Privacy policy

Last updated: 17 September 2026

This Privacy Policy describes how barau.bio (the “Site”, “we”, “us” or “our”) collects, uses and shares your personal data when you visit www.barau.bio (the “Site”), use our services, make a purchase there or otherwise communicate with us regarding the Site (collectively the “Services”). For the purposes of this Privacy Policy, “you” and “your” refer to you as a user of the Services, regardless of whether you are a customer, a website visitor or another person whose information we have collected in accordance with this Privacy Policy.

Please read this Privacy Policy carefully.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, among other reasons to reflect changes in our practices, or for other operational, legal or regulatory reasons. We will publish the revised Privacy Policy on the Site, update the “Last updated” date and take any further steps required by law.

How we collect and use your personal data

In order to provide the Services, we collect data as set out below. The information we collect and use varies depending on how you interact with us.

In addition to the specific purposes of use listed below, we may use the information collected about you to communicate with you, to provide or improve the Services, to fulfil all applicable legal obligations, to enforce all applicable terms of service and to protect or defend the Services, our rights and the rights of our users or others.

For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries addressed to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” and the padlock symbol in your browser bar.

What personal data do we collect?

The type of personal data we receive about you depends on how you interact with our Site and use our Services. When we use the term “personal information”, we are referring to information that identifies you, relates to you, describes you or can be associated with you. The following sections describe the categories and specific types of personal data we collect.

Information we collect directly from you

The information you provide to us directly through our Services may include:

Contact details – including your name, your address, telephone number and email address.
Order information – including your name, your billing address, delivery address, payment confirmation, email address and telephone number.
Customer account information – including your username, password, security questions and other information used for customer account security.
Customer support information – including the information you include in your communications with us, for example when you send a message via the Services.
Comment function - As part of the comment function on our Site, e.g. on the blog, in addition to your comment we also store and publish on our Site details of the time the comment was created and the commenter name you have chosen. Your IP address is also logged and stored. This storage of the IP address takes place for security reasons and in the event that the data subject infringes the rights of third parties or posts unlawful content through a comment. We need your email address in order to contact you should a third party object to your published content as unlawful. The legal bases for the storage of your data are Art. 6(1)(b) and (f) GDPR. We reserve the right to delete comments, among other reasons where they are objected to as unlawful by third parties.

For some features of the Services it may be necessary for you to provide us with certain information about yourself directly. You may choose not to provide this information. However, this may mean that you are unable to use or access certain features.

Information we collect about your use

We may also automatically collect certain information about your interaction with the Services (“Usage data”). For this purpose we may use cookies, pixels and similar technologies (“Cookies”). Usage data may contain information about how you access and use our Site and your account, including device information, browser information, information about your network connection, your IP address and other information about your interaction with the Services.

Information received from third parties

Finally, we may receive information about you from third parties, including from vendors and service providers who collect information on our behalf, for example:

Companies that support our Site and Services, such as Shopify.
For hosting our website and displaying the site content we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc. or Shopify (USA) Inc.

All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

Where data is transferred to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

For the transfer of data to the USA, the provider relies on the European Commission's Standard Contractual Clauses, which are intended to ensure compliance with the European level of data protection.
Our payment processors, who collect payment information (e.g. bank account, credit or debit card information, billing address) in order to process your payment, fulfil your orders and provide you with the products or services you have requested, in order to perform our contract with you.
Our fulfilment centre, which is responsible for order processing, dispatch and acceptance of returns as well as communication regarding logistics enquiries. This is the company Logiful GmbH, with its registered office at Ketziner Str. 122, 14476 Potsdam, Germany.

We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

Name, address and, where applicable, further personal data are disclosed to the provider in accordance with Art. 6(1)(b) GDPR exclusively for the purposes stated above. Your data is disclosed only to the extent actually necessary for the purposes stated above.
When you visit our Site, open or click on emails we send you, or interact with our Services or advertisements, we or third parties we work with may automatically collect certain information using online tracking technologies such as pixels, web beacons, software developer kits, third-party libraries and cookies.

