Privacy policy
1. Introduction and Controller
We are pleased that you are visiting our website and are interested in Klar2O Labor. Below, we inform you about how we process personal data when you visit our website, use our shop, order a water analysis, communicate with us, or otherwise make use of Klar2O Labor’s services.
Personal data means any information relating to an identified or identifiable natural person.
The controller within the meaning of the General Data Protection Regulation is:
Klar2O Labor
Werner-von-Siemens-Straße 2-6
76646 Bruchsal
Germany
Email: wasserlabor@klar2o.com
The controller determines, alone or jointly with others, the purposes and means of processing personal data.
2. Data Collection When Visiting Our Website
When you use our website for purely informational purposes, meaning when you do not place an order, create a customer account, or transmit any information to us, we only process data that your browser transmits to our server. This includes in particular:
visited page
date and time of access
amount of data transferred
referrer URL
browser used
operating system used
IP address
requesting provider
Processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and error-free provision of our website.
We reserve the right to review server log files subsequently if there are specific indications of unlawful use.
Our website uses SSL or TLS encryption. You can recognize an encrypted connection by “https://” and the lock symbol in the browser address bar.
3. Hosting and Shop System Shopify
We use Shopify for hosting, shop functionalities, checkout, and the presentation of our website.
Provider:
Shopify International Limited
Victoria Buildings, 2nd Floor
1-2 Haddington Road
Dublin 4, D04 XN32
Ireland
Data may also be transferred to Shopify Inc., Canada, as well as to other Shopify companies and service providers. Shopify provides merchants with a Data Processing Addendum.
(Shopify, Data Processing Addendum, https://www.shopify.com/legal/dpa)
For Canada, an adequacy decision of the European Commission exists insofar as the processing is subject to the Canadian data protection law PIPEDA.
(European Commission, Adequacy decisions, https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en)
4. Cookies and Cookie Consent
Our website uses cookies and similar technologies.
Cookies are small text files stored on your device. Some cookies are technically necessary, for example for the shopping cart, checkout, language settings, security, and shop functionality. Other cookies are used for analytics, marketing, or convenience functions.
We use technically necessary cookies on the basis of Art. 6(1)(f) GDPR or Art. 6(1)(b) GDPR.
We only set non-essential cookies if you have given your consent. The legal basis is Art. 6(1)(a) GDPR.
You can change or withdraw your consent at any time via the cookie consent tool on our website.
5. Contacting Us
If you contact us by email, contact form, telephone, chat, WhatsApp, or other communication channels, we process the data you provide in order to handle your inquiry.
This may include:
name
email address
telephone number
order number
customer number
message content
analysis ID
other voluntarily provided information
The legal basis is Art. 6(1)(b) GDPR if your inquiry is related to a contract or pre-contractual measure. In all other cases, the legal basis is Art. 6(1)(f) GDPR.
6. Customer Account
If you create a customer account, we process the data required for this purpose, in particular your name, email address, address, order history, and account settings.
Processing is carried out pursuant to Art. 6(1)(b) GDPR for the provision and management of your customer account.
You may request deletion of your customer account at any time. Statutory retention obligations remain unaffected.
7. Order Processing
If you order products or laboratory services through our website, we process the data required for contract performance.
This includes in particular:
name
billing address
delivery address
email address
telephone number
order data
payment data
shipping data
communication data
for water analyses: sample information, analysis ID, analysis values, and result data
The legal basis is Art. 6(1)(b) GDPR.
8. Water Analysis and Laboratory Processing
If you commission a water analysis, we process personal data to the extent necessary for carrying out the analysis, assigning the sample, preparing the analysis report, customer communication, quality assurance, and contract processing.
The sample receives an internal analysis ID. In the laboratory, the sample is generally processed under this analysis ID. Name, full address, payment data, and other direct customer data are not required for the actual laboratory analysis and are processed separately from the laboratory data.
The assignment between analysis ID and order or customer is only used to the extent necessary for:
contract performance
provision of results
follow-up questions
complaints
quality assurance
verification and documentation obligations
legal obligations
This processing constitutes pseudonymization, not complete anonymization. Pseudonymized data remains personal data as long as it can be attributed to a person using additional information. This corresponds to Recital 26 GDPR.
