Privacy Policy

Privacy Policy

Introduction

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as “data”) that we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, on mobile devices, and within external online presences such as our social media profiles (hereinafter collectively referred to as “Online Offering”).

The terms used are not gender-specific.

Last updated: 05.05.2026

Table of Contents

  • Introduction
  • Controller
  • Overview of Processing Activities
  • Data Protection Officer
  • Applicable Legal Bases
  • Security Measures
  • Transfer and Disclosure of Personal Data
  • Data Processing in Third Countries
  • Use of Cookies
  • Commercial and Business Services
  • Payment Service Providers
  • Credit Checks
  • Provision of the Online Offering and Web Hosting
  • Contact
  • Newsletter and Electronic Notifications
  • Plugins and Embedded Functions and Content
  • Deletion of Data
  • Changes and Updates to the Privacy Policy
  • Rights of Data Subjects
  • Definitions

Controller

Peteniel GmbH
Ludwig-Ganghofer-Straße 1
82031 Grünwald
Germany

Email: info@wholesale-kratom.eu

Imprint: https://wholesale-kratom.eu/imprint/

Data Protection Officer

Email: info@peteniel.de

Overview of Processing Activities

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects concerned.

Types of Data Processed

  • Inventory data (e.g. names, addresses)
  • Content data (e.g. entries in online forms)
  • Contact data (e.g. email, telephone numbers)
  • Meta/communication data (e.g. device information, IP addresses)
  • Usage data (e.g. websites visited, interest in content, access times)
  • Contract data (e.g. subject of contract, term, customer category)
  • Payment data (e.g. bank details, invoices, payment history)

Categories of Data Subjects

  • Business and contractual partners
  • Prospects
  • Communication partners
  • Customers
  • Users (e.g. website visitors, users of online services)

Purposes of Processing

  • Provision of our online offering and user-friendliness
  • Visitor action evaluation
  • Office and organisational procedures
  • Direct marketing (e.g. by email or post)
  • Contact enquiries and communication
  • Conversion measurement (measuring the effectiveness of marketing activities)
  • Security measures
  • Provision of contractual services and customer service
  • Administration and response to enquiries

Applicable Legal Bases

Below we share the legal bases of the General Data Protection Regulation (GDPR) on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile.

  • Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Security Measures

We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

These measures include in particular ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access, input, transfer, availability and separation. Furthermore, we have established procedures to ensure the exercise of data subject rights, the deletion of data and responses to threats to data. We also take the protection of personal data into account during the development or selection of hardware, software and procedures in accordance with the principle of data protection by design and by default.

SSL/TLS Encryption (https): To protect your data transmitted via our online offering, we use SSL/TLS encryption. You can recognise such encrypted connections by the prefix https:// in the address bar of your browser.

Transfer and Disclosure of Personal Data

In the context of our processing of personal data, it may happen that the data is transferred to or disclosed to other entities, companies, legally independent organisational units or persons. Recipients of this data may include, for example, payment institutions in the context of payment transactions, service providers commissioned with IT tasks, or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and in particular conclude appropriate contracts or agreements to protect your data with the recipients of your data.

Data Processing in Third Countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, entities or companies, this is only done in accordance with the legal requirements.

Subject to express consent or contractually or legally required transfer, we only process or have data processed in third countries with a recognised level of data protection, contractual obligation through so-called standard contractual clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 GDPR).

Use of Cookies

Cookies are small text files or other storage markers that store information on end devices and read information from end devices. For example, to save the login status in a user account, shopping cart contents in an e-shop, the content accessed or functions used in an online offering. Cookies can also be used for various purposes, e.g. for the purposes of functionality, security and convenience of online offerings and the creation of analyses of visitor flows.

Information on consent: We use cookies in accordance with legal requirements. Therefore, we obtain prior consent from users, except where this is not required by law. Consent is not necessary in particular if the storage and reading of information, including cookies, is strictly necessary to provide users with a telemedia service they have expressly requested (i.e. our online offering). Revocable consent is clearly communicated to users and contains information about the respective cookie usage.

