Privacy Policy

Last updated: September 2026. This privacy policy informs you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), about the processing of personal data on our website and in connection with your order.

1. Data controller

The controller responsible for data processing within the meaning of Article 4(7) GDPR is:

AURO OLIVE S.L.
Calle Los Esparteros 10
23537 Bedmar, Jaén, Spain
Authorised representative: Andrés Quesada Donoso
Email: hallo@auroolivenoel.com
Phone: [PLEASE ADD: phone number]
Website: auroolivenoel.com

A data protection officer has not been appointed, as we are not legally required to do so. If you have any questions about data protection, you can reach us at the email address given above.

Since we specifically address consumers in Germany with a German-language offering, prices in euros and delivery to Germany, we apply the data protection law that is directly applicable throughout the EU (the GDPR), supplemented by German law (BDSG, TDDDG), to the processing of your data.

2. General information on data processing

As a matter of principle, we process our users’ personal data only to the extent necessary to provide a functioning website together with our content and services. Data is processed on a regular basis only with your consent or where the processing is permitted by statutory provisions.

The following legal bases in particular may apply:

  • Article 6(1)(a) GDPR – your consent (e.g. for non-essential cookies, analytics, newsletter/waitlist);
  • Article 6(1)(b) GDPR – performance of a contract or pre-contractual measures (e.g. order processing);
  • Article 6(1)(c) GDPR – compliance with legal obligations (e.g. retention required under commercial and tax law);
  • Article 6(1)(f) GDPR – safeguarding legitimate interests (e.g. the technical operation and security of the website).

3. Hosting and server log files

Our website is hosted by an external service provider:

Webempresa (Webempresa Europa, S.L.), with server location within the European Union. The host processes the data transmitted via the website on our behalf. The basis for this is a data processing agreement pursuant to Article 28 GDPR.

Each time our website is accessed, the server automatically collects information transmitted by your browser and stores it in what are known as server log files. The following are recorded:

  • IP address of the requesting device,
  • date and time of access,
  • page/file accessed and volume of data transferred,
  • notification of successful retrieval (status code),
  • browser type and version used, operating system,
  • referrer URL (previously visited page).

Purpose: ensuring a smooth connection, convenient use, evaluation of system security and stability, and administrative purposes.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in the technically error-free and secure operation of the website).
Retention period: for security reasons, log files are generally stored for no longer than [PLEASE ADD: specific retention period for the server log files according to Webempresa, e.g. 7 or 14 days] and then deleted.

4. Cookies and consent management (Consent Mode v2)

Our website uses cookies and comparable technologies (e.g. local storage). Cookies are small text files that are stored on your device. We distinguish between technically necessary cookies and cookies that require consent.

Technically necessary cookies are required so that the website and the ordering process (cart, session, security) function. They are stored on the basis of Section 25(2) TDDDG; the subsequent processing is based on Article 6(1)(b) or (f) GDPR.

Cookies and services requiring consent (in particular statistics/analytics, see Section 5) are only set or triggered after you have given your consent via our cookie banner. The legal basis for storage on/access to your device is Section 25(1) TDDDG, and for the subsequent processing Article 6(1)(a) GDPR.

When you first access the website, we display a cookie banner (consent tool) through which you can agree to or decline the use of non-essential cookies. We use Google Consent Mode v2. By default, all purposes requiring consent (including analytics_storage, ad_storage, ad_user_data, ad_personalization) are pre-set to “denied” for as long as you do not give your consent. The respective storage and processing operations are only enabled once you have given your consent.

You can change or withdraw your choice at any time with effect for the future by calling up the cookie settings again via the cookie banner (where you can change your choice at any time) and by deleting the cookies in your browser. In addition, you can delete cookies that have already been set in your browser and prevent new cookies from being set.

5. Web analytics: Google Tag Manager and Google Analytics 4

5.1 Google Tag Manager

We use Google Tag Manager (GTM-NSVQBTKM), a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager itself is a tool for managing website tags without storing any data of its own in the form of cookies; it serves to integrate other services (such as Google Analytics 4) on a technical level and to make their triggering dependent on your consent. Tags that require consent are only triggered via Tag Manager after you have given your consent.

