Skip to content
0 Buy now

Privacy Policy

This is a translation of our German privacy policy (Datenschutzerklärung), provided for your convenience. In case of any discrepancy, the German version prevails.

Last updated: October 2026

1. Controller

ORGMAG Holding OÜ, Uus-Sadama tn 25, 10111 Tallinn, Estonia
E-mail: info@organicmagnesium.de

We have not appointed a data protection officer, as we are not obliged to do so. If you have any questions about data protection, please contact the e-mail address above.

2. Overview

We only process personal data insofar as this is necessary for operating this website, processing your order or answering your enquiries, we are legally obliged to do so, or you have given your consent. The legal bases are in particular Art. 6(1)(a) GDPR (consent), (b) (contract), (c) (legal obligation) and (f) (legitimate interest).

3. Hosting and server log files

This website is hosted by Zone Media OÜ, Estonia. When you visit the website, access data is processed automatically (IP address, date and time, page visited, browser and operating system, referrer). This is necessary for providing the website securely and reliably (Art. 6(1)(f) GDPR). The log files are deleted after 14 days at the latest unless they are needed to investigate a security incident. We have a data processing agreement with the host.

4. Cloudflare (delivery, security, spam protection)

We use services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to deliver the website quickly and securely and to protect it against attacks. All data traffic is routed through Cloudflare servers, including your IP address and technical connection data. At checkout we also use Cloudflare Turnstile to prevent automated orders and spam. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a secure and functional website. Cloudflare is certified under the EU-US Data Privacy Framework. More information: cloudflare.com/privacypolicy.

5. Orders and customer account

When you place an order, we process your order data (name, billing and delivery address, e-mail address, telephone number if provided, products ordered, payment status) to perform the purchase contract (Art. 6(1)(b) GDPR). If you create a customer account, we also store this data in your account until you delete it. Due to retention obligations under commercial and tax law, we store order data for up to 10 years (Art. 6(1)(c) GDPR).

For delivery, we pass on your name, your delivery address and, where applicable, your e-mail address to the logistics and shipping service provider we use. Shipping is currently handled by Amazon EU S.à r.l., 38 Avenue John F. Kennedy, L-1855 Luxembourg (Fulfilment by Amazon), and its parcel carriers.

To understand through which channels orders come about, our shop system (WooCommerce) stores the source of your visit (e.g. search engine or direct visit) in cookies with the prefix sbjs_ and transmits this information together with the order. This data does not leave our website.

6. Payment processing (Stripe, Klarna, PayPal)

If you pay by credit or debit card, Apple Pay, Google Pay, Klarna, iDEAL, Bancontact, EPS, SEPA direct debit, Przelewy24 or Link, the payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). You enter your payment details (e.g. card number) directly into an input field provided by Stripe; they are not stored on our server. We transmit the order amount, the order number and your name, e-mail address and billing address to Stripe (Art. 6(1)(b) GDPR). To prevent fraud, Stripe also processes technical data such as your IP address and device information and sets cookies on the checkout page for this purpose (Art. 6(1)(f) GDPR; our legitimate interest lies in secure payments). Stripe may also transfer data to Stripe, Inc. in the USA; Stripe is certified under the EU-US Data Privacy Framework. More information: Stripe privacy policy.

If you choose Klarna, you will be redirected to Klarna and your order and contact details will be transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (Art. 6(1)(b) GDPR). Klarna is independently responsible for processing the payment and may carry out an identity and credit check. More information: Klarna privacy notice.

If you pay with PayPal, you will be redirected to PayPal. For this purpose we transmit the order amount, the order number and your name and address to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (Art. 6(1)(b) GDPR). PayPal is independently responsible for processing the payment and may carry out an identity and credit check. More information: PayPal privacy statement.

7. Contact by e-mail or contact form

If you write to us by e-mail or via the contact form, we process your details (name, e-mail address, message) in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR). The data is deleted once the enquiry has been dealt with and there are no retention obligations.

To protect the contact form against spam, we use Google reCAPTCHA from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA evaluates behavioural data and device information to distinguish humans from bots; in the process your IP address may be transmitted to Google, including to the USA. The legal basis is Art. 6(1)(f) GDPR. Google is certified under the EU-US Data Privacy Framework. More information: Google privacy policy.

8. Newsletter

If you subscribe to our newsletter, we use your e-mail address to send you information about our products and offers (Art. 6(1)(a) GDPR). Registration takes place using the double opt-in procedure: you receive an e-mail in which you confirm your registration. For sending, we use Mailchimp from The Rocket Science Group LLC (Intuit), 405 N Angier Ave. NE, Atlanta, GA 30308, USA, which is certified under the EU-US Data Privacy Framework. You can unsubscribe from the newsletter at any time via the unsubscribe link in every e-mail or by sending us a message.

9. Cookies and cookie notice

We only use cookies that are necessary for operating the shop (e.g. basket, session, your cookie choice) and the source cookies described in section 5. On the checkout page, Stripe also sets cookies to prevent fraud (see section 6). The legal basis is Section 25(2) of the German TDDDG in conjunction with Art. 6(1)(b) and (f) GDPR. Your cookie choice is stored for 30 days. You can delete or block cookies at any time in your browser settings; the basket may then not work.

10. Audience measurement with Ahrefs Web Analytics

We use Ahrefs Web Analytics from Ahrefs Pte. Ltd., 16 Raffles Quay, #33-03 Hong Leong Building, Singapore 048581, to create anonymous visitor statistics (e.g. pages viewed, country of origin, device type). According to the provider, Ahrefs Web Analytics does not set cookies and does not store IP addresses or any other data that could identify you. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in improving our offering.

11. Fonts

To display fonts we use Bunny Fonts from BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia. When the fonts are loaded, your IP address is transmitted to servers in the EU; no cookies are set and no data is stored for tracking purposes (Art. 6(1)(f) GDPR).

12. Website security

To protect against attacks, we use the security plugin Wordfence from Defiant Inc., USA. Visitors’ IP addresses are checked and, in the case of suspicious access, stored and, where necessary, compared with Defiant to fend off attacks (Art. 6(1)(f) GDPR).

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw consent at any time with effect for the future (Art. 7(3)). An informal message to info@organicmagnesium.de is sufficient.

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can object to the use of your data for advertising at any time without giving reasons.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority where you live or the Estonian supervisory authority responsible for us: Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, www.aki.ee.

14. Storage period

We delete personal data as soon as the purpose of storage no longer applies and no statutory retention periods prevent this.