All information we receive from third parties is handled in accordance with this Privacy Policy. See also the section below, Third-party websites and links.

How we use your personal data

Provision of products and services. We use your personal data to provide you with the Services and to perform our contract with you, including processing your payments, fulfilling your orders, sending you notifications relating to your account, purchases, returns, exchanges or other transactions, creating, maintaining and otherwise administering your customer account, organising dispatch, facilitating returns and exchanges, and other features and functionalities relating to your customer account. We may also improve your shopping experience by enabling Shopify to match your account with other Shopify services you may wish to use. In that case, Shopify processes your data in accordance with its Privacy Policy and Consumer Privacy Policy.
Marketing and advertising. We may use your personal data for marketing and advertising purposes, for example to send marketing and promotional messages by email, SMS or post and to display advertising for products or services to you. Where applicable, this includes the use of your personal data to better tailor the Services and advertising on our Site and other websites. If you are resident in the EEA, the legal basis for these data processing activities is our legitimate interest in selling our products pursuant to Art. 6(1)(f) GDPR.
Direct marketing through Klaviyo. Our email newsletters are sent via this provider: Klaviyo, 225 Franklin St, Boston, MA 02110, USA. On the basis of our legitimate interest in effective and user-friendly newsletter marketing, we disclose the data you provide when signing up to the newsletter to this provider pursuant to Art. 6(1)(f) GDPR so that it may carry out the newsletter dispatch on our behalf. Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider also carries out a statistical performance evaluation of newsletter campaigns by means of web beacons or tracking pixels in the emails sent, which can measure open rates and specific interactions with the newsletter content. Device information (e.g. time of access, IP address, browser type and operating system) is also collected and evaluated, but is not merged with other data sets. You can withdraw your consent to newsletter tracking at any time with effect for the future. We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection.
Product availability notification by email. For items that are temporarily unavailable, you can sign up to receive email product availability notifications. We will send you a single email notifying you of the availability of the item you selected. The only mandatory detail for sending this notification is your email address. Providing further data is voluntary and may be used in order to address you personally. For sending these emails we use the double opt-in procedure, which ensures that you only receive a notification once you have expressly confirmed your consent by clicking a verification link sent to the email address provided. By activating the confirmation link you give us your consent to the use of your personal data pursuant to Art. 6(1)(a) GDPR. We store the IP address assigned by your internet service provider (ISP) as well as the date and time of sign-up, in order to be able to trace any possible misuse of your email address at a later point. The data collected when you sign up to our email product availability notification service is used strictly for that purpose. You can unsubscribe from availability notifications at any time by sending a corresponding message to the controller named at the outset. Once you have unsubscribed, your email address will be deleted without delay from the distribution list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to further use of the data which is permitted by law and about which we inform you in this policy. For sending these notifications we use the provider Klaviyo, 225 Franklin St, Boston, MA 02110, USA. We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection.
Prize draws. In order to run prize draws we process the personal data you provide, in particular your email address. The legal basis is Art. 6(1)(b) GDPR for the performance of the participation relationship. The data is used exclusively to register your entry, to confirm the email address provided, to carry out the draw and to notify the winners. From winners we additionally collect a name and delivery address in order to send the prize. Participation is confirmed by means of the double opt-in procedure: after submitting the form you will receive an email containing a confirmation link. Your entry is only complete once you have clicked that link. In this context we store the information required as proof of sign-up and confirmation. Once the prize draw has been fully concluded, the data is deleted unless statutory retention obligations apply. For the technical handling of entries we use the provider Klaviyo, 225 Franklin St, Boston, MA 02110, USA. We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties. For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection. Consent to receive our newsletter is not required in order to take part in a prize draw. It is given separately and voluntarily pursuant to Art. 6(1)(a) GDPR and has no bearing on the chance of winning. Newsletter sign-up takes place using the double opt-in procedure; details can be found in the section “Direct marketing through Klaviyo”. The further conditions of each prize draw are set out in the separately published terms of participation.

