Privacy Policy

The controller within the meaning of the GDPR and the German Federal Data Protection Act (BDSG) is Olive Hometex GmbH, Amit Kumar, Mahatma Gandhi Straße 40, 70376 Stuttgart, Baden-Württemberg, Germany.

If you have questions about the processing of your personal data, please contact us, including for requests for information, applications, or complaints:

When you access our website or app, your browser or device automatically transmits general data and information to our server, as is technically necessary. This general data and information is stored in the server's log files:

• browser type and version used
• operating system used
• referrer URL (previously visited website)
• IP address of the accessing device
• date and time of access
• which sub-pages were accessed
• volume of data transmitted
• other similar data and information used to defend against attacks on our IT systems

We use this log data without attributing it to you personally, or for any other profiling, for statistical evaluation purposes related to the operation, security, and optimisation of our online offering, and for anonymous visitor counting.

When you place an order through our online shop or app, we collect and process the following data for contract fulfilment: name, billing and delivery address, email address, phone number, company name and VAT ID (for business customers), and order and payment details. The legal basis is Art. 6(1)(b) GDPR (contract fulfilment). This data is retained for up to ten years, in accordance with statutory commercial and tax retention obligations (§ 257 HGB, § 147 AO of German law).

For payment processing, we use the following external payment service providers, who act as independent controllers within the meaning of the GDPR:

• Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland – further information: stripe.com/privacy
• PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg – further information: paypal.com/privacy

When you select one of these payment methods, the data required for payment processing (name, amount, account or payment details) is transmitted directly to the relevant provider. The legal basis is Art. 6(1)(b) GDPR.

When you register a customer account on our website or app, we collect your name, email address, password (stored encrypted), and optionally saved delivery addresses and order history. The legal basis is Art. 6(1)(b) GDPR. You may delete your account at any time via your account settings; statutory retention obligations for already completed orders remain unaffected.

For providing product images, we use the service Cloudinary Ltd. (Santa Clara, USA), which acts as our data processor within the meaning of Art. 28 GDPR. No personal user data is processed in this context; only product image material is stored and delivered.

Personal data within the meaning of this Privacy Policy is any information relating to an identified or identifiable natural person. This includes, in particular, your name, email address, and IP address. This typically occurs through log files, cookies, contact forms, and the order process. We generally use your personal data only for the purpose for which you provided it to us. External service providers are granted access only to the extent necessary to perform their services.

Personal data collected in connection with general website use (e.g. contact form) is generally stored for 14 months. Data related to concluded contracts and orders is subject instead to the statutory retention periods of up to ten years described under “Orders and Contract Processing.” IP addresses are stored only for the duration of use and are then deleted or anonymised.

We process your personal data on the following legal bases under the GDPR:

• Art. 6(1)(a) GDPR – consent (e.g. for cookies or newsletter subscriptions)
• Art. 6(1)(b) GDPR – contract performance (e.g. order processing, account management)
• Art. 6(1)(c) GDPR – compliance with legal obligations (e.g. statutory retention duties)
• Art. 6(1)(f) GDPR – legitimate interests (e.g. fraud prevention, IT security, anonymous statistics)

We do not sell your personal data to third parties. Data is only disclosed to third parties where this is necessary for contract fulfilment (e.g. delivery services, payment providers), required by law, or based on your consent.

Under applicable data protection law, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) – you may request information about what personal data we hold about you.
• Right to rectification (Art. 16 GDPR) – you may request correction of inaccurate data.
• Right to erasure (Art. 17 GDPR) – you may request deletion of your data, subject to applicable retention obligations.
• Right to restriction of processing (Art. 18 GDPR) – you may request that processing of your data be limited in certain circumstances.

To exercise any of these rights, please contact us at the address given under “Contact for Data Protection Enquiries.”

Where we process your personal data on the basis of your consent (Art. 6(1)(a) GDPR), you have the right to withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. You may withdraw consent by contacting us at the address provided or, where applicable, by adjusting your settings within our website or app.

Where we process your personal data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to such processing at any time on grounds relating to your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless processing is necessary for the establishment, exercise, or defence of legal claims.

Where your data is processed for direct marketing purposes, you have an unconditional right to object at any time, with effect that we will cease processing your data for such purposes.

You have the right to lodge a complaint with a data protection supervisory authority at any time. The supervisory authority responsible for our registered office is:

Where processing is based on consent or contract (Art. 6(1)(a) or (b) GDPR) and is carried out by automated means, you have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.

Our website uses cookies — small text files placed on your device by your browser. We use technically necessary cookies to operate our website (e.g. session management, shopping cart functionality). These are placed on the basis of Art. 6(1)(f) GDPR. We do not use tracking or advertising cookies without your explicit consent.

You can configure your browser to block or delete cookies. Please be aware that disabling technically necessary cookies may impair functionality. Further details on the cookies we use are available in our Cookie Settings.

We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our website uses TLS encryption (HTTPS) for all data transmissions. Access to personal data is restricted to authorised personnel only.

Our website may contain links to third-party websites. This Privacy Policy applies only to our own website and app. We have no control over and accept no responsibility for the privacy practices or content of any third-party websites. We recommend reviewing the privacy policy of any external site you visit.

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our services. The current version is always available on our website. Where changes are material, we will notify you by appropriate means.

We maintain a company profile on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). When you visit our LinkedIn profile or interact with our content, LinkedIn processes your data in accordance with their own privacy policy, available at linkedin.com/legal/privacy-policy. LinkedIn and Olive Hometex GmbH are joint controllers for page insights data (visitor statistics). The legal basis for our processing is Art. 6(1)(f) GDPR (legitimate interest in business communication and marketing).

We maintain a company profile on Instagram (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland). When you visit our Instagram profile or interact with our content, Meta processes your data in accordance with their own privacy policy, available at privacycenter.instagram.com/policy. The legal basis for our processing is Art. 6(1)(f) GDPR (legitimate interest in business communication and marketing).

Our hosting provider automatically collects and stores information in server log files that your browser transmits to us. This includes browser type and version, operating system, referrer URL, IP address, date and time of access, and pages requested. This data cannot be attributed to specific persons and is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR. Log files are stored for a maximum of 30 days and then deleted or anonymised, unless a specific incident requires further retention for security purposes.