Legal · Dr. Gabriel’s SUPERHERBS
Last updated: 18 October 2026
This English version is a translation provided for your convenience. Only the German version is legally binding.
The controller responsible for processing personal data on this website is:
BOSMEN GmbH
Franzosenweg 13, Top 3
1100 Vienna
Austria
Email: info@drgabriels.eu
Phone: +43 660 6392200
Website: https://drgabriels.eu/
In accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR), this privacy policy informs you which personal data we process and for what purposes.
Depending on how you use our online shop, we process in particular:
• technical access data, such as IP address, time of access, pages visited, browser and device information and, where applicable, error and security logs;
• contact and order data, in particular name, billing and delivery address, email address, phone number, items ordered, order number and order history;
• payment information, such as the payment method chosen, payment status, transaction references and data required for payment processing;
• messages you send us by email or via contact forms;
• your email address and proof of consent if you voluntarily sign up for our offer emails;
• usage, analytics and marketing data, insofar as valid consent has been given for this.
We sell food supplements. Depending on the product, an order may in some circumstances allow conclusions to be drawn about health-related interests. We do not request medical diagnoses in the regular ordering process. Please do not send us sensitive health information in free text fields unless this is necessary.
Our website is operated on systems of the hosting provider Host Europe GmbH:
Host Europe GmbH (hosting and email infrastructure)
Germany
https://www.hosteurope.de/
When you visit the website, for technical reasons, in particular IP addresses, date and time, content accessed, browser information and server logs may be processed. This serves technical operation, stability and the prevention of attacks and misuse.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website), insofar as the processing is not necessary for the performance of pre-contractual measures or a contract under Art. 6(1)(b) GDPR.
Server and security logs are only kept for as long as necessary for the purposes stated. Specific log retention periods depend on the hosting and security configuration actually in use.
The domain drgabriels.eu is registered with GoDaddy. Insofar as personal contact data are processed in connection with domain management, the relevant privacy information of the registrar applies: https://www.godaddy.com/legal/agreements/privacy-policy
We use WordPress with WooCommerce for the online shop. To process orders, we process the data you provide during the ordering process: in particular name, address, email address, phone number where applicable, goods ordered, price, payment and shipping method chosen and information on processing the order.
The purposes are the acceptance and processing of the order, invoicing, payment processing, delivery, customer communication and the handling of returns, statutory consumer claims and our voluntary 60-day money-back guarantee.
Legal bases: Art. 6(1)(b) GDPR (contract / pre-contractual measures), Art. 6(1)(c) GDPR (statutory retention and documentation obligations) and, where necessary, Art. 6(1)(f) GDPR (prevention of misuse, enforcement of legal claims and customer service).
Insofar as the shop offers the option of setting up a customer account, the account data and order overviews required for this are processed. Information on the customer account functions actually offered can be found in the respective registration and ordering process.
We use the Stripe integration for WooCommerce to process payments. The checkout currently offers in particular credit card (Visa, Mastercard), Apple Pay, Google Pay, EPS and SEPA Direct Debit.
For payment processing, the data required for payment may be transmitted to companies of the Stripe group and, where applicable, to other payment service providers or banks involved in the respective payment method. This may include contact data, transaction data, billing data and – depending on the payment method – card or account data. Payment data are generally processed by the respective payment service; we do not store full card information as normal WooCommerce order data.
Legal basis: Art. 6(1)(b) GDPR (payment processing) and, where applicable, Art. 6(1)(c) and (f) GDPR (legal obligations, fraud prevention and receivables management).
Further information: https://stripe.com/at/privacy
The specific Stripe companies and other payment service providers involved in processing depend on the payment method used and the Stripe agreements concluded.
To fulfil the purchase contract, we transmit the information required for delivery (in particular name, delivery address and – if necessary for delivery or shipment notification – contact details) to our shipping provider. We mainly use DPD; other suitable shipping providers may be used if necessary.
Legal basis: Art. 6(1)(b) GDPR.
If you contact us via info@drgabriels.eu or via a contact form, where offered, we process the information you provide and the content of your message in order to answer your enquiry.
Legal basis: Art. 6(1)(b) GDPR if the enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (answering legitimate enquiries), or Art. 6(1)(a) GDPR if consent is required in an individual case.