Security and fraud prevention. We use your personal data to detect, investigate or take action against possible fraudulent, illegal or malicious activity. If you choose to use the Services and register a customer account, you are responsible for the security of your account login details. We strongly recommend that you do not share your username, your password or other access data with third parties. If you believe your account has been compromised, please contact us immediately. If you are resident in the EEA, the legal basis for these data processing activities is our legitimate interest in ensuring the security of our website for you and other customers pursuant to Art. 6(1)(f) GDPR.
Communication with you and service improvement. We use your personal data to provide you with customer support and to improve our Services. This is in our legitimate interest in being able to respond to you, provide you with effective services and maintain our business relationship with you pursuant to Art. 6(1)(f) GDPR.

Cookies

Like many other websites, we use cookies to make visiting our website attractive and to enable the use of certain functions. Cookies are small text files that are stored on your device. Some of these cookies are automatically deleted once you close your browser (so-called “session cookies”), while others remain on your device for longer and allow page settings to be saved (so-called “persistent cookies”). In the latter case you can find the storage duration in the overview of the cookie settings of your web browser. You can find more information about the cookies we use in connection with providing our shop via Shopify at https://www.shopify.com/legal/cookies. Thanks to cookies we are able to operate and improve our Site and our Services (including storing your actions and preferences), carry out analyses and better understand user interaction with the Services.

Insofar as personal data is also processed by individual cookies we use, the processing takes place pursuant to Art. 6(1)(b) GDPR for the performance of the contract, pursuant to Art. 6(1)(a) GDPR where consent has been given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of your visit.

Most browsers accept cookies automatically by default. However, you can configure your browser so that cookies are removed or rejected via the browser controls. Please note that removing or blocking cookies may impair your user experience and may cause some of the Services, including certain features and general functionalities, not to work properly or no longer to be available. In addition, blocking cookies cannot fully prevent us from sharing information with third parties such as our advertising partners.

How we share personal data

In certain circumstances we may share your personal data with third parties for the purpose of performing the contract, for legitimate purposes and for other reasons subject to this Privacy Policy. These circumstances may include:

with vendors or other third parties who provide services on our behalf (e.g. IT management, payment processing, data analysis, customer support, cloud storage, order fulfilment and shipping).
with business and marketing partners in order to provide you with services and to advertise to you. Our business and marketing partners use your data in accordance with their own privacy policies.
Where you instruct or request us, or otherwise give us your consent, to share certain information with third parties, for example in order to send you products or through your use of social media widgets or login integrations.
In connection with a business transaction such as a merger or insolvency, in order to fulfil all applicable legal obligations (including responding to subpoenas, search warrants and similar requests), to enforce all applicable terms of service and to protect or defend the Services, our rights and the rights of our users or others.

We share the following categories of personal data and sensitive personal data about users for the purposes stated above in “How we collect and use your personal data” and “How we share personal data”.

Category	Categories of recipients
Identifiers such as basic contact details and certain order and account information Commercial information such as order information, purchase information and customer support information Internet or other similar network activity, such as usage data Geolocation data, e.g. locations determined via an IP address or other technical means	Vendors and third parties who provide services on our behalf (such as internet service providers, payment processors, fulfilment partners, customer support partners and data analytics providers) Business and marketing partners Affiliates

We do not use or publish your personal data without your consent or for the purpose of drawing inferences about you.

With your consent we share personal data for the purpose of carrying out advertising and marketing activities as follows.

Use of payment service providers

Apple Pay: If you choose the payment method “Apple Pay” from Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the “Apple Pay” function of your device running iOS, watchOS or macOS by charging a payment card stored in “Apple Pay”. Apple Pay uses security features integrated into your device's hardware and software in order to protect your transactions. Authorising a payment therefore requires the entry of a code you have previously set as well as verification using the “Face ID” or “Touch ID” function of your device.

For the purpose of payment processing, the information you provide during the order process, together with the information about your order, is passed to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before the data is transmitted, in order to carry out the payment, to the payment service provider of the payment card stored in Apple Pay. The encryption ensures that only the website through which the purchase was made can access the payment data. Once the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website in order to confirm the success of the payment.