Storage duration: The following types of cookies are distinguished with regard to storage duration:

  • Temporary cookies (session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their end device (e.g. browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status can be saved or preferred content can be displayed directly when the user revisits a website. Unless we provide users with explicit information about the type and storage duration of cookies (e.g. as part of obtaining consent), users should assume that cookies are permanent and the storage duration can be up to two years.

General information on revocation and objection (opt-out): You can revoke consent given at any time or object to the processing of your data by cookie technologies. You can initially declare your objection through your browser settings, e.g. by deactivating the use of cookies (which may also limit the functionality of our online offering). An objection to the use of cookies for online marketing purposes can also be declared via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

Commercial and Business Services

We process data of our contractual and business partners, e.g. customers and prospects (collectively referred to as “contractual partners”) in the context of contractual and comparable legal relationships and related measures and in the context of communication with contractual partners (or pre-contractually), e.g. to answer enquiries.

We process this data to fulfil our contractual obligations, to secure our rights and for the purposes of the administrative tasks associated with this information and business organisation. We only disclose the data of contractual partners to third parties within the scope of applicable law insofar as this is necessary for the aforementioned purposes or for the fulfilment of legal obligations or with the consent of the data subjects.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e. generally after 4 years, unless the data is stored in a customer account, e.g. as long as it must be retained for legal archiving reasons (e.g. for tax purposes, generally 10 years).

Customer account: Contractual partners can create an account within our online offering (e.g. customer or user account). If registration of a customer account is required, contractual partners will be informed of this as well as of the information required for registration. Customer accounts are not public and cannot be indexed by search engines.

Shop and e-commerce: We process the data of our customers to enable them to select, purchase or order the chosen products, goods and related services, as well as their payment and delivery or execution. If necessary for the execution of an order, we use service providers, in particular postal, forwarding and shipping companies, to carry out the delivery to our customers. For the processing of payment transactions, we use the services of banks and payment service providers.

  • Data types processed: Inventory data, payment data, contact data, contract data, usage data, meta/communication data.
  • Data subjects: Prospects, business and contractual partners, customers.
  • Purposes: Provision of contractual services and customer service, contact enquiries and communication, office and organisational procedures, administration and response to enquiries, security measures.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Payment Service Providers

In the context of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and use other payment service providers in addition to banks and credit institutions (collectively “payment service providers”).

The data processed by the payment service providers includes inventory data such as name and address, bank data such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, sum and recipient-related information. The information is required to carry out the transactions. However, the data entered is only processed and stored by the payment service providers. We do not receive any account or credit card related information, but only information confirming or negating the payment.

  • Data types processed: Inventory data, payment data, contract data, usage data, meta/communication data.
  • Data subjects: Customers, prospects.
  • Purposes: Provision of contractual services and customer service.
  • Legal bases: Performance of a contract (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Provision of the Online Offering and Web Hosting

To be able to provide our online offering securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offering can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security services and technical maintenance services.

The data processed in the context of providing the hosting offering may include all information relating to users of our online offering that arises in the course of use and communication. This regularly includes the IP address, which is necessary to deliver the content of online offerings to browsers, and all entries made within our online offering or on websites.

Email sending and hosting: The web hosting services we use also include the sending, receiving and storage of emails.

Collection of access data and log files: We ourselves (or our web hosting provider) collect data on each access to the server (so-called server log files). Server log files may include the address and name of the web pages and files accessed, date and time of access, data volumes transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

  • Data types processed: Content data, usage data, meta/communication data.
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Contact

When contacting us (e.g. via contact form, email, telephone or social media), the information provided by the enquiring persons is processed insofar as this is necessary to answer the contact enquiries and any requested measures.

  • Data types processed: Inventory data, contact data, content data, usage data, meta/communication data.
  • Data subjects: Communication partners, prospects.
  • Purposes: Contact enquiries and communication, administration and response to enquiries.
  • Legal bases: Performance of a contract (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Newsletter and Electronic Notifications

We send newsletters, emails and other electronic notifications (hereinafter “newsletter”) only with the consent of the recipients or with legal permission. If the contents of the newsletter are specifically described in the context of registration, they are decisive for user consent. Otherwise, our newsletters contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to provide your email address. We may, however, ask you to provide a name for personal salutation in the newsletter or further information if this is required for the purposes of the newsletter.

