Water kefir
Milk kefir
Kombucha
Ginger beer
Kefir duo
Kefir and kombucha
Starter kit
RennetPrivacy policy
Version: .
We process personal data only to the extent needed to run the shop, handle your order and stay in touch with you. This page explains which data is concerned, what we use it for, who we pass it to and what rights you have under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). As our company is established in France, the EU General Data Protection Regulation (Regulation (EU) 2016/679) also applies to our processing.
1. Controller
Naturalnco SARL (brand: Natural Probio)
26 rue principale
57920 Monneren
France
E-mail: hello@natural-probio.com
Telephone: +33 6 59 95 57 96
For any question about your data and to exercise your rights, you can reach us at this e-mail address.
2. Overview
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Technical data when you visit (IP address, date, time, page visited, browser) | Availability and security of the website | Art. 6(1)(f) UK GDPR (legitimate interests) | Only as long as necessary for operation and security |
| Name, delivery and billing address, e-mail, telephone, products ordered, payment status | Processing and delivery of the order, customer service | Art. 6(1)(b) UK GDPR (performance of the contract) | Until the end of the statutory retention periods |
| Invoices and accounting records | Compliance with legal and tax obligations, including UK VAT | Art. 6(1)(c) UK GDPR (legal obligation) | Ten years (Article L123-22 of the French Commercial Code), which also covers the period required for UK VAT records |
| E-mail address and order | E-mails about the order: confirmation, invoice, dispatch, tips for getting started, help with questions, request for a review | Art. 6(1)(b) and (f) UK GDPR | Until you object, and no later than three years after your last order |
| Customers' e-mail address | Tips and suggestions about our own products similar to those you bought | Art. 6(1)(f) UK GDPR, regulation 22(3) PECR (soft opt-in) | Until you object, which you can do at any time |
| E-mail address and proof of consent | Newsletter with recipes, tips, offers and welcome code | Art. 6(1)(a) UK GDPR (consent), regulation 22(2) PECR | Until you unsubscribe, and no later than three years after your last contact with us |
| Name, e-mail and message from the contact form | Answering your request | Art. 6(1)(b) or (f) UK GDPR | Twelve months after our reply |
| Published reviews (name, star rating, text) | Displaying your review on the product page | Art. 6(1)(a) UK GDPR (consent) | As long as the product is offered or until you ask for deletion |
3. Hosting
This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, which is within the EU. When you visit the pages, the server processes the technically necessary data. Our e-mails are also sent through the same provider. We have concluded a data processing agreement with Hostinger (Article 28 UK GDPR).
The connection between your browser and our server is encrypted (TLS).
4. Order processing
Your basket is stored in your browser (see section 10). After payment, we pass the order data (name, addresses, e-mail, telephone, products, amounts) to our central order system, based on the WooCommerce shop software on natural-probio.com, which we manage ourselves for the brand. It is used for dispatch and invoicing, and it sends you the e-mails with your invoice and your tracking number. Legal basis: Article 6(1)(b) UK GDPR.
5. Payment with Stripe
You pay on a payment page of Stripe Payments Europe, Limited, the company of the Stripe group that provides our payment service, established in the EU. For this purpose we send Stripe the products ordered, the amount and the delivery charge; on the payment page you enter your name, e-mail address, telephone number, address and payment details directly with Stripe. Stripe also processes device and connection data to prevent fraud. We never receive your full card or account details.
Stripe is itself responsible for part of the processing, for example fraud prevention and compliance with its own legal obligations. Stripe may transfer data to Stripe, Inc. in the United States; Stripe, Inc. is certified under the EU-US Data Privacy Framework and its UK Extension (the UK-US data bridge), and standard contractual clauses, with the UK Addendum, also apply. Legal bases: Article 6(1)(b), (c) and (f) UK GDPR.
Depending on the payment method you choose, Stripe passes the data needed for the payment to the provider concerned, which processes it under its own privacy notice:
- Cards (Visa, Mastercard): the payee's bank and your own bank, as part of the payment transaction.
- Apple Pay: Apple, as provider of the Apple Pay service on your device.
- Google Pay: Google, as provider of the Google Pay service on your device.
- PayPal: the PayPal company that holds your PayPal account.
- Klarna: the Klarna group company that provides the service in the United Kingdom. For Pay in 3, Klarna may check your identity and creditworthiness. Klarna is itself responsible for this; you will find more in Klarna's privacy information, shown to you when you pay.
6. Delivery
For delivery, we pass your name and delivery address, and where needed for the delivery notice your e-mail address or telephone number, to our carriers, La Poste SA, 9 rue du Colonel Pierre Avia, 75015 Paris, France, and Royal Mail Group Limited, 185 Farringdon Road, London EC1A 1AA, which delivers the parcel to your door. Legal basis: Article 6(1)(b) UK GDPR.
