Privacy policy

Herbs Magic operates this store and website in order to provide you with a curated shopping experience. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit, use, or make a purchase, or otherwise communicate with us. It has been drafted in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD). If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information. By using our website or placing an order, you acknowledge that you have read and understood this policy.

1. Who We Are (Data Controller)

The data controller responsible for your personal data is HerbsMagicShop.nl (trading as Herbs Magic), based in Spain. For the purpose of applicable data protection laws, we are the data controller of your personal information.

Contact: herbsmagicshoporders@gmail.com
Supervisory authority: Agencia Española de Protección de Datos (AEPD) — www.aepd.es — Tel: +34 900 293 183

If you have any questions about this Privacy Policy or wish to exercise any of your rights, please contact us at any time via the email address above.

2. What Personal Data We Collect

When we use the term "personal information," we refer to information that identifies or can reasonably be linked to you. We collect only the personal data that is necessary to process your order and provide our services, depending on how you interact with us.

2.1 Data you provide directly

  • Contact details including your full name, billing address, shipping address, phone number, and email address
  • Financial information including payment card details and transaction details (processed securely via our payment provider — we do not store card details)
  • Account information including username, password, and preferences
  • Transaction information including items you view, add to cart, purchase, return, or cancel
  • Communications including any information you include in messages to us, for example customer support enquiries

2.2 Data collected automatically

  • Device information including your IP address, browser type and version, device type, and unique identifiers
  • Usage information including how and when you interact with or navigate our website
  • Referring website or search query
  • Cookie data (see section 8)

2.3 Data from third parties

  • From our service providers, including Shopify, when they collect or process personal data on our behalf
  • From our business partners or other third parties, where permitted by law

We only collect data that is strictly necessary for the purposes described in this policy. We do not collect sensitive categories of personal data such as health data, racial or ethnic origin, or political opinions.

3. Why We Process Your Data & Legal Basis

We process your personal data only when we have a lawful basis to do so under Article 6 GDPR:

  • Processing and fulfilling your order, payments, returns and exchanges — Performance of a contract (Art. 6(1)(b) GDPR)
  • Sending order confirmations, shipping updates and account notifications — Performance of a contract (Art. 6(1)(b) GDPR)
  • Handling complaints, returns and customer service — Performance of a contract (Art. 6(1)(b) GDPR)
  • Complying with legal and tax obligations — Legal obligation (Art. 6(1)(c) GDPR)
  • Fraud prevention, account security and platform integrity — Legitimate interest (Art. 6(1)(f) GDPR)
  • Improving our website, services and shopping experience — Legitimate interest (Art. 6(1)(f) GDPR)
  • Responding to legal process, law enforcement or civil litigation — Legal obligation (Art. 6(1)(c) GDPR)
  • Sending marketing emails, promotions and personalised advertisements (if opted in) — Consent (Art. 6(1)(a) GDPR)

We will never use your data for purposes other than those listed above without informing you and, where required, obtaining your consent.

4. Who We Share Your Data With

We do not sell or rent your personal data. We share your data only with trusted parties necessary to fulfil our services:

  • Shopify Inc. — our e-commerce platform provider. Shopify hosts our store, processes order data, and acts as a data processor on our behalf. Shopify is GDPR compliant.
  • Shipping carriers — your name, address, email and phone number are shared with the carrier to enable delivery.
  • Payment processors — payment data is handled directly by our payment provider. We do not store or have access to your full payment details.
  • Business and marketing partners — where you have consented, we may share data to enable personalised advertising through third-party services.
  • Affiliates or corporate group — where applicable, data may be shared within our corporate group.
  • Legal authorities — we may disclose data to law enforcement, regulatory authorities, or in connection with legal proceedings or business transactions as required by law.

All third parties are contractually bound to handle your data in accordance with the GDPR and to use it only for the specific purpose for which it was shared.

4b. Data Processing Agreements

In accordance with Article 28 GDPR, we have entered into Data Processing Agreements (DPAs) with all third-party processors who handle personal data on our behalf. Shopify's Data Processing Addendum is accepted via Shopify account settings. Payment data is processed under the payment provider's own DPA and PCI-DSS compliance framework.

4c. Shopify Network Intelligence & Enhanced Services

Our store is powered by Shopify. To help protect, grow and improve our business, we use certain Shopify Enhanced Services that incorporate data from your interactions with our store, along with other merchants and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information for these purposes.

You have the right to opt out of Shopify's sharing of your data for advertising purposes at any time via the Shopify Privacy Portal. If you request deletion of your data with us, your data will also be deleted from Shopify Network Intelligence. For full details on how Shopify processes data, visit Shopify's Privacy Policy.

5. International Data Transfers

We may transfer, store and process your personal information outside the country you live in. Where we transfer personal data outside the European Economic Area (EEA), we rely on recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses (SCCs) or adequacy decisions to ensure your data remains protected to the same standard as within the EU.

You can request more information about these safeguards by contacting us at herbsmagicshoporders@gmail.com.

6. How Long We Keep Your Data

How long we retain your personal data depends on whether we need it to maintain your account, provide our services, comply with legal obligations, resolve disputes, or enforce applicable policies:

  • Order data — retained for 7 years to comply with Spanish and EU tax and accounting obligations
  • Customer service communications — retained for 2 years after the last interaction
  • Marketing consent — retained until you withdraw your consent or request deletion
  • Website analytics data — retained for a maximum of 26 months

After the applicable retention period, your data is securely deleted or anonymised. In accordance with the Spanish LOPDGDD, certain data may be "blocked" — retained in restricted form — before final deletion to meet legal obligations.

