and no statutory retention obligations apply.

13. Social media

Our website links to our profiles on Instagram and TikTok. These are simple links; no data is transferred until you click a link and visit the platform. The privacy notices of the respective providers apply there.

14. Storage period

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods. After that, the data is deleted.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). Simply contact us at info@lotea.de.

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can object to processing for direct marketing purposes at any time without giving reasons.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59–61, 10555 Berlin, Germany.

16. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. For Klarna’s credit check, see section 8.

17. Data security

Our website and checkout are encrypted with SSL/TLS. We take technical and organisational measures to protect your data against loss and unauthorised access.

18. Changes

We update this privacy policy when our services or the legal situation change. The current version on this page applies.