Privacy policy

 

Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Hoppenworth & Ploch Food Products GmbH

Länderweg 21

60599 Frankfurt am Main

info@hoppenworth-ploch.de

Further information can be found in our legal notice.

2. Data Protection Officer

We have appointed a Data Protection Officer.

You can preferably contact our Data Protection Officer by post at:

Hoppenworth & Ploch Food Products GmbH

Attn. Data Protection Officer

Länderweg 21

60599 Frankfurt am Main

You can contact our Data Protection Officer by email at:

info@hoppenworth-ploch.de

Subject: Data Protection Officer / Data Protection

3. General Information on Data Processing

Thank you for your interest in our online shop. The protection of your personal data is important to us. In this Privacy Policy, we inform you about which personal data we collect, for what purposes we process it, and what rights you have.

Personal data means any information relating to an identified or identifiable natural person, e.g. name, address, email address, telephone number, order data, payment data, IP address or usage data.

We process personal data only where permitted by law. The most important legal bases are:

• Art. 6(1)(b) GDPR, where processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract.
• Art. 6(1)(c) GDPR, where we are legally obliged to process data.
• Art. 6(1)(f) GDPR, where processing is necessary for the purposes of legitimate interests.
• Art. 6(1)(a) GDPR, where you have given us your consent.

4. Accessing Our Website and Server Log Files

When you access our website, the web server automatically processes information transmitted by your browser to us or to our technical service provider. This may include, in particular:

• IP address
• date and time of access
• page or file accessed
• amount of data transferred
• referrer URL
• browser type and browser version
• operating system
• requesting provider

The processing takes place in order to technically provide the website, ensure the stability and security of the system, and prevent misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our online offering.

Server log files are stored only for as long as necessary for the purposes mentioned above and are then deleted or anonymised, unless longer storage is required for security reasons or for the establishment, exercise or defence of legal claims.

5. Hosting and Shopify Shop System

Our online shop is operated via Shopify. Depending on the contractual arrangement, the provider is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland, as well as other companies of the Shopify group.

Shopify provides us with the technical e-commerce infrastructure. In this context, personal data may be processed when you visit the shop, use the shopping cart, proceed to checkout, place an order, make a payment, use a customer account or communicate with us.

This may include, in particular:

• name
• billing and shipping address
• email address
• telephone number
• order data
• payment status
• IP address
• technical usage data
• customer account information

The processing takes place for the provision of the online shop, the processing of orders, payment processing, fraud prevention, shop security and the management of customer relationships.

The legal bases are Art. 6(1)(b) GDPR, insofar as the processing is necessary for contract processing; Art. 6(1)(c) GDPR, insofar as legal obligations apply; and Art. 6(1)(f) GDPR, insofar as the processing serves the secure and economic operation of our online shop.

Shopify may also process data outside the European Union or the European Economic Area. Where data is transferred to third countries, this is done on the basis of appropriate safeguards, in particular adequacy decisions by the European Commission, standard contractual clauses or other mechanisms permitted under the GDPR.

6. Orders, Customer Account and Contract Processing

If you place an order in our online shop, create a customer account or contact us, we process the data you provide. This may include, in particular:

• name
• billing address
• shipping address
• email address
• telephone number
• products ordered
• order number
• payment information
• delivery and shipping information
• messages and other information you provide to us

Mandatory fields are marked as such. Without this information, we may not be able to process your order, or may only be able to do so to a limited extent.

The processing takes place for the acceptance, handling and fulfilment of your order, delivery of the goods, payment processing, customer communication, handling of complaints, returns and withdrawals, and compliance with legal obligations.

The legal bases are Art. 6(1)(b) GDPR for contract processing and Art. 6(1)(c) GDPR for statutory retention and documentation obligations.

After the contract has been fully processed, your data will be restricted for further processing and deleted after the expiry of tax and commercial law retention periods, unless there is another legal basis for longer storage.

7. Customer Account

If you create a customer account, we store the data you provide so that you can place future orders more conveniently and view your order history.

The processing takes place on the basis of Art. 6(1)(b) GDPR, insofar as the customer account is used for contract performance, and on the basis of Art. 6(1)(f) GDPR, insofar as our legitimate interest lies in providing a user-friendly customer account.

You can have your customer account deleted at any time. Please contact us using the contact details provided in our legal notice. Statutory retention obligations remain unaffected.

8. Payment Processing

We use payment service providers for payment processing. Depending on the payment method you select during the order process, payment data will be transmitted to the respective payment service provider or collected directly by that provider.

The following data may be processed in particular:

• name
• billing address
• shipping address
• email address
• order amount
• payment method
• transaction data
• further payment information, insofar as required for the respective payment method

The processing takes place for the purpose of processing your payment. The legal basis is Art. 6(1)(b) GDPR.

