Privacy policy

1. Controller and contact

The controller is Pharmatura UG (haftungsbeschränkt), Bei den Mühren 1, 20457 Hamburg, Germany. You can contact us about privacy at hello@provitura.com.

2. Personal data we process

The data we process depends on how you use Provitura. We collect information you provide, information created while we fulfil a request and limited technical information needed to operate and secure the shop.

• Identity and contact details, such as name, email, telephone number, billing address and delivery address.
• Account and authentication data, saved addresses and account preferences.
• Cart, order, delivery, return, refund and customer-service information.
• Subscription status, product, renewal dates and recurring-payment references.
• Payment references and status received from Frisbii. Complete card details are entered in Frisbii's hosted checkout, not in the Provitura storefront.
• Messages, privacy requests and newsletter choices.
• Technical data such as IP address, browser information, security events and necessary cookie identifiers.

3. Purposes and legal bases

We process data only where we have a legal basis under the GDPR.

• Contract: to run checkout, accept payment, fulfil and support orders, manage accounts, subscriptions, returns and refunds.
• Legal obligation: to meet accounting, tax, consumer-protection and other statutory duties.
• Consent: for newsletters and any non-essential cookies or marketing that requires consent. You may withdraw consent at any time.
• Legitimate interests: to secure the services, prevent fraud, answer enquiries, maintain records and improve operations, balanced against your rights.

4. Payments and subscriptions

Frisbii operates the hosted payment page and processes payment details. We receive transaction identifiers, payment status and the references needed to authorise, capture, refund and manage recurring payments. Subscription renewals use the payment method stored with Frisbii every 30 days until the subscription is paused or cancelled.

5. Fulfilment, communications and marketing

We share the order and delivery information needed for fulfilment with Webshipper, the fulfilment partner and the selected carrier. Transactional emails are delivered through Resend. If you choose the newsletter, the contact and consent information needed for that service is processed through Klaviyo. These providers may process data only for the relevant service and under applicable data-protection obligations.

6. Other recipients

Our websites and databases are hosted by Railway in the European Union, and Cloudflare provides DNS and network security. Data may also be processed by other infrastructure, security, professional-adviser and support providers where necessary. We may disclose data to public authorities or other parties when law requires it, to establish or defend legal claims, or in connection with a lawful corporate transaction. We do not sell personal data.

7. Retention

We keep personal data only for as long as needed for the purpose collected and to meet legal obligations. Order and accounting records are kept for the applicable statutory period. Account data is generally kept while the account is active. Subscription records are kept while needed to administer and document the subscription. Newsletter data is kept until consent is withdrawn or the service is no longer used, subject to limited suppression records. Security, support and legal records are kept according to need, risk and limitation periods.

8. International transfers

Klaviyo, which handles our newsletter, and Resend, which delivers our transactional emails, are United States companies and may process data outside the European Economic Area. Other service providers may also do so. Where that happens, we use a lawful transfer mechanism, such as an adequacy decision, the European Commission's standard contractual clauses or another safeguard recognised by data-protection law.

9. Your rights

Subject to the GDPR's conditions and exceptions, you may request access, correction, deletion, restriction and portability of your data, and object to processing based on legitimate interests or direct marketing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. We may need to verify your identity before responding.

10. Complaints and security

We use appropriate technical and organisational measures to protect personal data, but no online service can promise absolute security. If you have a concern, contact us first so we can investigate. You also have the right to complain to a competent data-protection authority, including the Hamburg Commissioner for Data Protection and Freedom of Information where it is competent for the controller.