7. Your Rights Under the GDPR

Depending on where you live, you may have some or all of the following rights in relation to your personal data:

  • Right of access — Request a copy of the personal data we hold about you.
  • Right to rectification — Request correction of inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten") — Request deletion of your data where there is no overriding legal reason to retain it.
  • Right to restriction of processing — Ask us to limit how we use your data in certain circumstances.
  • Right to data portability — Receive your data in a structured, machine-readable format and transfer it to another controller.
  • Right to object — Object to processing based on legitimate interest, including for direct marketing purposes.
  • Right to withdraw consent — Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
  • Right to appeal — If you are unhappy with how we have handled a rights request, you may appeal our decision by contacting us or by lodging a complaint with your local data protection authority.

To exercise any of these rights, contact us at herbsmagicshoporders@gmail.com with the subject line "Data Request" and your full name and order details. We will respond within 30 days. We will not discriminate against you for exercising any of these rights.

We may need to verify your identity before processing your request. You may also designate an authorised agent to make requests on your behalf, provided they can supply proof of your authorisation.

You may also exercise rights related to data processed by Shopify directly via the Shopify Privacy Portal.

Records of consent: Where we process your data on the basis of consent, we keep a record of when and how that consent was given (GDPR Art. 5(2) accountability principle). You can request a copy of your consent record at any time.

7b. Complaints

If you have complaints about how we process your personal data, please contact us first at herbsmagicshoporders@gmail.com. If you remain unsatisfied, you have the right to lodge a complaint with your local data protection authority. For the EEA, the responsible supervisory authority is:

Agencia Española de Protección de Datos (AEPD)
C/Jorge Juan, 6 — 28001 Madrid, Spain
www.aepd.es — Tel: +34 900 293 183

8. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to ensure the website functions correctly, to analyse how visitors use our site, and where applicable, to show relevant content and advertisements.

8.1 Types of cookies we use

  • Essential cookies — necessary for the website and shopping cart to function. These cannot be disabled.
  • Functional cookies — remember your preferences such as language or currency.
  • Analytical cookies — help us understand how visitors use the site (e.g. Google Analytics). Used only with your consent.
  • Marketing cookies — used to show relevant advertisements based on your interests. Used only with your explicit consent.

In accordance with AEPD guidelines and the ePrivacy Directive, we ask for your explicit consent before placing any non-essential cookies. You can manage or withdraw your cookie consent at any time via the cookie settings on our website. Refusing non-essential cookies will not affect your ability to browse or place orders.

8.2 Google Consent Mode v2

Our website uses Google Consent Mode v2, required for all European traffic using Google services such as Google Analytics or Google Ads. This ensures Google only receives tracking signals when you have given explicit consent. Without your consent, Google's services operate in a restricted, privacy-safe mode and do not track your personal behaviour.

8.3 Your cookie choices

When you first visit our website, you will be presented with a cookie consent banner allowing you to accept or decline non-essential cookies. You can change your preferences at any time via the cookie settings link in the footer of our website.

9. Data Security & Breach Notification

We implement appropriate technical and organisational measures including SSL/TLS encryption, secure access controls, and use of GDPR-compliant platforms to protect your data. Please be aware that no security measures are perfect or impenetrable. We recommend you do not use unsecured channels to communicate sensitive information to us.

In the event of a personal data breach:

  • We will assess the breach within 24 hours of discovery
  • If the breach poses a risk to your rights, we will notify the AEPD within 72 hours
  • If the breach poses a high risk, we will notify you directly without undue delay

If you believe your personal data has been compromised, please contact us immediately at herbsmagicshoporders@gmail.com.

10. Marketing Communications

We may send you promotional emails, and you may opt out at any time by using the unsubscribe link in any email we send. If you opt out, we may still send you non-promotional emails about your account or orders. In accordance with Spanish law (LSSI) and GDPR, we require a clear, affirmative opt-in — pre-ticked boxes do not constitute valid consent.

11. Automated Decision-Making & Profiling

We do not use automated decision-making or profiling in any way that produces legal or similarly significant effects on you as defined under Article 22 GDPR. Fraud prevention checks may involve limited automated processing, but all final decisions are reviewed by a human member of our team.

12. Minors & Children's Data

Our website and services are not intended for persons under the age of 18. We do not knowingly collect personal data from minors. As of the effective date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" personal information of individuals under 16 years of age. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at herbsmagicshoporders@gmail.com and we will delete it promptly.

13. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and recommend you review their privacy policies before providing any personal data. Information you share on public or semi-public venues, including third-party social networking platforms, may be viewable by other users without limitation. Our inclusion of such links does not imply any endorsement of those platforms or their owners.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. We will post the revised policy on this page, update the "Last updated" date, and provide notice as required by applicable law. Continued use of our website after changes have been published constitutes acceptance of the updated policy.

Last updated: May 12, 2026 — This policy is drafted in accordance with GDPR (EU) 2016/679, Spanish Organic Law 3/2018 (LOPDGDD), and Shopify's merchant privacy requirements.