Vraxylonthol

Privacy Policy

Last updated: March 2026

1. Controller and contact details

The controller responsible for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

Vraxylonthol
Bayerstraße 27
80335 München
Germany

Email: touch@vraxylonthol.world
Phone: +49 89 599 89040

2. Scope and purpose of this policy

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website https://vraxylonthol.world (the "Website") and our services. We process personal data in accordance with the GDPR, the German Federal Data Protection Act (BDSG), and other applicable data protection legislation.

We are committed to transparency and to protecting your privacy. By using our Website or providing your data to us, you acknowledge that you have read and understood this policy.

3. Definitions

Personal data means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).

Processing means any operation performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, alignment, restriction, erasure, or destruction (Art. 4(2) GDPR).

Controller means the natural or legal person who determines the purposes and means of the processing (Art. 4(7) GDPR).

Recipient means a natural or legal person to whom personal data are disclosed (Art. 4(9) GDPR).

4. Data we collect and legal basis

4.1 Data you provide to us

When you place an order, use our contact form, or get in touch with us, we may collect:

  • Name and surname
  • Email address
  • Phone number (if you provide it)
  • Address (for delivery and invoicing)
  • Message content and correspondence
  • Consent records (e.g. agreement to terms and privacy policy)

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR), or your consent (Art. 6(1)(a) GDPR), or our legitimate interest in handling enquiries (Art. 6(1)(f) GDPR).

4.2 Automatically collected data

When you visit our Website, we or our service providers may automatically collect:

  • IP address
  • Browser type and version
  • Operating system
  • Referrer URL
  • Pages visited and date/time of access
  • Device identifiers where applicable

Legal basis: Legitimate interest in ensuring security, functionality and optimisation of the Website (Art. 6(1)(f) GDPR), or consent where required (e.g. non-essential cookies) (Art. 6(1)(a) GDPR).

4.3 Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy. Strictly necessary cookies do not require consent. Analytics and marketing cookies are used only with your consent.

Legal basis: Consent for non-essential cookies (Art. 6(1)(a) GDPR); legitimate interest or legal obligation for strictly necessary cookies.

5. Purposes of processing

We process your personal data for the following purposes:

  • Fulfilment of orders and delivery of products (Vitaserra and related services)
  • Customer communication and support
  • Processing of enquiries and contact requests
  • Compliance with legal obligations (e.g. tax, commercial law)
  • Improvement of our Website and services (where based on consent or legitimate interest)
  • Detection and prevention of fraud and abuse
  • Assertion and defence of legal claims

6. Retention periods

We retain your data only for as long as necessary for the purposes set out above or as required by law:

  • Contract and order data: For the duration of the contractual relationship and thereafter for the statutory retention period (e.g. 6 or 10 years under German tax and commercial law).
  • Contact and enquiry data: Until the enquiry is fully resolved, and for a reasonable period thereafter for follow-up (e.g. 3 years) unless longer retention is required by law.
  • Consent and cookie preferences: For the period of validity of your consent and as required to demonstrate compliance (e.g. up to 3 years).
  • Access and server logs: Typically up to 7–90 days unless a longer period is justified for security or legal reasons.
  • Marketing communications: Until you withdraw consent or object, and then only as needed to record the objection.

After the retention period, we delete or anonymise your data unless we are legally obliged to retain it.

7. Recipients and international transfers

We may share your data with:

  • Payment and shipping service providers necessary to perform the contract
  • IT and hosting providers who process data on our behalf (processors) under a data processing agreement
  • Legal and regulatory authorities when required by law

Processors act only on our instructions and are contractually bound to protect your data. We do not sell your personal data to third parties.

If we transfer data to countries outside the European Economic Area (EEA), we ensure an adequate level of protection (e.g. EU Standard Contractual Clauses or adequacy decision) in accordance with Art. 44 et seq. GDPR.

8. Security measures

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Use of HTTPS and encryption (e.g. TLS) for data in transit
  • Access controls and authentication for our systems
  • Restriction of access to personal data on a need-to-know basis
  • Regular review of our security practices and, where applicable, contracts with processors

Despite these measures, no transmission or storage over the internet can be guaranteed to be completely secure. We encourage you to use strong passwords and to protect your own devices.

9. Your rights under the GDPR

You have the following rights in relation to your personal data:

  • Right of access (Art. 15 GDPR): You may request confirmation as to whether we process your data and, if so, a copy of the data and information on the processing.
  • Right to rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17 GDPR): You may request deletion of your data where the legal conditions are met (e.g. data no longer necessary, withdrawal of consent, unlawful processing).
  • Right to restriction of processing (Art. 18 GDPR): You may request that we restrict processing in certain situations (e.g. while accuracy is contested).
  • Right to data portability (Art. 20 GDPR): Where processing is based on consent or contract and is carried out by automated means, you may receive your data in a structured, commonly used format.
  • Right to object (Art. 21 GDPR): You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds. You may object to processing for direct marketing at any time without giving reasons.
  • Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
  • Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your residence or place of work. In Germany, the competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) or the data protection authority responsible for your place of residence.

To exercise these rights, please contact us using the details in section 1. We will respond within one month, subject to any permitted extension.

10. Children

Our Website and services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it without delay.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. The "Last updated" date at the top will be revised accordingly. We encourage you to review this page periodically. Material changes may be communicated by a notice on the Website or by email where appropriate.

12. Additional information

For information on cookies and similar technologies, please see our Cookie Policy. For terms governing the use of our Website and products, see our Terms of Service and Legal Information.

If you have any questions about this Privacy Policy or our data practices, please contact us at touch@vraxylonthol.world or by post at the address above.