Privacy policy

  • Privacy Policy for www.mytcm.eu

    Last updated: 21 August 2026

    1. Controller

    The controller responsible for the processing of personal data on www.mytcm.eu is:

    Herba Natura Harald Noll B.V.
    Industriestraat 12
    7091 DC Dinxperlo
    Netherlands

    Email: info@mytcm.eu
    Telephone EU: +49 89 21538242
    Telephone Germany: 0800 2742833

    2. Purposes and legal bases of processing

    We process personal data in accordance with the General Data Protection Regulation (GDPR), in particular to provide and secure the website, process orders, take steps prior to entering into a contract, handle payments and shipping, administer customer accounts, respond to enquiries, communicate with customers, localise language and region, prevent fraud and misuse, comply with legal obligations and safeguard legitimate interests.

    The legal bases include in particular Article 6(1)(b) GDPR for contracts and steps prior to entering into a contract, Article 6(1)(c) GDPR for legal obligations, Article 6(1)(f) GDPR for legitimate interests and, where required, Article 6(1)(a) GDPR for consent.

    3. Visiting the website and technical data

    When you visit the website, technically necessary data may be processed, in particular the IP address, date and time of access, pages viewed, referrer URL, browser and device information, operating system, language settings, approximate geolocation, cookie and device identifiers and server log data.

    This processing serves the technical provision, security and stability of the website, protection against fraud and bots, and the correct display of language, country and region.

    4. Orders, customer accounts and customer communication

    If you place an order, use a customer account or contact us, we process the data you provide, in particular your name, address, email address, telephone number, order contents, billing and shipping data, account information and the content of communications.

    This data is used to review your order, determine availability, send a payment email, allocate incoming payments, dispatch goods, respond to queries and provide the customer account.

    5. Advance payment

    Online payment providers such as Shopify Payments or PayPal are currently not enabled. Payment is made in advance following a separate payment email.

    For advance payments, we process the data required to allocate the payment, in particular the payment amount, payment reference, account holder and receipt of payment. Payment data is processed through the banks involved.

    6. Shipping and returns

    For delivery and the processing of returns, personal data may be disclosed to shipping service providers, logistics partners and the returns agency where this is necessary for shipping, delivery, return or proof of shipment.

    Returns are processed through Retourenagentur Bilgic, DHL Postfiliale, Herba Natura, Feldstraße 51, 46485 Wesel, Germany.

    7. Shopify as shop, hosting and account service provider

    The website and online shop are operated using Shopify. Shopify processes personal data relating to access to and use of the shop, as well as data that you submit when placing orders, using customer accounts or through other interactions, in order to provide, secure and further develop the shop services.

    Shopify Network Intelligence is currently enabled. This allows Shopify to use customer data securely together with other Shopify data to provide enhanced services and to improve products, security, personalisation and, where applicable, ad targeting. Information from interactions with Shopify and with other Shopify merchants may also be taken into account. Other merchants cannot view our shop's data.

    Where consent is required for processing that is not technically necessary, Shopify takes account of the choices made through the cookie banner. Consent can be changed or withdrawn with effect for the future through the shop's cookie settings.

    Further information about processing by Shopify and exercising rights in relation to Shopify is available at:
    https://privacy.shopify.com/en
    https://www.shopify.com/legal/privacy

    8. Service providers and apps used

    Recipients of personal data may include, in particular, IT and hosting service providers, Shopify as the shop system service provider, email service providers, banks, shipping providers, returns service providers, tax and legal advisers and public authorities, where this is necessary for the respective purposes.

    The Shopify shop also has apps installed for communication, translation, order limits, security and country, language and region selection. These currently include Shopify Messaging, T Lab - AI Language Translate, Translate & Adapt, Melon Order Limits, Securify, Selecty, Orbe Geolocation and Geolocation. Depending on how the respective function is used, these apps may access shop, order, customer, device or activity data.

    Securify by siimple.ai is used to protect against fraud, bots and access from specific countries or IP addresses. The app may access order and customer data as well as name, email address, telephone number, address, geolocation, IP address, browser and operating system, browsing behaviour and a client ID cookie identifier.

    Shopify Messaging is installed for customer communication and email marketing and may access contact data as well as device and activity data. Marketing messages are sent only where consent or another permissible legal basis exists. Consent may be withdrawn at any time with effect for the future.

    9. Cookies, consent and similar technologies

    We use technically necessary cookies and similar technologies where this is required for operation, security, the shopping cart, customer accounts, language and region, and the ordering process.

    For non-essential cookies and analytics, marketing or tracking technologies, consent is obtained in the regions configured for this purpose through Shopify's automated cookie banner. In those regions, non-essential processing takes place only in accordance with the choices made.

    Securify is connected to the shop as an app pixel. Where data is collected for analytics purposes, the consent conditions configured in Shopify apply. Security-related data may be processed where this is necessary to protect the shop and prevent misuse.

    You can change your cookie choices at any time through the shop's cookie settings or withdraw consent with effect for the future.

    10. International data transfers and hosting

    The European Union is currently selected in Shopify as the hosting location for customer data. Nevertheless, Shopify and other service providers may also process data in countries outside the European Economic Area.

    Where personal data is processed outside the European Economic Area, this takes place only in accordance with the GDPR, in particular on the basis of an adequacy decision by the European Commission, appropriate safeguards such as standard contractual clauses, or another permissible basis.

    11. Storage period

    We store personal data only for as long as is necessary for the respective purposes. Order, invoice and business records may be stored for longer due to statutory retention obligations.

    Data processed on the basis of consent will be deleted or its processing restricted if consent is withdrawn and no other legal basis applies. The specific storage period may also depend on the service providers used and statutory obligations.

    12. Your rights

    Under the GDPR, data subjects have rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests.

    Consent that has been given may be withdrawn at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

    To exercise your rights, you can contact info@mytcm.eu. For processing for which Shopify is independently responsible, you can also use Shopify's privacy portal:
    https://privacy.shopify.com/en

    13. Complaint to a supervisory authority

    You have the right to lodge a complaint with a data protection supervisory authority. In particular, the Dutch supervisory authority, Autoriteit Persoonsgegevens, may be competent for Herba Natura Harald Noll B.V. You may also contact a data protection supervisory authority in your country of residence.

    14. Requirement to provide data

    For orders, we require the data necessary for the order, availability check, allocation of payment, invoicing, shipping and compliance with legal obligations. Without this data, an order may not be processed.

    15. Automated decision-making

    No decision based solely on automated processing within the meaning of Article 22 GDPR takes place unless expressly stated otherwise. Technical security, fraud, bot, country or IP checks serve to protect the shop and are not used for decisions that produce legal or similarly significant effects.

    16. Updates to this Privacy Policy

    We update this Privacy Policy when legal requirements, technical processes, Shopify settings, apps used or service providers change. Please therefore check the current version of this Privacy Policy regularly.