Privacy policy

1. Controller

The controller of your personal data is Shopping Network OOD, Via Georgi Sava Rakovski 145, BG-1000 Sofia, Bulgaria, VAT ID BG204019092. Contact for data protection questions: orders@drwogler-botanics.com.

2. What data we process

• Orders: first name, last name, email address, phone number, delivery address and (optionally) billing address, products ordered and amounts.
• Customer account (optional): email address, password (stored only in irreversibly encrypted form), first and last name, phone, delivery address, your choice about receiving offers and the orders linked to the account.
• Contact form: name, email address, (optionally) phone number and the content of your message.
• Origin of the visit: the promotional (landing) page you came through and – only with your cookie consent – advertising campaign parameters (UTM) and the ad click identifier; we store these with the order to measure the performance of our advertising.
• Technical data: for security reasons (to prevent abuse), we store a pseudonymised record of the IP address for a short time.

3. Purpose and legal basis

• Processing the order, delivery and communication about the order – conclusion and performance of a contract (Article 6(1)(b) GDPR).
• Compliance with legal obligations, e.g. accounting and tax obligations (Article 6(1)(c) GDPR).
• Replying to your enquiry submitted via the contact form – legitimate interest (Article 6(1)(f) GDPR).
• Customer account (overview of orders and delivery, faster checkout) – contract at your request (Article 6(1)(b) GDPR).
• Special offers by email and measuring ad performance – your consent (Article 6(1)(a) GDPR), which you can withdraw at any time (in your account settings or in “Cookie settings”).

We do not use your data for marketing without your explicit consent, and we do not sell it to third parties.

4. Recipients of data

We share data only to the extent strictly necessary: with delivery services (Pošta Slovenije, GLS Croatia) for the delivery of your parcel, and with our hosting and email provider, which stores data on our behalf on servers in the EU. With your consent, website usage data is also shared with Google Ireland Limited (Google Analytics and Google Ads) and with our advertising partner Content Exchange (I.R.V. d.o.o., Ljubljana), see section 6.

5. Retention period

We keep order data for as long as necessary to perform the contract and to exercise the rights arising from it, and in accordance with the statutory retention periods for accounting records. We keep messages sent via the contact form for a maximum of two years. We keep customer account data until you delete the account (you can do this yourself at any time in the account settings); after deletion, orders remain stored in line with the statutory periods but are no longer linked to an account.

6. Cookies and local storage

Strictly necessary cookies and local storage always work:

• dwb_lang (cookie, 1 year) – remembers your chosen language;
• dwb_cart_v1 (browser local storage) – the contents of your cart, which remain on your device;
• dwb_consent (browser local storage) – your cookie choice;
• dwb_c (session cookie, 30 days) and dwb_in (cookie, 30 days) – only if you log in to a customer account: keep you logged in;
• dwb_coupon and dwb_upsell (browser session storage) – your discount code and the extra offer you chose at checkout;
• dwb_attr_v1 (browser local storage, 30 days) – the promotional page you came through (so that its offers apply); campaign parameters and the ad click identifier are only stored with your consent.

Analytics cookies (only with your consent). We use Google Analytics 4 (Google Ireland Limited) for statistics on visits and purchases: which pages are visited, which products are added to the cart and bought, and where visits come from. We do not pass your name, email, phone number or address to Google. The _ga and _ga_* cookies (up to 2 years) are only stored once you click “Accept”; until then Google only receives anonymous cookieless signals. Data is kept in Google Analytics for 14 months. The legal basis is your consent (Article 6(1)(a) GDPR).

Advertising cookies (only with your consent). We use the Google Ads tag (Google Ireland Limited) to measure the performance of our ads and of orders that came through them. The tag runs in consent mode (Google Consent Mode): until you click “Accept”, Google does not store advertising cookies (e.g. _gcl_au) and only receives anonymous cookieless signals. The legal basis is your consent (Article 6(1)(a) GDPR). You can change your choice at any time in the page footer (“Cookie settings”). Data may also be transferred to the USA on the basis of standard contractual clauses or the EU-US Data Privacy Framework. More: how Google uses data.

Content Exchange (only with your consent). Some of our ads run on the Content Exchange advertising network (I.R.V. d.o.o., Leskoškova cesta 12, Ljubljana, Slovenia). Its measurement code (and its cookies) is only loaded once you click “Accept” and measures visits and purchases (products and amounts). If you came through one of its ads, we store the click identifier (sub_id) with your consent and, when you place an order, report only that identifier, the order number and the amount through its measurement tool Voluum – we do not pass on your name, email, phone number or address. The legal basis is your consent (Article 6(1)(a) GDPR).

7. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing. Send your request to orders@drwogler-botanics.com. We will reply within one month at the latest.

If you believe that the processing of your data infringes the regulations, you can lodge a complaint with a supervisory authority – in Slovenia with the Information Commissioner (www.ip-rs.si), in Croatia with the Personal Data Protection Agency (azop.hr) or in Bulgaria with the Commission for Personal Data Protection (www.cpdp.bg).

8. Security

The website uses an encrypted connection (HTTPS). Order data is stored in a protected area of the server that is not accessible from the web.