This policy explains what personal data we collect when you use yerbador.com, why we process it, who receives it and what you can demand from us. It applies to the online shop Yerbador Mate at https://yerbador.com.

1. Controller and contact

The controller of your personal data is:

  • NATURÉ SUISSE & CO sp. z o.o., ul. Łucka 20/1102, 00-845 Warszawa, Poland
  • KRS 0001140344, District Court for the Capital City of Warsaw in Warsaw, Commercial Division of the National Court Register
  • NIP 5273143646, EU VAT number PL5273143646, REGON 540428116
  • Person authorised to represent the company: Jakub Kobosko
  • E-mail: [email protected]

Contact is by e-mail only. There is no telephone customer service line for yerbador.com. Postal address for returns and complaints: Yerbador, Green Republic sp. z o.o., ul. Przemysłowa 5, 05-230 Kobyłka, Poland.

We have not appointed a data protection officer. Write to [email protected] and your message reaches the controller directly.

The “Yerbador” trade mark belongs to OROTAL Commodities Trading SA, Avenue de Champel 29, 1206 Geneva, Switzerland (UID CHE-264.449.639). OROTAL is only the brand owner. It is not a controller of your data. The shop is run, and every order is performed, by NATURÉ SUISSE & CO sp. z o.o. in Poland.

2. What data we collect and where it comes from

Order data

When you place an order you give us your name, delivery address, e-mail address, the contents and value of the order and your chosen payment method. If you ask for an invoice, you also give us the invoicing data, including the company name, address and tax number where you buy as an entrepreneur. We receive the result of your payment (paid, failed, refunded) from the payment provider; we do not receive your full card number.

Account data

If you create an account, we store your log-in e-mail address, your password in encoded form, your saved addresses and your order history.

Newsletter data

If you subscribe to the newsletter, we store your e-mail address, the fact and date of your consent, and information about whether our messages were delivered, opened and clicked.

Correspondence

When you write to us about an order, a return, a withdrawal or a complaint, we keep your message, our answer and any documents or photographs you send.

Technical data

When you visit the site, our servers and the tools listed in section 4 record technical data: IP address, browser and device information, the language and currency you selected, the pages you viewed and the identifiers stored in cookies and similar technologies.

Where the data comes from

  • directly from you — order form, account, newsletter form, e-mails;
  • from your browser and device — technical data and cookie identifiers;
  • from our payment providers — the status of your payment;
  • from the carrier — the status of your parcel.

3. Purposes and legal bases, with retention periods

  • Performing the sales contract — accepting and fulfilling your order, delivery, payment, handling returns, withdrawals and complaints. Legal basis: Art. 6(1)(b) GDPR. Kept for the duration of the contract and then within the periods below.
  • Invoicing, tax and accounting duties — issuing invoices and keeping the books. Legal basis: Art. 6(1)(c) GDPR together with the Polish Accounting Act and the Tax Ordinance. Kept for 5 years counted from the end of the calendar year in which the tax obligation arose.
  • Establishing and defending legal claims — for example a dispute about a complaint or a payment. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest. Kept until the limitation periods for the claims expire.
  • Security of the site, fraud and chargeback prevention. Legal basis: Art. 6(1)(f) GDPR. Kept for the lifetime of the relevant logs and cookies, and longer only where an incident is being investigated.
  • Measuring shop traffic on aggregated data. Legal basis: Art. 6(1)(f) GDPR. Kept in aggregated form only.
  • Direct marketing to our own customers. Legal basis: Art. 6(1)(f) GDPR. Processed until you object.
  • Newsletter and e-mail marketing. Legal basis: Art. 6(1)(a) GDPR, your consent. Kept until you withdraw consent, plus the record of the consent itself as proof.
  • Abandoned-cart reminders. Legal basis: Art. 6(1)(a) GDPR, your consent. Kept until you withdraw consent.
  • Analytics and advertising cookies and similar technologies. Legal basis: Art. 6(1)(a) GDPR, your consent given in the cookie banner. Kept for the lifetime of each cookie stated in the cookie policy.

4. Recipients of the data

We disclose your data only to the following recipients, and only to the extent each of them needs it. Some act as our processors, some as independent controllers of their own services.

  • DPD Polska sp. z o.o. and its partner carriers in the country of delivery — delivery of your parcel.
  • Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland — card payments.
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg — PayPal payments.
  • UAB MailerLite (Lithuania) — newsletter and e-mail marketing.
  • Sellasist — the order, invoicing and warehouse system we use to fulfil orders.
  • Meta Platforms Ireland Limited — Meta pixel and advertising measurement.
  • Google Ireland Limited — Google Tag Manager, Google Analytics 4 and Google Ads.
  • OVH — hosting of the shop.
  • Cloudflare — content delivery and protection against attacks.
  • Accounting, legal and IT service providers bound by confidentiality.