(GDPR, Recital 26, https://dsgvo-gesetz.de/erwaegungsgruende/nr-26/)
The legal basis is Art. 6(1)(b) GDPR.
9. Publication of Anonymized or Aggregated Analysis Results
We would like to statistically evaluate water analysis results and publish them in anonymized or aggregated form. The purpose is in particular the transparent presentation of regional water parameters, quality assurance, product improvement, and scientific-statistical evaluation.
In particular, the following information may be used:
postal code or larger regional unit
analysis parameters
measured values
average values
ranges
frequencies
statistical summaries
Publication only takes place if the data has first been anonymized or aggregated in such a way that identification of individual persons, households, properties, or specific samples is no longer reasonably possible.
We do not publish:
names
full addresses
email addresses
telephone numbers
order numbers
customer numbers
analysis IDs
individual analysis reports with personal reference
We only publish individual values together with a postal code if this does not create a realistic possibility of re-identification. In cases of low sample size, conspicuous individual values, or other re-identification risks, we publish data only in a more aggregated form, for example at city, district, federal state, or regional level, or we refrain from publication.
As an internal protective rule, publication at postal-code level generally only takes place where there is a sufficient minimum number of cases and no risk of re-identification.
Processing up to anonymization is carried out on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest lies in quality assurance, product improvement, statistical evaluation, and transparent information about regional water parameters.
You may object to this processing at any time on grounds relating to your particular situation. Data that has already been effectively anonymized can no longer be attributed to a person and therefore generally cannot be subsequently deleted, corrected, or assigned to individual persons.
10. Payment Service Providers
For payment processing, we transfer the data required for this purpose to the payment service provider selected in each case. The legal basis is Art. 6(1)(b) GDPR.
Depending on the payment method offered, the following providers in particular may be used:
Shopify Payments
PayPal
Stripe
Klarna / Sofort
Apple Pay
Google Pay
For certain payment methods, payment service providers may act as independent controllers within the meaning of the GDPR. The privacy notices of the respective payment service provider also apply.
11. Shipping Service Providers
For the delivery of products, sample kits, or return materials, we transfer the necessary shipping data to transport service providers.
This includes in particular:
name
delivery address
where applicable, email address
where applicable, telephone number
The transfer is carried out pursuant to Art. 6(1)(b) GDPR insofar as it is necessary for delivery.
An email address or telephone number is only transferred for delivery notification if this is necessary for the specific shipment or if you have given your consent.
12. Newsletter and Direct Advertising
If you subscribe to our newsletter, we use your email address to send promotional information.
Registration is generally carried out using the double opt-in procedure. In this process, we store the IP address, time of registration, and time of confirmation in order to be able to prove the registration.
The legal basis is Art. 6(1)(a) GDPR.
You can withdraw your consent at any time via the unsubscribe link in the newsletter or by sending us a message.
If you have purchased goods or services from us, we may use your email address pursuant to Section 7(3) UWG for advertising similar own products or services, provided that you have not objected. The legal basis is Art. 6(1)(f) GDPR.
13. Review Reminders and Customer Reviews
We may ask you to submit a review after an order, provided this is legally permitted or you have given your consent.
If we use external review services, the data required for this purpose will be transmitted to the respective provider, in particular email address, order data, and review content.
Depending on the case, the legal basis is Art. 6(1)(a) GDPR, Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR.
14. Web Analytics
We may use web analytics services, such as Google Analytics 4 or Microsoft Clarity, to statistically evaluate the use of our website and improve our offering.
Such services regularly use cookies or similar technologies and may process technical information such as IP address, device information, browser data, page views, clicks, and user behavior.
Use only takes place after your consent pursuant to Art. 6(1)(a) GDPR.
You can withdraw your consent at any time via the cookie consent tool.
15. Online Marketing, Retargeting, and Conversion Tracking
We may use marketing and tracking services, in particular:
Google Ads Conversion Tracking
Meta Pixel
affiliate tracking
retargeting services
These services help us evaluate advertising, measure campaigns, and display interest-based advertising.
Use only takes place after your consent pursuant to Art. 6(1)(a) GDPR.
You can withdraw your consent at any time via the cookie consent tool.