On our website you can voluntarily sign up for emails with exclusive offers, vouchers and information about new products from Dr. Gabriel’s SUPERHERBS. Signing up is not a requirement for making a purchase. We use a double opt-in procedure: after signing up, you receive an email with a confirmation link. Only after your confirmation do we send you offer emails.
As proof of your consent, we store your email address, the language chosen, the wording of the consent text, the page on which you signed up, and the times of sign-up, of sending the confirmation email, of confirmation and, where applicable, of unsubscribing. Your details are transmitted via the sign-up form on our website (WordPress/Elementor), stored there as a form submission and forwarded to a Google spreadsheet (Google Sheets) maintained by us, which is processed with Google Apps Script (see section 9).
The legal basis for sending such voluntarily requested promotional messages is your consent under Art. 6(1)(a) GDPR in conjunction with the applicable Austrian rules on electronic advertising. You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe option in our promotional emails or by email to info@drgabriels.eu.
Your email address will then no longer be used for these promotional purposes; necessary proof data may continue to be stored to the extent permitted by law.
To send transactional emails (such as order and shipping confirmations), we use WordPress with the WP Mail SMTP plugin. Emails are sent via our own mailbox info@drgabriels.eu and the SMTP host mail.drgabriels.eu; the technical infrastructure provider is Host Europe GmbH.
We send confirmation emails for the double opt-in procedure and – if you have subscribed to them – offer emails via a Google account (Gmail) using our sender address info@drgabriels.eu; delivery takes place via the SMTP host mail.drgabriels.eu. The sign-up data are stored in Google Sheets and processed with Google Apps Script. The provider of these services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer of personal data to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy
We do not currently use a separate external newsletter platform such as Mailchimp or Brevo. When emails are sent, in particular sender and recipient addresses, sending times, technical connection data and message content are processed.
Legal basis for transaction-related messages: Art. 6(1)(b) GDPR; for legally required messages additionally Art. 6(1)(c) GDPR; for voluntary offer emails Art. 6(1)(a) GDPR.
For the technical provision of the shop we use WordPress and extensions, including WooCommerce and Elementor. Whether additional providers receive personal data via individual extensions depends on the functions and interfaces activated.
Our online shop uses technically necessary cookies or comparable storage technologies, for example for the shopping cart and checkout functions and to store your privacy settings. Such functions are necessary for the shop service you request.
In addition, analytics, advertising and comparable tracking technologies may be used – exclusively after the prior consent required for this. This applies, among others, to the services described below, insofar as they are actually activated on the website.
Legal bases: for strictly necessary processing, Art. 6(1)(b) or (f) GDPR and the relevant exceptions of § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021); for storage on or access to end devices that requires consent, § 165(3) TKG 2021, and for the subsequent data processing Art. 6(1)(a) GDPR.
You can withdraw or change your voluntary consent at any time with effect for the future. A permanently accessible “Cookie settings” link is provided in the footer for this purpose. The “Statistics” and “Marketing” categories remain deactivated until valid consent has been given; technically necessary cart, checkout and security technologies remain possible. The banner offers the equivalent buttons “Accept all” and “Continue without consent” as well as the option “Set privacy settings individually”. Rejecting non-essential technologies does not prevent you from making a purchase.
Consent management (Real Cookie Banner)
To obtain and manage your consent, we use the WordPress plugin “Real Cookie Banner” by devowl.io GmbH, Germany. The plugin runs on our own server; visitor data are not transmitted to the plugin provider. Your choice is stored in a cookie (“real_cookie_banner*”, storage period 12 months). As proof of consent (Art. 7(1) GDPR), we also store in our database a random consent ID, the time, the choice made, the banner version and technical information such as, where applicable, a shortened or pseudonymised IP address and the browser type. Legal basis: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR; setting this cookie is strictly necessary within the meaning of § 165(3) TKG 2021.
Technically necessary (“Essential” category)
• WooCommerce: cookies “woocommerce_items_in_cart”, “woocommerce_cart_hash” and “wp_woocommerce_session_*” for the shopping cart and ordering process (storage period: browser session or up to 2 days); for logged-in customers, additionally the WordPress login cookies.
• Stripe: cookies “__stripe_mid” (1 year) and “__stripe_sid” (30 minutes) for fraud prevention in payment processing (see section 5).
Legal basis: § 165(3) TKG 2021 (strictly necessary) and Art. 6(1)(b) and (f) GDPR.