5.2 Google Analytics 4

We use Google Analytics 4 (measurement ID: G-7HM0J4KLWY), a web analytics service provided by Google Ireland Limited. Google Analytics uses cookies and similar technologies to analyse the use of our website (e.g. pages visited, time spent, approximate region of origin, device used, interactions in the shop). IP addresses are truncated by Google Analytics 4 or not stored as part of the reports; we do not combine data to directly identify individuals.

Purpose: analysis and improvement of our offering, reach measurement and statistical evaluation of usage behaviour.
Legal basis: exclusively your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. No analysis takes place without your consent (Consent Mode v2, default “denied”).
Retention period: the cookies set by Google Analytics have different lifespans depending on their type (generally up to 2 years). Usage and event data are retained at Google account level for a period configured by us of [PLEASE ADD: retention period set in Google Analytics, default 2 or 14 months] and then automatically deleted.

5.3 Data transfer to Google / USA

The provider of the services is Google Ireland Limited. In the course of processing, personal data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (DPF); transfers to the USA are therefore based on an adequacy decision of the EU Commission pursuant to Article 45 GDPR. In addition, Google has entered into standard contractual clauses pursuant to Article 46 GDPR. We point out that, despite these safeguards, a residual risk of access by US authorities cannot be entirely ruled out in the case of a transfer to the USA.

Withdrawal and opt-out: you can withdraw your consent at any time with effect for the future via the cookie banner (see Section 4). In addition, Google provides a browser add-on to deactivate Google Analytics at https://tools.google.com/dlpage/gaoptout. You can find further information in Google’s privacy policy at https://policies.google.com/privacy.

5.4 Fonts (web fonts)

This website uses only fonts stored locally on our server. When the pages are accessed, no connection to third-party servers (in particular not to Google Fonts) is established in order to load the fonts; personal data such as your IP address is not transmitted to third parties for this purpose.

6. Order processing in the online shop (WooCommerce)

Our shop runs on the WooCommerce software on a WordPress installation. When you place an order, we process the data required to fulfil the purchase contract with you.

Categories of data processed:

  • order and contract data (products ordered, quantity, price, order and invoice number),
  • master data: first and last name, billing and delivery address,
  • contact data: email address and, where applicable, phone number,
  • payment data (in the case of advance payment/bank transfer, in particular the payment reference and receipt of payment; see Section 7),
  • further voluntary details that you provide during the ordering process (e.g. notes regarding delivery).

Purpose: processing your order, delivery of the goods, invoicing, handling of enquiries and processing of any withdrawal or warranty claim.
Legal basis: Article 6(1)(b) GDPR (performance of the purchase contract or pre-contractual measures). Where statutory retention obligations exist, additionally Article 6(1)(c) GDPR.
Recipients: your data is passed on to the parties required for the performance of the contract, in particular to the credit institution for payment processing, to the shipping service provider (see Section 8), and to our tax adviser and – within the framework of data processing – to our hosting service provider.

Retention period: we store the order data for the duration of the performance of the contract. After that, certain data (in particular invoices and accounting records) is subject to statutory retention periods: under Section 147 AO and Section 257 HGB, retention periods generally apply of up to 10 years (invoices, accounting records) or 6 years (other commercial correspondence). During this time, processing is restricted; the data is deleted once the periods have expired.

7. Payment processing (advance payment / bank transfer)

We currently offer payment by advance payment / bank transfer (BACS). After your order, you will receive our bank details; you transfer the invoice amount yourself from your account.

Data processed: name of the payer, amount, payment reference (order/invoice number) and the account details shown on receipt of payment (e.g. IBAN of the sending account).
Purpose: allocation and posting of your payment.
Legal basis: Article 6(1)(b) GDPR (performance of the contract) and Article 6(1)(c) GDPR (tax and commercial law obligations).
Recipients: the credit institution holding the account and our tax adviser.
Retention period: within the statutory retention periods (Section 147 AO, Section 257 HGB), see Section 6.

Card payment (e.g. via Stripe) is not currently active. As soon as we offer further payment methods, we will update this privacy policy accordingly.

8. Shipping

To deliver your order, we pass on the necessary address and, where applicable, contact data (name, delivery address, and where necessary email address or phone number for delivery notification) to the appointed shipping service provider.

