Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

BERTRAND Food GmbH
Hansestr. 3
59590 Geseke
Germany

Phone: (+49) 5258 977 7325
E-mail: hey@bertrand.bio

No data protection officer has been appointed.

2. Your rights as a data subject

With regard to the personal data we store about you, you generally have the following rights:

• Access to your stored data and its processing (Art. 15 GDPR)
• Rectification of inaccurate personal data (Art. 16 GDPR)
• Erasure of the data we store about you (Art. 17 GDPR)
• Restriction of processing, insofar as we are not yet permitted to erase your data due to legal obligations (Art. 18 GDPR)
• Objection to the processing of your data by us (Art. 21 GDPR)
• Data portability, provided that you have consented to the data processing or have concluded a contract with us (Art. 20 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

3. Collection of general information when visiting our website

Nature and purpose of the processing

When you access our website, information of a general nature is automatically collected. This information (server log files) includes, for example, the type of web browser, the operating system used, the domain name of your internet service provider, your IP address and similar data.

It is processed in particular for the following purposes:

• Ensuring a trouble-free connection to the website
• Ensuring smooth use of our website
• Evaluating system security and stability
• For further administrative purposes

The processing is carried out on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR in the aforementioned purposes of data collection. We do not use your data to draw conclusions about you as a person.

Hosting

Our online shop is hosted by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes server log files, order and customer data as well as technical data for the operation of the shop on our behalf. For details, please refer to Shopify's privacy policy: shopify.com/legal/privacy.

4. Cookies and consent management

We use cookies on our website. Cookies are small text files that are stored on your device. Technically necessary cookies are used on the basis of Art. 6 (1) (f) GDPR. Cookies that are not strictly necessary (e.g. for marketing, tracking and analysis) are only set with your prior consent pursuant to Art. 6 (1) (a) GDPR and sec. 25 (1) of the German Digital Services Act (DDG).

We use the consent banner integrated into our shop by Shopify to obtain, manage and document your consent. You can withdraw your consent at any time with effect for the future via the consent banner.

5. Embedding of YouTube and Vimeo videos

We embed videos from the platforms YouTube (YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA; Google Ireland Limited) and Vimeo (Vimeo.com, Inc., 330 West 34th Street, Floor 10, New York, NY 10001, USA) on our website.

When you open a page with an embedded video, a connection is established to the servers of the respective provider, whereby your IP address and, where applicable, further device and usage data are transmitted to the provider. This may also include a transfer to the USA.

Embedding only takes place if you have given your consent via our cookie consent banner. The legal basis is Art. 6 (1) (a) GDPR and sec. 25 (1) DDG. You can withdraw your consent at any time via the consent banner.

6. Contacting us

Nature and purpose of the processing

When you contact us by e-mail, telephone or via a contact form, the data you provide (e.g. name, contact details, message) is stored by us in order to process your enquiry. We delete the related data once storage is no longer necessary.

Legal basis

The processing is carried out on the basis of Art. 6 (1) (b) GDPR (pre-contractual/contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in responding to your enquiry).

7. Customer account and order processing

Nature and purpose of the processing

When a customer account is created or an order is placed, we collect and process the data required for performing the contract (including name, address, e-mail address, telephone number, order details, payment data). We pass this data on to the following third parties to the extent required:

• to the shipping company commissioned with the delivery (DHL or UPS)
• to our payment service provider (see section 8)
• to our ERP system JTL-Wawi, which is used for order and inventory management and is operated by our hosting provider ecomDATA GmbH, Steinamangererstraße 9/16, 7400 Oberwart, Austria

A data processing agreement pursuant to Art. 28 GDPR exists with ecomDATA. As ecomDATA is based in Austria and thus within the EU, there is no transfer to a third country.

Legal basis

The processing is carried out to perform the purchase contract concluded with you pursuant to Art. 6 (1) (b) GDPR and to comply with statutory retention obligations (in particular under tax and commercial law) pursuant to Art. 6 (1) (c) GDPR.

8. Payment processing

We use the following payment service providers for payment processing, to whom your payment data (e.g. name, billing address, credit card or account details) is transmitted depending on the payment method chosen:

• Shopify Payments (credit card, Shop Pay, Apple Pay, Google Pay and local payment methods), operated by Shopify International Limited or affiliated payment service providers
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg)
• Payment in advance, processed via our bank

The processing is carried out on the basis of Art. 6 (1) (b) GDPR to perform the contract.

9. E-mail dispatch (newsletter and transactional e-mails)

We use the service Brevo (Brevo SAS, 8 rue de Londres, 75009 Paris, France) to send our newsletter as well as order and shipping confirmations. This involves processing your e-mail address, where applicable your name and order data, and, in the case of the newsletter, additional information on your opening and click behaviour within the e-mails. A data processing agreement pursuant to Art. 28 GDPR exists with Brevo. As Brevo is based in France and thus within the EU, there is no transfer to a third country in this respect.

Transactional e-mails (order and shipping confirmations): the legal basis is Art. 6 (1) (b) GDPR (performance of contract).

Newsletter: the legal basis is Art. 6 (1) (a) GDPR (consent). You can withdraw your consent at any time via the unsubscribe link in every newsletter e-mail.

10. Communication via Superchat

We use the Superchat platform, operated by SuperX GmbH, Prenzlauer Allee 242-247, Haus 7, 10405 Berlin, for customer communication (including via WhatsApp). When you contact us, your telephone number or contact details as well as the content of the conversation are processed. Where messages are transmitted via Meta's WhatsApp infrastructure, processing outside the EU/EEA cannot be ruled out.

The legal basis is Art. 6 (1) (b) GDPR (performance of contract/pre-contractual enquiry) or Art. 6 (1) (a) GDPR insofar as you actively initiate contact.

11. Electronic withdrawal function

If you exercise your right of withdrawal via the withdrawal function provided on our website (bertrand.bio/widerruf), we process the data you enter there (name, order number, e-mail address) as well as time stamp and IP address for evidence purposes and to prevent misuse.

The processing is carried out on the basis of Art. 6 (1) (b), (c) (statutory obligation to provide evidence) and (f) GDPR (prevention of misuse).

12. Affiliate programme

If you take part in our affiliate programme or use a third party's affiliate code, we process the data required for this purpose (e.g. allocation of the code to the customer account, credit generated) in order to run the programme. The legal basis is Art. 6 (1) (b) GDPR.

13. Google Ads and Google Analytics

Google Ads (conversion tracking)

We use Google Ads to draw attention to our offers by means of advertising on external websites. As part of conversion tracking, a cookie is set when you visit our site, provided you reached it via a Google advertisement.

Google Analytics (GA4)

We use the web analytics service Google Analytics (GA4) to statistically evaluate your use of our website.

Both services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (where necessary with further processing by Google LLC, USA). Data may therefore be transferred to the USA.

Both services are only used if you have given your consent via our cookie consent banner. The legal basis is Art. 6 (1) (a) GDPR and sec. 25 (1) DDG. You can withdraw your consent at any time via the consent banner.

14. Retention period

Unless a more specific retention period is stated within this privacy policy, your personal data will remain with us until the purpose of the data processing no longer applies. Retention periods under commercial and tax law (generally 6 or 10 years) remain unaffected.

15. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or in order to implement changes to our services.

Last updated: 20 July 2026