We also disclose data to public authorities where the law obliges us to do so. We do not sell your data.

5. Transfers outside the European Economic Area

Some of the recipients listed above — in particular Google and Meta — may process data on servers in the United States.

Those transfers take place under the European Commission’s EU-US Data Privacy Framework adequacy decision, or on the basis of the European Commission’s standard contractual clauses.

You can ask for a copy of the safeguards used at [email protected].

6. How long we keep the data

  • Order and invoice data: 5 years counted from the end of the calendar year in which the tax obligation arose.
  • Data needed to defend claims: until the limitation periods for those claims expire.
  • Newsletter data: until you withdraw your consent.
  • Account data: for as long as you keep the account; after deletion we retain only what the periods above require.
  • Cookie data: for the lifetime of each cookie, as stated in the cookie policy.

When a period ends, we delete the data or anonymise it.

7. Your rights and how to exercise them

Under the GDPR you have the right to:

  • access your data and receive a copy of it;
  • have inaccurate data rectified;
  • have your data erased;
  • have processing restricted;
  • receive your data in a portable form and have it transmitted to another controller;
  • object to processing based on our legitimate interest, including an objection to direct marketing — if you object to direct marketing, we stop;
  • withdraw any consent at any time; withdrawal does not affect the lawfulness of the processing carried out before it.

To use any of these rights, write to [email protected]. We answer without undue delay. We may ask you a question that lets us confirm who you are, so that we do not hand your data to somebody else.

Complaint to a supervisory authority

You can lodge a complaint about our processing with a supervisory authority. Our lead authority is the Polish President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, https://uodo.gov.pl. You can also complain to the supervisory authority of your own country of residence.

8. Is providing data obligatory

Providing data is voluntary. But it is necessary to conclude and perform the sales contract: without your name, delivery address and e-mail address we cannot accept an order, deliver a parcel, issue an invoice or handle a return or a complaint.

Providing data for the newsletter, for marketing and for analytics or advertising cookies is entirely optional. You can shop without giving any of it.

9. Automated decision-making and profiling

We take no decisions about you that produce legal effects or similarly significantly affect you solely by automated means, and we do not profile you with legal effect.

Advertising audiences are built only on the basis of the consent you give for marketing cookies. If you do not give that consent, no audience is built from your visit.

10. Cookies and similar technologies

Consent for cookies is collected by the CookieYes banner in four categories: strictly necessary (always on), functional, analytics and performance, and advertising.

  • Strictly necessary cookies keep your shopping cart, your session, your chosen language, your chosen currency and site security. They run without consent.
  • Analytics: Google Analytics 4 (measurement ID G-6BSMVYB8ZK), loaded through Google Tag Manager (container GTM-53NMWS89).
  • Advertising: Meta pixel (ID 424504803625707) and Google Ads.
  • We use Google Consent Mode, so Google tags only measure what you have agreed to.
  • Cookies set by the shop itself expire at the end of the session or after up to 12 months. The exact lifetimes are listed in the consent banner’s cookie declaration.

You can change or withdraw your consent at any time from the cookie settings link on the site. Full details are in the cookie policy.

11. Newsletter and marketing communication

We send the newsletter only if you subscribed to it. The legal basis is your consent, Art. 6(1)(a) GDPR. The newsletter is sent through UAB MailerLite (Lithuania), which also records whether a message was delivered, opened and clicked.

If you have bought from us, we may also send you direct marketing about our own products on the basis of Art. 6(1)(f) GDPR. You can object to it at any time and we stop.

Abandoned-cart reminders are sent only where you consented to them.

How to unsubscribe

  • click the unsubscribe link at the bottom of any newsletter message, or
  • write one sentence to [email protected].

Unsubscribing costs nothing and needs no reason. After you unsubscribe we keep only the record of the consent and its withdrawal, as proof that we acted lawfully.

12. Security of the data

  • Card and PayPal payments are handled on the side of Stripe or PayPal. We do not receive or store your card number.
  • The shop is hosted by OVH; Cloudflare delivers the content and protects the site against attacks.
  • Access to order data is limited to the people who need it to fulfil orders, run the accounts or answer your messages.
  • Every processor listed in section 4 works under a contract that obliges it to keep the data confidential and to process it only on our instructions.
  • Account passwords are stored in encoded form.

If a personal data breach occurs and it is likely to result in a high risk to your rights, we will inform you and the supervisory authority as the GDPR requires.

13. Changes to this policy

We may change this policy, for example when we start using a new processor or a new tool. The current version is always published on this page, and it is the version that applies to the processing carried out while it is published.

If a change concerns processing based on your consent, we ask for your consent again; we do not extend an old consent to a new purpose. Contracts already concluded are governed by the terms in force when you placed the order — see our terms and conditions.