Shipping service provider: [PLEASE ADD: name of the specific shipping service provider, e.g. DHL / GLS] – this provider processes the data on its own responsibility for delivery purposes.
Purpose: delivery of the ordered goods and, where applicable, shipment tracking.
Legal basis: Article 6(1)(b) GDPR (performance of the contract). Insofar as your email address or phone number is transmitted to the provider for delivery notification, we base this on Article 6(1)(a) GDPR (consent), provided you gave this during the ordering process.
Retention period: for the duration of the delivery; beyond that, the statutory retention periods apply to the associated records.

9. Contacting us by email

If you contact us by email (hallo@auroolivenoel.com), we process the data you provide (in particular your email address, name and the content of your message) in order to handle your request.

Legal basis: Article 6(1)(b) GDPR where your enquiry relates to a contract or its initiation; otherwise Article 6(1)(f) GDPR (legitimate interest in responding to enquiries).
Retention period: we store the correspondence until your request has been conclusively dealt with and no statutory retention periods stand in the way. The data is then deleted.

10. Newsletter and waitlist (pre-order)

For the pre-order of our product (pre-order, 2026 harvest) and for general news, you can sign up to a waitlist or a newsletter. Mailings are only sent with your express consent.

For this purpose we use the double opt-in procedure: after you sign up, you receive an email asking you to confirm your registration by clicking a confirmation link. Only then do we add you to the distribution list. For evidentiary purposes, we log the registration, the confirmation and the time.

Data processed: email address, name where applicable, and the time of registration and confirmation and the IP address used to register.
Purpose: sending information about the pre-order, product availability and offers.
Legal basis: Article 6(1)(a) GDPR (consent).
Withdrawal: you can withdraw your consent at any time with effect for the future by clicking the unsubscribe link at the end of each email or by sending us a short message to hallo@auroolivenoel.com. After unsubscribing, your data is deleted from the distribution list, provided no statutory retention obligations or evidentiary interests stand in the way.
Service provider: [PLEASE ADD: name of the newsletter/email service provider and, where applicable, data processing agreement, e.g. built-in WooCommerce/WordPress mailing or an external provider].

11. Recipients and data processing

Your data is only transferred to third parties within the legally permitted framework. Service providers that process data on our behalf (e.g. hosting and, where applicable, email/newsletter mailings) are contractually bound pursuant to Article 28 GDPR and process data exclusively in accordance with our instructions. A transfer to third countries outside the EU/EEA takes place only under the conditions of Articles 44 et seq. GDPR (see in particular Section 5.3).

12. Your rights as a data subject

You have the following rights with regard to the personal data concerning you:

  • Access (Article 15 GDPR): you can request information about whether and which data we process about you.
  • Rectification (Article 16 GDPR): you can request the correction of inaccurate data or the completion of incomplete data.
  • Erasure (Article 17 GDPR): you can request the erasure of your data, provided no statutory retention obligations or other exceptions stand in the way.
  • Restriction of processing (Article 18 GDPR): under certain conditions you can request the restriction of processing.
  • Data portability (Article 20 GDPR): you can request to receive the data you have provided in a structured, commonly used and machine-readable format, or to have it transferred to another controller.
  • Objection (Article 21 GDPR): you can object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR.
  • Withdrawal of consent (Article 7(3) GDPR): you can withdraw consent you have given at any time with effect for the future. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

To exercise your rights, an informal message to hallo@auroolivenoel.com is sufficient.

13. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right under Article 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

As our company is based in Spain, the competent supervisory authority is the Spanish data protection authority Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es. As a consumer resident in Germany, you may also contact the German state data protection authority responsible for your place of residence.

14. Obligation to provide data

To conclude a purchase contract, the provision of certain data (in particular name, delivery and billing address, email address) is required. Without this information, we cannot process your order and cannot enter into a contract with you. The provision of further data (e.g. phone number, newsletter sign-up) is voluntary.

15. Automated decision-making

Automated decision-making, including profiling, within the meaning of Article 22 GDPR does not take place.

16. Currency and amendment of this privacy policy

This privacy policy is currently valid and has the status stated above. As our website and our offering develop, or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. You can access the current version at any time on this page.