Insofar as personal data is processed in the transmissions described, the processing takes place exclusively for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.

Apple retains anonymised transaction data, including the approximate purchase amount, the approximate date and time and whether the transaction was completed successfully. Anonymisation entirely excludes any personal reference. Apple uses the anonymised data to improve “Apple Pay” and other Apple products and services.

If you use Apple Pay on your iPhone or Apple Watch to complete a purchase you made via Safari on your Mac, the Mac and the authorising device communicate over an encrypted channel on Apple's servers. Apple does not process or store any of this information in a format that allows you to be identified. You can disable the option to use Apple Pay on your Mac in the settings of your iPhone. Go to “Wallet & Apple Pay” and disable “Allow Payments on Mac”.

Further data protection information about Apple Pay can be found at the following internet address: https://support.apple.com/de-de/HT203027

Klarna: One or more online payment methods of the following provider are available on our Site: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

If you select a payment method of the provider under which you pay in advance (similar to a credit card payment), the payment data you provide during the order process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be disclosed to the provider pursuant to Art. 6(1)(b) GDPR. In this case your data is disclosed exclusively for the purpose of payment processing with the provider and only to the extent necessary for this.

If you select a payment method under which the provider pays in advance (such as purchase on invoice or in instalments, or direct debit), you will also be asked during the order process to provide certain personal data (first and last name, street, house number, postcode, town, date of birth, email address, telephone number and, where applicable, details of an alternative means of payment).

In order to safeguard our legitimate interest in establishing the creditworthiness of our customers, we forward this data to the provider pursuant to Art. 6(1)(f) GDPR for the purpose of a credit check. On the basis of the personal data you provide and further data (such as shopping basket, invoice amount, order history, payment experience), the provider checks whether the payment option you have selected can be granted having regard to payment and/or default risks.

In order to reach a decision as part of the application assessment, in addition to the provider's internal criteria, identity and creditworthiness information from the following credit agencies may also be taken into account pursuant to Art. 6(1)(f) GDPR:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). Insofar as score values form part of the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. The calculation of score values takes into account, among other things but not exclusively, address data.

You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may remain entitled to process your personal data where this is necessary for contractually compliant payment processing.

Paypal: One or more online payment methods of the following provider are available on our Site: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method of the provider under which you pay in advance, the payment data you provide during the order process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be disclosed to the provider pursuant to Art. 6(1)(b) GDPR. In this case your data is disclosed exclusively for the purpose of payment processing with the provider and only to the extent necessary for this.

If you select a payment method under which we pay in advance, you will also be asked during the order process to provide certain personal data (first and last name, street, house number, postcode, town, date of birth, email address, telephone number and, where applicable, details of an alternative means of payment).

In order to safeguard our legitimate interest in establishing your creditworthiness in such cases, we forward this data to the provider pursuant to Art. 6(1)(f) GDPR for the purpose of a credit check. On the basis of the personal data you provide and further data (such as shopping basket, invoice amount, order history, payment experience), the provider checks whether the payment option you have selected can be granted having regard to payment and/or default risks.

Shopify Payments: One or more online payment methods of the following provider are available on our Site: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

If you select a payment method of the provider under which you pay in advance (such as credit card payment), the payment data you provide during the order process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be disclosed to the provider pursuant to Art. 6(1)(b) GDPR. In this case your data is disclosed exclusively for the purpose of payment processing with the provider and only to the extent necessary for this.

Third-party websites and links

Our Site may contain links to websites or other online platforms operated by third parties. If you follow links to websites that are not affiliated with or controlled by us, you should review their data protection and security policies as well as other terms and conditions. We give no warranty and accept no responsibility for the data protection or security of such websites, including the accuracy, completeness or reliability of the information found on those websites. Information you provide in public or semi-public places, including information you share on third-party social networking platforms, may also be viewed by other users of the Services and/or users of those third-party platforms, without any restriction as to use by us or by third parties. Our inclusion of such links does not automatically constitute an endorsement of the content of such platforms or of their owners or operators, except as disclosed in the Services.