16. Social Media and External Content
Our website may contain content or links from external providers, such as Facebook, Instagram, Pinterest, Google Maps, or review widgets.
If external content is embedded, personal data such as IP address, browser information, and usage data may be transmitted to the respective provider.
Where legally required, embedding only takes place after your consent pursuant to Art. 6(1)(a) GDPR.
17. Automation, Internal Tools, and Accounting
We may use service providers for internal processes, accounting, process automation, communication, and data synchronization.
This may include in particular:
accounting software
automation tools
CRM systems
email and support systems
cloud services
Processing is carried out on the basis of Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR, or Art. 6(1)(f) GDPR.
Our legitimate interest lies in efficient organization, legally compliant accounting, process security, and customer support.
18. Recipients of Personal Data
We only disclose personal data where this is necessary or legally permitted.
Recipients may include in particular:
Shopify
payment service providers
shipping service providers
IT and hosting service providers
laboratory and analysis service providers
communication and support tools
newsletter and marketing service providers
review services
tax advisors
legal advisors
authorities and courts
Where service providers process personal data on our behalf, we conclude data processing agreements pursuant to Art. 28 GDPR. Art. 28 GDPR obliges processors, among other things, to process data only on documented instructions from the controller.
(GDPR-Info, Art. 28 GDPR, https://gdpr-info.eu/art-28-gdpr/)
18. Recipients of Personal Data
We only disclose personal data where this is necessary or legally permitted.
Recipients may include in particular:
Shopify
payment service providers
shipping service providers
IT and hosting service providers
laboratory and analysis service providers
communication and support tools
newsletter and marketing service providers
review services
tax advisors
legal advisors
authorities and courts
Where service providers process personal data on our behalf, we conclude data processing agreements pursuant to Art. 28 GDPR. Art. 28 GDPR obliges processors, among other things, to process data only on documented instructions from the controller.
(GDPR-Info, Art. 28 GDPR, https://gdpr-info.eu/art-28-gdpr/)
20. Storage Period
We store personal data only for as long as this is necessary for the respective purposes.
Order, contract, payment, and invoice data are stored in accordance with statutory commercial and tax retention obligations.
Analysis-related personal data is stored only for as long as necessary for analysis, provision of results, quality assurance, complaints, verification obligations, or legal obligations.
Data based on consent is processed until the consent is withdrawn, unless another legal basis exists.
Anonymized data may be used permanently for statistics, quality assurance, product improvement, and publications.
21. Data Security
We take appropriate technical and organizational measures to protect personal data.
These include in particular:
SSL/TLS encryption
access restrictions
separate processing of customer and laboratory data
analysis ID in the laboratory process
pseudonymization
internal authorization concepts
organizational protective measures
Absolute security of electronic data transmission cannot be guaranteed.
22. Rights of Data Subjects
Under the GDPR, you have the following rights:
right of access pursuant to Art. 15 GDPR
right to rectification pursuant to Art. 16 GDPR
right to erasure pursuant to Art. 17 GDPR
right to restriction of processing pursuant to Art. 18 GDPR
right to notification pursuant to Art. 19 GDPR
right to data portability pursuant to Art. 20 GDPR
right to withdraw consent pursuant to Art. 7(3) GDPR
right to object pursuant to Art. 21 GDPR
right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR
To exercise your rights, please contact us at:
23. Right to Object
If we process personal data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.
We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless the processing serves the establishment, exercise, or defense of legal claims.
If personal data is processed for direct advertising purposes, you may object at any time. After your objection, we will no longer use this data for direct advertising.
24. Objection to Analysis Evaluation Before Anonymization
You may object at any time to the processing of your personal or pseudonymized analysis and postal-code data for statistical evaluations and publication purposes, as long as the data can still be attributed to you.
After effective anonymization, attribution to you is no longer possible. Individual deletion, correction, or blocking of anonymized data is then generally no longer possible.
25. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law.
The competent authority may in particular be the supervisory authority of your place of residence or of our company’s registered office.
26. Changes to This Privacy Policy
We may amend this privacy policy if our website, services, service providers used, technical processes, or legal requirements change.
The version published on our website at the relevant time applies.
Last updated: 27 April 2026