Cart

Your cart is empty

Privacy policy

Last updated: 11/06/2026

This Privacy Policy explains how we process personal data when you use our website https://bionera.co.uk and our social media profiles. "Personal data" means any information relating to an identifiable individual, such as a name or an IP address.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Controller and contact details

The controller responsible for the processing described here is:

Naturida GmbH
Kienberger Allee 4
12529 Schönefeld
Germany
Email: info@bionera.co.uk
Represented by: Felix Malte Lüer

UK GDPR representative (Article 27):
UK Compliance ltd, 60 Tottenham Court Rd, Suite 5839a, W1T 2EW, London,
hello@ukcompliancepartner.com

Our data protection officer can be reached via
heyData GmbH
Schützenstraße 5
10117 Berlin
Germany
www.heydata.eu
email: datenschutz@heydata.eu.

2. Legal bases for processing

Depending on the situation, we rely on the following legal bases under Article 6(1) UK GDPR:

  • Consent (Art. 6(1)(a)) — for processing where we ask for your consent, for example certain cookies and marketing.
  • Performance of a contract (Art. 6(1)(b)) — where processing is necessary to fulfil a contract with you (for example when you buy a product) or to take pre-contractual steps at your request.
  • Legal obligation (Art. 6(1)(c)) — where we must process data to comply with the law, for example tax and accounting obligations.
  • Legitimate interests (Art. 6(1)(f)) — where processing is necessary for our legitimate interests and is not overridden by your rights, for example for the technical operation and security of our website.

3. International data transfers

We are based in Germany and use service providers in the European Economic Area (EEA) and elsewhere. Where we transfer your personal data outside the UK, we rely on one of the following safeguards:

  • UK adequacy regulations — the UK government has determined that the EEA (which includes Germany) and certain other countries provide an adequate level of protection.
  • The UK Extension to the EU–US Data Privacy Framework — for transfers to providers in the United States that are certified under it.
  • The UK International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses — where no adequacy decision applies, together with additional safeguards where appropriate.

4. How long we keep data

We delete personal data once it is no longer needed for the purpose for which it was collected, unless we are required to keep it to meet a legal retention obligation (for example tax or accounting law). Where data must be kept for such reasons, we restrict its processing instead of deleting it.

5. Your rights

You have the following rights in relation to your personal data:

  • the right to be informed and the right of access;
  • the right to rectification (correction) and erasure (deletion);
  • the right to restrict processing;
  • the right to object to processing;
  • the right to data portability;
  • the right to withdraw any consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, contact us using the details in section 1.

You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
www.ico.org.uk

6. Providing your data

In a business relationship with us you generally only need to provide the personal data that is necessary to enter into and perform the contract, or that we are legally required to collect. Without this data we will usually be unable to enter into or continue the contract. Mandatory fields are marked as such.

7. No automated decision-making

We do not generally use solely automated decision-making within the meaning of Article 22 UK GDPR. If we do so in an individual case, we will inform you separately where legally required.

8. Contacting us

If you contact us (for example by email or through our contact form), we store the data you provide in order to deal with your enquiry. The legal basis is our legitimate interest in responding to enquiries (Art. 6(1)(f) UK GDPR), or the performance of a contract where your enquiry relates to one. We delete this data when it is no longer needed, unless a retention obligation applies.

9. Newsletter and marketing emails

If you subscribe to our newsletter, we process the data you provide solely to send you the newsletter, on the basis of your consent (Art. 6(1)(a) UK GDPR). You can withdraw your consent at any time, for example via the unsubscribe link in any newsletter.

Where you have bought from us, we may send you marketing about our similar products by email unless you object, on the basis of our legitimate interest in direct marketing (Art. 6(1)(f) UK GDPR) and in accordance with PECR. You can object at any time, free of charge, via the unsubscribe link or by contacting us.

We send newsletters using Klaviyo (Klaviyo, Inc., 125 Summer St, Floor 6, Boston, MA 02111, USA) and/or Shopify (Shopify International Limited, 1–2 Victoria Buildings, Haddington Road, Dublin 4, Ireland). Transfers to the USA are protected as described in section 3.

10. Cookies and similar technologies

Our website stores information on your device (for example cookies) or accesses information already stored on it. Strictly necessary cookies, which are required to provide a service you have requested or to ensure the security of our website, are used on the basis of our legitimate interest. All other cookies and similar technologies are used only with your consent, which you give through our cookie banner and can withdraw at any time via the cookie settings. This reflects the requirements of PECR and the UK GDPR.

11. Website operation and hosting

Our website is provided through Shopify (Shopify International Limited, 1–2 Victoria Buildings, Haddington Road, Dublin 4, Ireland), which processes data such as content, usage, metadata/communication data and contact data. Legal basis: our legitimate interest in providing the website (Art. 6(1)(f) UK GDPR). Privacy information: https://www.shopify.com/legal/privacy

We use the content delivery network and security service Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) on the basis of our legitimate interest in the performance and security of our website (Art. 6(1)(f) UK GDPR). Privacy information: https://www.cloudflare.com/privacypolicy/

When you simply browse the website, our server automatically receives certain technical data (such as your IP address, date and time of request, the page requested, HTTP status code, data volume, referring website, browser, operating system and language). This is processed to ensure the stability and security of the website (Art. 6(1)(f) UK GDPR) and stored in log files for no longer than necessary, and at most 14 days.

12. Orders and fulfilment

When you place an order we process your first and last name, address, email address and payment information in order to perform the contract (Art. 6(1)(b) UK GDPR).

We pass this data to the service providers needed to fulfil your order, including our fulfilment provider Monta Services B.V., Weide 30, 4206 CJ Gorinchem, Netherlands.

13. Payment service providers

We use payment service providers to process payments; these providers are independent controllers for the payment data they receive. Where they receive data you enter during the order process, this serves to perform the contract with you (Art. 6(1)(b) UK GDPR). Depending on the payment method you choose, these may include:

  • Shopify Inc., Canada (for Shop Pay)
  • Stripe Payments Europe, Ltd., Ireland (for Shopify Payments)
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg
  • Klarna Bank AB (publ), Sweden
  • Apple Inc., USA (Apple Pay)
  • Google Ireland Limited (Google Pay)
  • Mastercard Europe SA, Belgium / Visa Europe Services Inc.

14. Analytics, advertising and other third-party services

Depending on the consent you give in our cookie banner, we may use the following services. Unless stated otherwise, where these involve a transfer outside the UK the safeguards in section 3 apply.

15. Social media profiles

We maintain profiles on Facebook and Instagram (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) and LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). When you interact with us through these profiles, we process the data you provide in order to respond, on the basis of our legitimate interest (Art. 6(1)(f) UK GDPR). The platform operators process user data for their own purposes; see their respective privacy notices.

16. Changes to this Privacy Policy

We may update this Privacy Policy with effect for the future. The current version is always available on this page.

17. Questions

For any questions or comments about this Privacy Policy, please contact us using the details in section 1.