Privacy Policy
Privacy Policy
We are pleased about your interest in nako naturals. The protection of your personal data is important to us. Below we inform you, in accordance with Art. 13 and 14 of the EU General Data Protection Regulation (GDPR), about how we process personal data when you visit this website and how you can exercise your rights.
1. Controller
The controller within the meaning of the GDPR is:
nako naturals GmbH
Industriestrasse 5
21394 Kirchgellersen, Germany
Phone: +49 (0) 4135 610 900-0
E-mail: sales@nakonaturals.com
For all questions regarding data protection, you can contact us at any time at the above address or by e-mail.
2. Hosting
This website is operated on the cloud platform of Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium. When you visit this website, all data entered on it and the technical access data described in section 3 are processed on the servers of this provider. We have concluded a data processing agreement (Art. 28 GDPR) with Odoo S.A. Odoo S.A. processes the data on our behalf and in accordance with our instructions. Further information can be found in Odoo's privacy policy at https://www.odoo.com/privacy.
3. Access data / server log files
When you visit this website, technical access data is automatically processed for the purpose of delivering the website, ensuring its stability and security, and detecting misuse. This includes: IP address, date and time of the request, requested page/file, amount of data transferred, browser type and version, operating system, and referrer URL.
The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically error-free and secure provision of the website. Log data is not merged with other data sources and is deleted or anonymised within a short period, unless it is required for the investigation of a specific security incident.
4. Cookies and consent
This website uses cookies. Cookies that are strictly necessary for the operation of the website (e.g. session and language cookies) are set on the basis of § 25 (2) TDDDG and Art. 6 (1) (f) GDPR. All other cookies — in particular analytics cookies — are only set after you have given your consent via our cookie banner (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR).
You can refuse optional cookies in the banner ("Allow only essential cookies") without any disadvantages, and you can withdraw consent you have given at any time with effect for the future by deleting the cookies in your browser — the cookie banner will then be displayed again and you can make a new selection. A detailed list of all cookies used, their purposes and their storage periods can be found in our Cookie Policy.
5. Web analytics: Google Analytics 4
Provided that you have given your consent via the cookie banner, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and similar technologies to analyse your use of our website (e.g. pages visited, duration of visit, approximate region, device and browser type) and to compile aggregated reports on website activity for us.
The legal basis for this processing is exclusively your consent, Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. If you do not give your consent, or if you reject optional cookies, Google Analytics is not loaded and no data is transmitted to Google. In Google Analytics 4, IP addresses are not stored; they are used solely for an approximate geographic classification and are deleted immediately afterwards.
In connection with the use of Google Analytics, data may be transferred to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR. In addition, we have concluded the EU standard contractual clauses with Google as part of the Google Ads Data Processing Terms.
The data collected via Google Analytics is deleted after a maximum of 14 months. You can withdraw your consent at any time as described in section 4. Further information on data processing by Google can be found at https://policies.google.com/privacy.
6. Contact form and e-mail contact
If you contact us via the contact form on this website or by e-mail, the data you provide (e.g. name, company, e-mail address, phone number, subject and your message) will be processed by us for the purpose of handling your enquiry and for possible follow-up questions.
The legal basis is Art. 6 (1) (b) GDPR, insofar as your enquiry is related to the initiation or performance of a contract, and otherwise Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the effective handling of enquiries addressed to us. We delete enquiry data as soon as it is no longer required for the processing of your enquiry and no statutory retention obligations (in particular under commercial and tax law, § 257 HGB, § 147 AO) require further storage.
7. Business partner and customer data
If you enter into a business relationship with us as a customer, supplier or interested party, we process the personal data of your contact persons (e.g. name, business contact details, correspondence, order and delivery data) for the purpose of preparing, concluding and performing contracts, for quality and traceability documentation customary in the food and cosmetics ingredients industry, and for compliance with statutory obligations.
The legal bases are Art. 6 (1) (b) GDPR (performance of a contract), Art. 6 (1) (c) GDPR (legal obligations, e.g. food safety, customs and tax law) and Art. 6 (1) (f) GDPR (legitimate interest in the orderly management of our business relationships). This data is stored for the duration of the business relationship and subsequently in accordance with the statutory retention periods.
8. Recipients of personal data
Within our company, only those departments and persons who need your data to fulfil the purposes described above have access to it. In addition, we use carefully selected service providers (in particular our hosting provider, see section 2, and — subject to your consent — Google as analytics provider, see section 5), which process personal data on our behalf on the basis of data processing agreements pursuant to Art. 28 GDPR. Data is only transferred to other third parties (e.g. authorities, freight carriers, banks) where this is necessary for the performance of a contract or where we are legally obliged to do so.
9. Transfers to third countries
As a matter of principle, we process your data within the European Union / the European Economic Area. Insofar as data is transferred to the United States in connection with Google Analytics, this is done on the basis of the EU-U.S. Data Privacy Framework adequacy decision and the EU standard contractual clauses (see section 5). Within our group of companies, data may be shared with nako naturals Private Limited in India where this is necessary for the performance of a contract with you (Art. 49 (1) (b) GDPR) or on the basis of EU standard contractual clauses pursuant to Art. 46 (2) (c) GDPR.
10. Storage periods
Unless a specific storage period is stated in this privacy policy, we store personal data only for as long as is necessary to fulfil the respective purpose. After the purpose has ceased to apply, the data will be deleted unless statutory retention obligations (in particular retention periods of up to 10 years under commercial and tax law) require continued storage; in this case, processing is restricted accordingly.
11. Your rights
As a data subject, you have the following rights vis-à-vis us:
- the right of access to the personal data we process about you (Art. 15 GDPR),
- the right to rectification of inaccurate data (Art. 16 GDPR),
- the right to erasure (Art. 17 GDPR),
- the right to restriction of processing (Art. 18 GDPR),
- the right to data portability (Art. 20 GDPR),
- the right to object to processing based on Art. 6 (1) (e) or (f) GDPR (Art. 21 GDPR), and
- the right to withdraw consent you have given at any time with effect for the future (Art. 7 (3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected.
To exercise your rights, an informal message to the contact details given in section 1 is sufficient.
Right to object (Art. 21 GDPR)
Where we process your personal data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Right to lodge a complaint with a supervisory authority
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is:
Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany
12. No automated decision-making
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
13. Obligation to provide data
You are neither legally nor contractually obliged to provide personal data on this website. However, without certain data (e.g. your contact details when using the contact form) we may not be able to process your enquiry.
14. Changes to this privacy policy
We reserve the right to adapt this privacy policy so that it always complies with the current legal requirements or to reflect changes to our services (e.g. the introduction of new services). The new privacy policy will then apply to your next visit.
Last updated: 1 July 2026