Depending on the selected payment method, the following service providers may be involved in particular:

• Shopify Payments
• PayPal
• Klarna
• credit card providers
• Apple Pay
• Google Pay

The privacy information of the respective payment service provider also applies to the processing carried out by that provider.

9. Shipping and Delivery

For the delivery of your order, we pass on the data required for this purpose to shipping service providers. This may include, in particular:

• name
• shipping address
• email address
• telephone number
• order and shipping information

The disclosure takes place where it is necessary for delivery, on the basis of Art. 6(1)(b) GDPR.

In particular, we use the following shipping service providers and shipping platforms:

• DHL Paket GmbH
• Deutsche Post AG
• Sendcloud GmbH

For international shipments, the data required for delivery may also be transmitted to local postal and parcel service providers in the respective destination country, insofar as this is necessary for the delivery of the order.

Where your email address or telephone number is transmitted to shipping service providers for parcel notifications or delivery coordination, this only takes place where there is a legal basis for doing so, in particular where this is necessary for delivery or where you have given your consent.

10. Communication, Contact Form and Email

If you contact us by email, contact form, telephone or another method, we process the data you provide in order to handle your enquiry.

This may include:

• name
• email address
• telephone number
• content of your message
• order number
• other information you provide to us

The legal basis is Art. 6(1)(b) GDPR if your enquiry is related to a contract or an order. In all other cases, the processing takes place on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in handling your enquiry. If you have expressly given your consent, the legal basis is Art. 6(1)(a) GDPR.

Enquiries are deleted as soon as they are no longer required and no statutory retention obligations apply.

11. Withdrawal, Returns and Withdrawal Button

Our website may provide functions that allow you to submit a withdrawal, return or other enquiry in connection with your order. This may be done in particular via a link, button, form or displayed modal.

If you use such a function, we process the data you provide in order to handle your withdrawal or enquiry. This may include, in particular:

• name
• email address
• order number
• affected products
• message text
• time of the enquiry
• technical information such as IP address or browser data

The processing takes place for the handling of your statutory right of withdrawal, contract processing and compliance with legal obligations. The legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR.

For the provision of the withdrawal and returns function, we use the EU Withdrawal Button service provided by 401layers UG, Dorothea-Erxleben-Str. 1 a, 40721 Hilden, Germany. The provider processes the personal data required for the provision and handling of the withdrawal and returns function. Further information can be found in the provider’s privacy information.

12. Newsletter

If you subscribe to our newsletter, we use your email address and any other voluntarily provided data to regularly send you information about our products, offers, coffees, events and news.

Subscription takes place only with your consent. The legal basis is Art. 6(1)(a) GDPR.

For sending newsletters, we use Shopify Email, a function of our Shopify shop system. The provider is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland, as well as other companies of the Shopify group.

The following data may be processed in particular:

• email address
• name, if provided
• subscription time
• IP address at the time of subscription
• consent status
• newsletter interactions, e.g. openings and clicks, where used

You can unsubscribe from the newsletter at any time, for example via the unsubscribe link in each newsletter email or by sending us a message. After unsubscribing, we delete your email address from the active mailing list, unless there is another legal basis for further storage.

Where Shopify processes personal data outside the European Union or the European Economic Area, this is done on the basis of appropriate safeguards within the meaning of the GDPR, in particular adequacy decisions, standard contractual clauses or other permitted mechanisms.

13. Newsletter Analytics

Our newsletters may contain analytics functions that allow us to determine whether a newsletter has been opened and which links have been clicked. We use this information to better tailor our newsletters to the interests of recipients.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, insofar as such analytics are used. You can withdraw your consent at any time with effect for the future by unsubscribing from the newsletter or contacting us.

14. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small text files stored on your device. Similar technologies may include, for example, local storage, pixels, tags or scripts.

We distinguish between technically necessary technologies and non-necessary technologies.

Technically necessary technologies are required for our website and online shop to function. These include, for example, shopping cart, checkout, login, language settings, security functions and consent management. The legal basis for storing or accessing information on your device is Section 25(2) TDDDG. The subsequent processing of personal data takes place on the basis of Art. 6(1)(f) GDPR or Art. 6(1)(b) GDPR, insofar as the processing is necessary for the operation of the shop or contract processing.

Non-necessary technologies, in particular for analytics, marketing, personalisation or external media, are used only if you have given your consent. The legal basis for storing or accessing information on your device is Section 25(1) TDDDG. The subsequent processing of personal data takes place on the basis of Art. 6(1)(a) GDPR.