Web analytics services

Google (Universal) Analytics: This website uses Google (Universal) Analytics, a web analytics service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables an analysis of your use of our website.

By default, when you visit the website, Google (Universal) Analytics sets cookies which are stored as small text elements on your device and collect certain information. The scope of this information also includes your IP address, which is however shortened by Google by removing the last digits in order to exclude direct personal identifiability.
The information is transmitted to Google's servers and processed further there. Transmissions to Google LLC, based in the USA, are also possible.
Google uses the information collected on our behalf to evaluate your use of our Site, to compile reports on website activity for us and to provide further services connected with website use and internet use. The shortened IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data. The data collected in the context of the use of Google (Universal) Analytics is stored for a period of two months and then deleted.
All of the processing described above, in particular the setting of cookies on the device used, takes place only if you have given us your express consent to this pursuant to Art. 6(1)(a) GDPR.
Without your consent, Google (Universal) Analytics is not used during your visit to the Site. You can withdraw the consent you have given at any time with effect for the future. To exercise your right of withdrawal, please disable this service via the “cookie consent tool” provided on our Site.
We have concluded a data processing agreement with Google which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.
Further legal information about Google (Universal) Analytics can be found at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy?hl=de&gl=de and at https://policies.google.com/technologies/partner-sites

Demographic characteristics
Google (Universal) Analytics uses the special “demographic characteristics” function and can use it to create statistics which make statements about the age, gender and interests of site visitors. This is done by analysing advertising and information from third-party providers. This allows target groups to be identified for marketing activities. The data collected cannot, however, be attributed to any particular person and is deleted after being stored for a period of two months.

Google Signals: As an extension to Google (Universal) Analytics, Google Signals may be used on our Site in order to have cross-device reports created. If you have activated personalised advertising and have linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics pursuant to Art. 6(1)(a) GDPR, analyse your usage behaviour across devices and create database models, including on cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop the cross-device analysis, you can disable the "Personalised advertising" function in the settings of your Google account. To do so, follow the instructions on this page: https://support.google.com/ads/answer/2662922?hl=de Further information about Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=de
UserIDs: As an extension to Google (Universal) Analytics, the "UserIDs" function may be used on our Site. If you consent to the use of Google (Universal) Analytics pursuant to Art. 6(1)(a) GDPR, have set up an account on our Site and log in to that account on different devices, your activities, including conversions, can be analysed across devices.
For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection.