Double opt-in procedure: Registration for our newsletter generally takes place in a so-called double opt-in procedure. This means that after registration you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register with third-party email addresses.

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them in order to be able to prove a previously given consent.

Analysis and performance measurement: Newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from our server (or, if we use a mailing service provider, from their server) when the newsletter is opened. This information is used for the technical improvement of our newsletter.

  • Data types processed: Inventory data, contact data, meta/communication data, usage data.
  • Data subjects: Communication partners.
  • Purposes: Direct marketing (e.g. by email or post).
  • Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).
  • Opt-out: You can cancel receipt of our newsletter at any time, i.e. revoke your consent or object to further receipt. You will find a link to cancel the newsletter either at the end of each newsletter or you can use one of the contact options listed above, preferably email.

Plugins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos or social media buttons and posts (hereinafter uniformly referred to as “content”).

The integration always requires that the third-party providers of this content process the IP address of the users, as without the IP address they would not be able to send the content to their browsers. The IP address is therefore required for the display of this content or functions.

  • Data types processed: Usage data, meta/communication data, content data, inventory data, contact data.
  • Data subjects: Users, communication partners.
  • Purposes: Provision of our online offering and user-friendliness, provision of contractual services and customer service, security measures.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR), consent (Art. 6(1)(a) GDPR), performance of a contract (Art. 6(1)(b) GDPR).

Services and service providers used:

  • Google Fonts: We integrate fonts (“Google Fonts”) from Google, whereby user data is used solely for the purpose of displaying fonts in the user’s browser. The integration is based on our legitimate interests in a technically secure, maintenance-free and efficient use of fonts, their uniform presentation, and taking into account possible licensing restrictions for their integration. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://fonts.google.com/; Privacy policy: https://policies.google.com/privacy.
  • Google reCAPTCHA: We integrate the “reCAPTCHA” function to be able to recognise whether entries (e.g. in online forms) are made by humans and not by automatically acting machines (so-called “bots”). Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://www.google.com/recaptcha/; Privacy policy: https://policies.google.com/privacy.

Deletion of Data

The data processed by us will be deleted in accordance with the legal requirements as soon as the consents permitted for processing are revoked or other permissions cease to apply (e.g. if the purpose of processing this data no longer applies or it is not required for the purpose).

If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to these purposes. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

Changes and Updates to the Privacy Policy

We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Rights of Data Subjects

As data subjects, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

  • Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw consent given at any time.
  • Right of access: You have the right to obtain confirmation as to whether data concerning you is being processed and to access this data as well as further information and a copy of the data in accordance with the legal requirements.
  • Right to rectification: You have the right, in accordance with the legal requirements, to request the completion of data concerning you or the rectification of inaccurate data concerning you.
  • Right to erasure and restriction of processing: You have the right, in accordance with the legal requirements, to request that data concerning you be erased without undue delay, or alternatively to request restriction of the processing of the data in accordance with the legal requirements.
  • Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the legal requirements, or to request its transfer to another controller.
  • Complaint to a supervisory authority: You also have the right, in accordance with the legal requirements, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Definitions

  • Personal data: “Personal data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Controller: “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: “Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data, including collection, evaluation, storage, transfer or deletion.
  • Conversion measurement: Conversion measurement (also known as “conversion tracking”) is a method by which the effectiveness of marketing measures can be determined. For this purpose, a cookie is generally stored on the devices of users within the websites on which the marketing measures take place and then retrieved again on the target website.
  • Profiling: “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
  • Reach measurement: Reach measurement (also referred to as web analytics) is used to evaluate visitor flows to an online offering and may include the behaviour or interests of visitors in certain information, such as website content.
  • Remarketing: “Remarketing” or “retargeting” refers to the practice of noting which products a user was interested in on a website, in order to remind the user of these products on other websites, e.g. in advertisements.
  • Tracking: “Tracking” refers to the ability to track user behaviour across multiple online offerings. As a rule, behavioural and interest information is stored in cookies or on the servers of the tracking technology providers with regard to the online offerings used (so-called profiling).

This privacy policy was created for wholesale-kratom.eu, operated by Peteniel GmbH.