You can change or withdraw your consent at any time with effect for the future. To do so, use the settings in our cookie banner or consent tool.

15. Consent Management

We use Shopify’s integrated functions to manage cookie and privacy settings. These functions can be used to obtain, document and manage consent for the use of certain cookies and similar technologies.

The following data may be processed in particular:

• consent status
• date and time of consent
• browser and device information
• website accessed
• IP address in truncated or full form
• technical identifiers for assigning consent

The processing takes place for the management and documentation of your consent and for the implementation of your privacy and cookie settings. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest lies in the legally compliant management and documentation of consent.

Where information is stored on or accessed from your device for this purpose, this is done for technically necessary functions on the basis of Section 25(2) TDDDG.

You can change or withdraw your consent at any time with effect for the future via the cookie or privacy settings on our website.

16. Web Analytics with Google Analytics 4

If you have given your consent, we use Google Analytics 4, a web analytics service provided by Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The parent company is Google LLC, USA.

Google Analytics 4 enables us to analyse the use of our website. In particular, the following data may be processed:

• page views
• interactions on the website
• technical information about browser and device
• approximate location
• referrer URL
• duration of use
• events in the shop
• truncated or pseudonymous online identifiers

We use Google Analytics 4 only on the basis of your consent. The legal basis is Art. 6(1)(a) GDPR. The storage of or access to information on your device takes place on the basis of Section 25(1) TDDDG.

Google Analytics 4 does not, by default, log or store IP addresses in reports. According to Google, IP addresses are used to derive location information and are then discarded.

It cannot be excluded that data may be transferred to Google LLC in the USA. Where data is transferred to the USA, this is done on the basis of the EU-US Data Privacy Framework, insofar as the recipient is certified accordingly, or on the basis of other appropriate safeguards within the meaning of the GDPR.

You can withdraw your consent at any time via the settings in our cookie banner.

17. Google Ads and Conversion Tracking

If you have given your consent, we use Google Ads and Google Conversion Tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The parent company is Google LLC, USA.

With Google Ads, we can display advertisements in Google search results and on third-party websites. With conversion tracking, we can measure whether users perform certain actions after clicking on an advertisement, such as completing a purchase or visiting a page.

The following data may be processed in particular:

• clicks on advertisements
• pages accessed
• conversions
• technical device and browser information
• pseudonymous identifiers
• approximate location information

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. The storage of or access to information on your device takes place on the basis of Section 25(1) TDDDG.

It cannot be excluded that data may be transferred to Google LLC in the USA. Where data is transferred to the USA, this is done on the basis of the EU-US Data Privacy Framework, insofar as the recipient is certified accordingly, or on the basis of other appropriate safeguards within the meaning of the GDPR.

You can withdraw your consent at any time via the settings in our cookie banner.

18. Meta Pixel and Meta Ads

If you have given your consent, we use technologies provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

With the Meta Pixel or comparable technologies, we can determine whether users perform certain actions on our website after clicking on a Facebook or Instagram advertisement. We can also create audiences for advertisements and measure the effectiveness of our advertising.

The following data may be processed in particular:

• pages accessed
• clicks
• purchase events
• shopping cart events
• technical device and browser information
• IP address
• pseudonymous identifiers
• hashed contact data, where configured accordingly

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. The storage of or access to information on your device takes place on the basis of Section 25(1) TDDDG.

It cannot be excluded that data may be transferred to Meta companies outside the European Union or the European Economic Area. Where data is transferred to third countries, this is done on the basis of appropriate safeguards within the meaning of the GDPR.

You can withdraw your consent at any time via the settings in our cookie banner.

19. Shopify Analytics and Shop Evaluations

As part of the operation of our Shopify shop, Shopify analytics functions may be used to evaluate orders, sales, product performance, shopping carts, visitor flows and the use of the shop.

In particular, order data, usage data and technical information may be processed. The processing takes place, insofar as it is necessary for the operation, improvement and economic management of our shop, on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the analysis and optimisation of our online shop.

Where non-necessary cookies or comparable technologies are used for this purpose, this is done only on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

20. Embedded Content and External Media

Our website may include third-party content, such as videos, maps, social media posts, external fonts or comparable content.

If you access a page on which such external content is embedded, your browser may transmit technically necessary connection data to the respective provider. This may include, in particular, your IP address, browser and device information, date and time of access, and the page accessed.

External content that is not technically necessary for the operation of our website is generally loaded only if you have given your consent. The legal basis for storing or accessing information on your device is Section 25(1) TDDDG. The subsequent processing of personal data takes place on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

Where external content is technically necessary or actively accessed by you, the processing takes place on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the user-friendly and technically functional provision of our website and embedded content.