Retargeting/remarketing and conversion tracking

Meta Pixel: Within our online offering we use the service "Meta Pixel" of the following provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta")
If a user clicks on an advertisement we have placed on Facebook and/or Instagram, the URL of our linked page is extended with a parameter by means of "Meta Pixel". This URL parameter is then entered into the user's browser after redirection by a cookie which our linked page itself sets.
On the one hand, this enables Meta to determine the visitors to our online offering as a target group for the display of advertisements (so-called "Ads"). Accordingly, we use the service in order to display the Facebook and/or Instagram ads we place only to those users who have also shown an interest in our online offering or who display certain characteristics (e.g. interests in particular topics or products, determined on the basis of the websites visited) which we transmit to Meta (so-called “Custom Audiences”).
On the other hand, “Meta Pixel” makes it possible to trace whether users were redirected to our website after clicking on an advertisement and what actions they carry out there (so-called “conversion tracking”).
The data collected is anonymous to us and therefore gives us no insight into the identity of users. However, the data is stored and processed by Meta, so that a connection to the respective user profile is possible and Meta can use the data for its own advertising purposes.
All of the processing described above, in particular the setting of cookies for reading information on the device used, is carried out only if you have given us your express consent to this pursuant to Art. 6(1)(a) GDPR. You can withdraw the consent you have given at any time with effect for the future by disabling this service in the “cookie consent tool” provided on the website.
We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.
The information generated by Meta is generally transmitted to a Meta server and stored there; in this context transmission to servers of Meta Platforms Inc. in the USA may also occur.
For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection.
Google Ads conversion tracking: This website uses the online advertising programme "Google Ads" and, within Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).
We use the Google Ads offering in order to draw attention to our attractive offers on external websites with the help of advertising media (so-called Google Adwords). In relation to the data of the advertising campaigns, we can determine how successful the individual advertising measures are. Our aim in doing so is to show you advertising that is of interest to you, to make our Site more interesting for you and to achieve a fair calculation of the advertising costs incurred.
The cookie for conversion tracking is set when a user clicks on an Ads advertisement placed by Google. Cookies are small text files that are stored on your device. These cookies generally expire after 30 days and do not serve to identify you personally. If the user visits certain sub-pages of our Site and the cookie has not yet expired, Google and we can recognise that the user clicked on the advertisement and was redirected to that sub-page. Each Google Ads customer receives a different cookie. Cookies can therefore not be tracked across the websites of Google Ads customers. The information obtained with the help of the conversion cookie serves to create conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their advertisement and were redirected to a page bearing a conversion tracking tag. However, they do not receive any information by which users can be personally identified.
In the context of the use of Google Ads, personal data may also be transmitted to the servers of Google LLC. in the USA.
Details of the processing triggered by Google Ads conversion tracking and of Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites
All of the processing described above, in particular the setting of cookies for reading information on the device used, is carried out only if you have given us your express consent to this pursuant to Art. 6(1)(a) GDPR. You can withdraw the consent you have given at any time with effect for the future by disabling this service in the “cookie consent tool” provided on our Site.
You can also permanently object to the setting of cookies by Google Ads conversion tracking by downloading and installing the Google browser plug-in available at the following link:
https://www.google.com/settings/ads/plugin?hl=de
In order to address users whose data we have received in the context of business or business-like relationships with advertising that is even better tailored to their interests, we use a customer match function within Google Ads. For this purpose we transmit one or more files containing aggregated customer data (above all email addresses and telephone numbers) electronically to Google. Google does not obtain access to clear data; instead, it automatically encrypts the information in the customer files during the transmission process by means of a special algorithm. The encrypted information can then only be used by Google in order to match it to existing Google accounts which the data subjects have set up. This makes it possible to deliver personalised advertising across all Google services linked to the respective Google account.
Customer data is transmitted to Google exclusively where you have given us your express consent to this pursuant to Art. 6(1)(a) GDPR. You can withdraw this consent vis-à-vis us at any time with effect for the future. Further information about Google's data protection measures in relation to the customer match function can be found here: https://support.google.com/google-ads/answer/6334160?hl=de&ref_topic=10550182
Google's privacy policies can be viewed here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/
For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection.
Google Marketing Platform: Our Site uses the online marketing tool Google Marketing Platform of the operator Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("GMP").
GMP uses cookies in order to display advertisements relevant to users, to improve the reports on campaign performance or to avoid a user seeing the same advertisements several times. By means of a cookie ID, Google records which advertisements are displayed in which browser and can thereby prevent them from being displayed more than once. In addition, GMP can use cookie IDs to record so-called conversions which relate to advertisement requests. This is the case, for example, where a user sees a GMP advertisement and later, using the same browser, visits the advertiser's website and buys something via that website. According to Google, GMP cookies contain no personal information.
Because of the marketing tools used, your browser automatically establishes a direct connection with Google's server.
We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you as follows to the best of our knowledge: through the integration of GMP, Google receives the information that you have accessed the corresponding part of our website or clicked on an advertisement of ours. If you are registered with a Google service, Google can attribute the visit to your account. Even if you are not registered with Google or are not logged in, there is a possibility that the provider may obtain and store your IP address. In the context of the use of GMP, personal data may also be transmitted to the servers of Google LLC. in the USA.
All of the processing described above, in particular the setting of cookies for reading information on the device used, is carried out only if you give us your express consent to this pursuant to Art. 6(1)(a) GDPR. You can withdraw this at any time with effect for the future by disabling this service in the “cookie consent tool” provided on our Site.
For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection.
The privacy policies of GMP by Google can be found here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