Functional
• Elementor popups: the local storage of your browser records whether and how often a pop-up has already been shown to you so that it does not appear repeatedly. This only happens with your consent. Legal basis: Art. 6(1)(a) GDPR and § 165(3) TKG 2021.
Statistics: WooCommerce Order Attribution
Only if you consent to the “Statistics” category do we use the WooCommerce “Order Attribution” function. It records how you reached our website – such as the referral source (e.g. search engine or social network), campaign parameters (UTM), landing page, device type and the number of page views in the session – and stores this information in the “sbjs_*” cookies (storage period: browser session, “sbjs_session” 30 minutes). If you place an order, this information is stored together with the order in our shop. We use it exclusively to identify the channels through which orders are placed; it is not passed on to third parties. Without consent, these cookies are not set and no source data are stored with the order. Legal basis: Art. 6(1)(a) GDPR and § 165(3) TKG 2021.
An overview of all services used, with cookie names and storage periods, is available at any time via the “Cookie settings” link in the footer of our website. There you can also change or withdraw your choice.
Where activated and covered by your consent, we use Google Analytics 4 for the statistical analysis of the use of our shop and Google Ads to measure the effectiveness of our advertising and, where applicable, to create advertising audiences. Google Site Kit may be used for the technical connection and display of Google services in WordPress.
Online identifiers, device and browser data, usage events, pages visited, approximate location information and interactions with products or ads may be processed. Depending on the service and contractual arrangement, Google acts as a processor or as an independent controller.
Legal basis for tracking that requires consent: Art. 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021. Information from Google: https://policies.google.com/privacy
Where activated and after the required consent has been given, we use services from Meta (e.g. Meta Pixel and Meta Conversions API) to evaluate campaigns, measure conversions and deliver targeted advertising on Meta’s platforms.
Usage events such as page views, cart actions or purchases, online identifiers and – depending on the actual configuration – matched contact information may be processed and transmitted to Meta. This may take place via the browser and, in the case of the Conversions API, additionally on the server side. Server-side transmissions must not circumvent the required consent.
Legal basis for transmission and processing that require consent: Art. 6(1)(a) GDPR and § 165(3) TKG 2021, where applicable.
Information from Meta: https://www.facebook.com/privacy/policy/
Where activated and after the required consent has been given, we use the TikTok Pixel to measure advertising success and optimise our advertising campaigns. Device and browser information, identifiers and event data, such as page views and purchase events, may be transmitted to TikTok.
Legal basis: Art. 6(1)(a) GDPR and § 165(3) TKG 2021, where applicable.
Information from TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/en
Depending on the processing, recipients may include in particular our hosting company, IT and email service providers used for technical purposes, payment service providers, banks, shipping companies and – for technologies that are activated and approved accordingly – analytics and advertising platforms.
With certain external services, personal data may be processed outside the European Economic Area, in particular in the USA. If an adequate level of data protection for the respective recipient is not ensured by a relevant adequacy decision (e.g. for recipients certified under the EU-US Data Privacy Framework), permitted transfers are based on appropriate safeguards, in particular standard contractual clauses, and, where applicable, supplementary measures. The specific providers used and the bases for transfer depend on the active integrations.
We only keep personal data for as long as necessary for the respective purposes or as required by statutory retention obligations.
In particular, under Austrian law, invoices and business records relevant for tax purposes generally have to be kept for seven years; in special cases, longer retention may be necessary. Order data are kept to the extent necessary for contract processing, accounting, warranty, legal claims and statutory obligations.
We process data for voluntary promotional messages for this purpose until you withdraw your consent or until the offer ends; necessary proof of consent may be stored beyond this to fulfil documentation obligations. For technical logs and tracking data, the necessary and actually configured deletion periods of the respective systems apply.
Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to certain processing (Art. 21).
You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). If personal data are processed for direct marketing, you can object to this processing at any time.
You can send your requests to info@drgabriels.eu. If you believe that your data are being processed unlawfully, you can lodge a complaint with the competent supervisory authority:
Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
https://www.dsb.gv.at/
Certain information, in particular the data needed for invoicing, delivery and payment, is required to process a purchase contract. Without it, we may not be able to process the order. Voluntary consent to advertising and consent to non-essential tracking are not a requirement for placing an order.
We adapt this privacy policy when legal requirements or the technologies and processing operations we actually use change. The version published on this website applies.