7. E-mails about your order
After an order you receive the order confirmation, the invoice and the tracking number. In the days that follow we send you tips for getting started with your culture, ask whether everything is going well and invite you to leave a review. Legal basis: Article 6(1)(b) UK GDPR and our legitimate interest in good customer service (Article 6(1)(f) UK GDPR).
The review request contains a link to our page on Trustpilot. We do not pass your data to Trustpilot: if you follow the link and leave a review there, Trustpilot A/S (Copenhagen, Denmark) processes your data under its own responsibility and privacy policy.
As a customer, you will also occasionally receive tips and suggestions from us about our own products similar to those you bought (the soft opt-in under regulation 22(3) PECR, and Article 6(1)(f) UK GDPR). We tell you about this when you order and give you the chance to refuse. You can object at any time, at no cost to you other than the cost of sending your message, using the unsubscribe link in every e-mail or by writing to us.
8. Newsletter
You receive the newsletter only if you have given your consent (Article 6(1)(a) UK GDPR and regulation 22(2) PECR). Signing up works like this: you enter your e-mail address on our website and tick the consent box. We then send you an e-mail with a confirmation link (double opt-in). Only when you click this link is the sign-up complete, and you then receive the welcome e-mail with, where applicable, your personal welcome code. If you do not confirm, we send you no newsletter. As proof of your consent, we keep the time of sign-up and confirmation, the place on the website where you signed up, the text of the consent and a truncated, irreversible hash of your IP address.
On the Stripe payment page you can also tick a box to agree to receive offers by e-mail. If you have done so without completing the payment, we send you a single reminder with a link to your basket.
You can withdraw your consent at any time, with effect for the future: with one click on the unsubscribe link in every e-mail or by sending us a message. After that you receive only e-mails relating to your orders.
9. Contact form and questions by e-mail
When you write to us through the contact form or by e-mail, we process your name, your e-mail address, your message and any photos attached in order to answer your question. Legal basis: Article 6(1)(b) UK GDPR if it concerns an order, otherwise Article 6(1)(f) UK GDPR.
10. Cookies and local storage
We do not use tracking or advertising cookies, analytics tools, advertising networks or social media plug-ins. That is why we do not show a cookie banner.
In your browser's local storage (local storage and session storage) we store only what the shop needs for the functions you use: the contents of your basket, your delivery choice, whether you have already seen the newsletter window, your welcome code where applicable and, for the confirmation page, your last order. This data stays on your device and is not passed to anyone else. This storage is strictly necessary for the service you request and therefore does not require consent (regulation 6(4) PECR). You can clear it at any time in your browser settings; your basket will then be empty.
The fonts are hosted on our own server. The payment page belongs to Stripe, which sets its own cookies there that are necessary for a secure payment.
11. Reviews
When you review a product, we publish the name you give, the star rating, your text and the date. Your e-mail address is not published; we use it only to link the review to an order or to contact you if we have a question. Legal basis: your consent (Article 6(1)(a) UK GDPR), which you can withdraw at any time.
12. Recipients
Your data is passed only to the service providers named above, to the extent they need it for their task: Hostinger (hosting and e-mail), our WooCommerce order system (order management), Stripe and the payment provider you choose (payment), La Poste and Royal Mail (delivery). We do not sell your data and we do not pass it on for advertising purposes.
We do not ask for, and do not process, any special categories of personal data within the meaning of Article 9 UK GDPR. Please do not include such information in messages to us.
13. Transfers outside the United Kingdom
We are established in the EU, and this website is hosted within the EU. The United Kingdom recognises the countries of the EEA as providing an adequate level of protection (adequacy regulations under section 17A of the Data Protection Act 2018), so your data may be transferred there without further safeguards. Where a provider transfers data to a country outside the United Kingdom and the EEA, such as Stripe to the United States, the safeguards described in section 5 apply.
14. Your rights
You have the right of access (Article 15 UK GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You can withdraw any consent you have given at any time, with effect for the future (Article 7(3)). Simply write to hello@natural-probio.com.
Right to object: where we process data on the basis of Article 6(1)(f) UK GDPR, you may object at any time on grounds relating to your particular situation (Article 21(1)). You may object at any time, without giving reasons, to the use of your data for direct marketing (Article 21(2)); we will then no longer use it for that purpose.
15. Right to complain
If you are unhappy with how we handle your data, please tell us first, and we will do our best to put it right. You also have the right to lodge a complaint with the supervisory authority in the United Kingdom, the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, website ico.org.uk. As our company is established in France, our processing is also supervised by the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
16. Obligation to provide data and automated decisions
For an order, we need your name, delivery address, e-mail address and payment details; without this data we cannot perform the contract. We do not ourselves take any automated decisions within the meaning of Article 22 UK GDPR. Any creditworthiness check for payment in instalments is carried out by Klarna under its own responsibility.
17. Changes
We update this privacy policy when the shop or the law changes. The version published on this page applies.