Site functionalities

Facebook plugins: Plugins of the social network of the following provider are used on our Site: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
These plugins enable direct interactions with content on the social network.
In order to increase the protection of your data when visiting our website, the plugins are initially deactivated and integrated into the Site by means of a so-called “2-click” or “Shariff” solution.
This integration ensures that when a page of our website containing such plugins is accessed, no connection is yet established with the provider's servers.
Only when you activate the plugins and thereby give your consent to the data transfer pursuant to Art. 6(1)(a) GDPR does your browser establish a direct connection to the provider's servers. In doing so, regardless of whether you are logged in to an existing user profile, information about the device you use (including your IP address), your browser and your page history is transmitted to the provider to a certain extent and, where applicable, processed further there.
If you are logged in to an existing user profile on the provider's social network, information about interactions carried out via the plugins is also published there and displayed to your contacts.
You can withdraw your consent at any time by deactivating the activated plugin by clicking on it again. However, the withdrawal has no effect on the data already transferred to the provider.
Data may also be transferred to: Meta Platforms Inc., USA
We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.
For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection.
Instagram plugins: Plugins of the social network of the following provider are used on our Site: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
These plugins enable direct interactions with content on the social network.
In order to increase the protection of your data when visiting our website, the plugins are initially deactivated and integrated into the Site by means of a so-called “2-click” or “Shariff” solution.
This integration ensures that when a page of our website containing such plugins is accessed, no connection is yet established with the provider's servers.
Only when you activate the plugins and thereby give your consent to the data transfer pursuant to Art. 6(1)(a) GDPR does your browser establish a direct connection to the provider's servers. In doing so, regardless of whether you are logged in to an existing user profile, information about the device you use (including your IP address), your browser and your page history is transmitted to the provider to a certain extent and, where applicable, processed further there.

If you are logged in to an existing user profile on the provider's social network, information about interactions carried out via the plugins is also published there and displayed to your contacts.
You can withdraw your consent at any time by deactivating the activated plugin by clicking on it again. However, the withdrawal has no effect on the data already transferred to the provider.
Data may also be transferred to: Meta Platforms Inc., USA
We have concluded a data processing agreement with the provider which ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.
For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection.

Google Web Fonts: For the uniform display of typefaces, our Site uses so-called web fonts of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland
When a page is accessed, your browser loads the required web fonts into your browser cache in order to display texts and typefaces correctly, and establishes a direct connection to the provider's servers. In doing so, certain browser information, including your IP address, is transmitted to the provider.
Data may also be transmitted to: Google LLC, USA
The processing of personal data in the course of establishing a connection with the provider of the typefaces is carried out only if you have given us your express consent to this pursuant to Art. 6(1)(a) GDPR. You can withdraw the consent you have given at any time with effect for the future by disabling this service via the “cookie consent tool” provided on our Site. If your browser does not support web fonts, a standard font from your computer will be used.
For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection.
Further information on Google's privacy provisions can be found here: https://business.safety.google/intl/de/privacy/
Google Customer Reviews: We work with Google as part of the “Google Customer Reviews” programme. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). This programme gives us the opportunity to obtain customer reviews from users of our Site. After a purchase on our Site you will be asked whether you would like to take part in an email survey by Google.
If you give your consent pursuant to Art. 6(1)(a) GDPR, we transmit your email address to Google. You will receive an email from Google Customer Reviews asking you to rate your purchase experience on our Site. The rating you give is then combined with our other ratings and displayed in our Google Customer Reviews logo as well as in our Merchant Center dashboard. Your rating is also used for Google Seller Ratings. In the context of the use of Google Customer Reviews, personal data may also be transmitted to the servers of Google LLC. in the USA.
You can withdraw your consent at any time by sending a message to the controller responsible for the data processing or to Google.
For data transfers to the USA, the provider has adhered to the EU-US Data Privacy Framework, which on the basis of an adequacy decision of the European Commission ensures compliance with the European level of data protection.
Further information on Google's privacy provisions can be found here: https://business.safety.google/intl/de/privacy/

Children's data

The Services are not intended for use by children, and we do not knowingly collect personal data from children. If you are a parent or guardian of a child who has provided us with their personal data, you can reach us using the contact details given below and request the deletion of this data.