You can change or withdraw your consent at any time with effect for the future via the cookie or privacy settings on our website.

21. Social Media Presences

We maintain presences on social networks and platforms, in particular Instagram, Facebook, LinkedIn and other platforms.

If you visit our social media profiles or interact with us there, personal data may be processed by us and by the respective platform provider. This may include, in particular, profile information, interactions, messages, comments, likes and technical usage data.

We process your data in order to communicate with you, provide content and carry out our public relations activities. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in communication with customers and interested parties as well as in the presentation of our company.

The privacy information of the respective platform providers also applies to processing carried out by those providers. We have only limited influence over the scope and purposes of data processing by the platform providers.

22. Applications

If you apply to us, we process the application data you provide for the purpose of carrying out the application process.

This may include, in particular:

• name
• contact details
• CV
• certificates
• cover letter
• availability
• salary expectations
• other information you provide

The legal basis is Section 26 BDSG and Art. 6(1)(b) GDPR. If you have given your consent, for example to be included in an applicant pool, the legal basis is Art. 6(1)(a) GDPR.

Application data will be deleted as soon as it is no longer required for the application process and no statutory retention periods apply.

23. Business Partners, B2B Customers and Suppliers

We process personal data of contact persons at business partners, B2B customers, suppliers and service providers.

This may include:

• name
• business contact details
• position
• communication content
• contract and order data
• payment and billing information

The processing takes place for the purpose of conducting business relationships, communication, contract processing and compliance with legal obligations. The legal bases are Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR.

24. Disclosure of Data to Service Providers

We use external service providers who support us in operating our company and our online shop. These may include service providers from the following areas:

• shop system and hosting
• payment processing
• shipping and fulfilment
• newsletter and email marketing
• accounting and invoicing
• customer service
• web analytics and marketing
• IT security
• consent management
• returns and withdrawal processing

Where these service providers process personal data on our behalf, we enter into data processing agreements with them in accordance with Art. 28 GDPR. Where service providers act as independent controllers, the disclosure is based on the applicable legal basis.

Personal data is disclosed only where this is necessary, where there is a legal obligation, where you have given your consent, or where another legal basis applies.

25. Data Transfers to Third Countries

Some of the service providers we use may process personal data outside the European Union or the European Economic Area, in particular in the USA.

A transfer to third countries takes place only if the requirements of Art. 44 et seq. GDPR are met. This may be the case, in particular, where:

• an adequacy decision by the European Commission exists for the third country
• the recipient is certified under the EU-US Data Privacy Framework
• standard contractual clauses have been concluded
• additional safeguards are in place
• you have expressly given your consent
• the transfer is necessary for contract performance

A transfer to third countries may also take place where this is necessary for the performance of a contract, in particular if you request delivery to a country outside the European Union or the European Economic Area. In this case, the data required for delivery and customs clearance may be transmitted to shipping, postal, parcel and delivery service providers as well as customs authorities in the respective destination country.

This may include, in particular:

• name
• shipping address
• email address
• telephone number
• order and shipping information
• customs clearance information

The transfer takes place, insofar as it is necessary for contract performance, on the basis of Art. 6(1)(b) GDPR in conjunction with Art. 49(1)(b) GDPR.

Where the transfer is necessary to comply with legal obligations, in particular in connection with customs, export or tax obligations, the processing takes place on the basis of Art. 6(1)(c) GDPR.

26. Storage Period

We store personal data only for as long as necessary for the respective purposes or where statutory retention periods apply.

Order, contract and invoice data are generally stored for the duration of the retention periods under commercial and tax law. Communication data is deleted once the respective enquiry has been finally processed and no retention obligations apply. Data processed on the basis of consent is stored until consent is withdrawn or until the purpose of the processing no longer applies.

27. Your Rights

Subject to the statutory requirements, you have the following rights:

• right of access pursuant to Art. 15 GDPR
• right to rectification pursuant to Art. 16 GDPR
• right to erasure pursuant to Art. 17 GDPR
• right to restriction of processing pursuant to Art. 18 GDPR
• right to data portability pursuant to Art. 20 GDPR
• right to object pursuant to Art. 21 GDPR
• right to withdraw consent given pursuant to Art. 7(3) GDPR
• right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

To exercise your rights, you can contact us at any time. The contact details can be found above in this Privacy Policy and in our legal notice.

28. Withdrawal of Consent

If you have given us your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

You can withdraw or change consent for cookies, analytics and marketing technologies via the settings in our cookie banner.

29. Right to Object

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.

If we process personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing. This also applies to profiling insofar as it is related to such direct marketing.

After you object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

30. Current Version and Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy if our website, our services, the service providers we use or the legal requirements change.

Version: June 2026