As at the time this Privacy Policy takes effect, we have no actual knowledge that we “share” or “sell” personal data of persons under the age of 16 (as those terms are defined in applicable law).

Security and retention of your data

Please note that no security measures are perfect or impenetrable and that we cannot guarantee “perfect security”. In addition, the information you send us may not be secure during transmission. We recommend that you do not use insecure channels to send us sensitive or confidential information.

How long we retain your personal data depends on various factors, for example whether we need the data in order to administer your customer account, provide the Services, comply with legal obligations, resolve disputes or enforce other applicable agreements and policies.

Where personal data is processed for the purposes of direct marketing on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(2) GDPR.

Your rights

Depending on where you live, you may have some or all of the rights listed below in relation to your personal data. However, these rights are not absolute and apply only in certain circumstances. In certain cases we may decline your request to the extent permitted by law.

Right of access/information: You may have the right to request access to the personal data we have stored about you, including details of how we use and share your data.
Right to erasure: You may have the right to request the deletion of the personal data we have stored about you.
Right to rectification: You may have the right to request the correction of inaccurate personal data we have stored about you.
Right to portability: You may have the right to receive a copy of the personal data we have stored about you and, in certain circumstances and subject to certain exceptions, to request the transfer of this data to third parties.
Right to object to sale, sharing or targeted advertising:
WHERE WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST FOLLOWING A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THAT PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED WHERE WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FUNDAMENTAL FREEDOMS, OR WHERE THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

WHERE YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSES OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSES OF SUCH MARKETING. YOU CAN EXERCISE THE OBJECTION BY CONTACTING US AT THE ADDRESS GIVEN BELOW.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
Restriction of processing: You may have the right to ask us to stop or restrict the processing of your personal data.
Withdrawal of consent: Where we rely on your consent to process your personal data, you may have the right to withdraw that consent.
Right of appeal: If we decline to act on your request, you may have the right to appeal against our decision. You can do this by replying directly to our refusal.
Managing communication preferences: We may send you promotional emails and you can opt out of receiving these emails at any time by using the unsubscribe option shown in our emails to you. If you unsubscribe, we may still send you emails that are not for promotional purposes, for example regarding your customer account or your orders.

You can exercise these rights as indicated on our Site or by contacting us using the contact details given below.

We will not discriminate against you for exercising any of these rights. In order to verify your identity we may need to collect information from you, such as your email address or customer account information, before we can give a substantive response to the request. Under applicable law you may designate an authorised representative to make requests to exercise your rights on your behalf. Before we accept such a request from a representative, we must receive proof from them that you have authorised them to act on your behalf. In addition, we may need to confirm your identity directly with us. We will respond to your request promptly, as required by applicable law.

Complaints

If you have complaints about the way in which we process your personal data, please contact us using the contact details given below. If you are not satisfied with our response to your complaint, depending on where you live you may have the right to appeal against our decision by contacting us using the contact details listed below or by lodging your complaint with your local data protection authority. For the EEA, you can find a list of the competent data protection supervisory authorities here.

International users

Please note that we may transfer, store and process your personal data outside the country in which you live. Your personal data is also processed by employees and by external service providers and partners in those countries.

Where we transfer your personal data to countries outside Europe, we rely on recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses or equivalent agreements of the relevant competent UK authority, unless the data transfer is to a country which has been found to offer an adequate level of protection.

Contact

If you have questions about our data protection practices or this Privacy Policy, or wish to exercise any of the rights available to you, please send us an email at info@barau.bio or contact us by post at Barau by Bibi GmbH, Landshuter Straße 55, 84030 Ergolding, Germany.

Within the meaning of applicable data protection law, and unless expressly stated otherwise, we are the controller of your personal data.