This is a translation for your convenience. Only the German version is legally binding.
Version: 23 October 2026
This privacy policy explains how personal data is processed when you visit fruitwarrior.eu, use our online shop, contact us and place an order. Personal data is any information relating to an identified or identifiable person.
1. Controller and data protection contact
The controller responsible for processing your personal data on this website is:
FUWA BIOTECH Europe GmbH
Augustinerplatz 2
79098 Freiburg
Germany
Email: privacy@fuwa-europe.com
Phone: +49 163 4003755
We are not legally obliged to appoint a data protection officer. For all questions about data protection and the exercise of your rights, you can reach us at the email address or postal address given above.
2. Hosting, delivery of the website and server logs
The website is hosted by Hostinger International Limited, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Hostinger processes the data arising on the website on our behalf. Delivery may take place through the infrastructure used by Hostinger and its sub-processors, including content delivery and security services.
Each time a page is accessed, technically necessary connection data is processed. This may include the IP address, date and time, the address accessed, the amount of data transferred, the referrer, browser type, operating system and status and error information. The processing is necessary to deliver the website, to ensure its stability and security, to fend off attacks and to investigate technical errors.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests lie in the secure, stable and efficient operation of the shop. The access logs are created on our host’s infrastructure and are automatically overwritten there on a rotating basis; we do not make our own copies. We only analyse them when there is a specific reason, i.e. to investigate a specific technical error or security incident. Only in that case do we secure the entries concerned, and we delete them as soon as the investigation is complete and no obligations to provide evidence stand in the way.
We have a data processing agreement with Hostinger. Where Hostinger uses sub-processors outside the European Economic Area, the agreement provides in particular for EU standard contractual clauses.
3. Technically necessary functions and local storage
For the cart, checkout, login, security, storing your privacy choices, remembering the language you chose with the language switcher and remembering a closed notice bar, we use technically necessary cookies. They enable the shop and account functions you request and are not used for advertising. The legal basis for storing or reading information on your device is Section 25(2) No. 2 TDDDG. The subsequent processing of personal data takes place, depending on the function, on the basis of Art. 6(1)(b), (c) or (f) GDPR.
Your privacy choices, your chosen language, a closed notice bar and any objection to local audience measurement are stored for up to one year. If you close the notice bar at the top of the page, we only store an identifier of the notices you closed, so that the bar only appears again once there are new notices. We only store the language once you use the language switcher; only the language code is stored. Without this choice, the language of the home page follows the language setting of your browser, which your browser sends with every request anyway; we do not store it. All other necessary cookies are valid, depending on the function, for the session or a short, function-related period; you can view the specific durations at any time via “Cookie settings” in the footer.
These functions cannot be switched off through the consent request, because otherwise the service requested could not be provided. You can delete cookies in your browser; your cart, login and saved choices may be lost as a result. You can view the specific technical storage items and durations at any time via “Cookie settings” in the footer.
4. Managing and documenting your privacy choices
We provide the choices through a consent management system that we operate ourselves. All optional categories are switched off initially. You can consent to or reject the optional statistics and change your decision at any time via “Cookie settings” in the footer.
To implement your choice and to provide the legally required proof, we store your choice, the time, the version applicable at that time and a random identifier. No further information is recorded. The entries are deleted after twelve months at the latest.
The legal bases are Art. 6(1)(c) GDPR in conjunction with our obligation to provide proof under Art. 7(1) GDPR, and Art. 6(1)(f) GDPR. Our legitimate interest lies in reliably implementing, documenting and defending your choice. The necessary choice cookie is based on Section 25(2) No. 2 TDDDG.
5. Shop, customer account, orders and delivery
We run our shop on our own self-hosted systems. When you create a customer account, go through checkout and place an order, we process the information required for the respective process. This includes in particular name, company name where applicable, billing and delivery address, email address, telephone number where applicable, account data, cart, products ordered, prices, tax and shipping data, payment method, order status, communication and technical transaction data. You can order as a guest; a customer account is not required.
The processing serves to prepare and perform the purchase contract, delivery, payment processing, handling of queries, returns, warranty and customer service. The legal basis is Art. 6(1)(b) GDPR. We also process data required under tax and commercial law on the basis of Art. 6(1)(c) GDPR. We base measures against fraud and misuse and to assert or defend claims on Art. 6(1)(f) GDPR.
Depending on your order, the necessary recipients are in particular shipping and logistics service providers, payment service providers, tax advisers, banks and authorities, where there is a legal obligation. Only the data required for the specific purpose is transferred in each case.
For shipping, we work with DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. We transfer the data required for delivery, in particular name, delivery address and shipment data. The legal basis is Art. 6(1)(b) GDPR.
Order and invoice data that constitute accounting records are generally retained for eight years from the end of the calendar year in which they were created. Commercial and business letters may be subject to statutory six-year periods. Data that is required solely for processing the contract is deleted or anonymised as soon as the contract, warranty and statutory limitation periods have expired and no statutory or demonstrable reasons stand in the way.
You can have your customer account deleted at any time. An informal message to privacy@fuwa-europe.com or through our contact form is sufficient. When we delete it, we remove your login data, your profile and the stored delivery and billing addresses.
We cannot completely delete orders that have already been completed, insofar as they are subject to the commercial and tax retention periods mentioned above. This data is blocked for the duration of the periods, i.e. kept solely to fulfil the retention obligation and no longer used for other purposes. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 17(3)(b) GDPR. Once the periods have expired, the data is deleted.
When you use our electronic withdrawal function, we process your name, email address, information about the affected order and, where applicable, individual items, your withdrawal declaration, language, time of receipt and confirmation delivery status. We store the declaration, acknowledge its receipt by email and use it to process the withdrawal. The legal bases are Art. 6(1)(b) and (c) GDPR in conjunction with Section 356a BGB. We generally retain declarations and acknowledgements as business correspondence for six years from the end of the year of receipt (Section 257 HGB); they are then deleted unless a longer statutory obligation applies. A declaration is linked to an order only where the details match. The function does not trigger an automatic refund.
6. Payment methods: PayPal and Stripe
You can see which payment methods are offered at checkout. For payment without an external online payment service, we process the order and payment status data ourselves on the bases mentioned in section 5.
If you choose a PayPal payment method, we transfer the data required to process the payment to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. This may include name, contact and billing data, amount, currency, order reference, device and connection data and payment status. The legal basis is Art. 6(1)(b) GDPR; statutory verification and retention obligations may additionally be based on Art. 6(1)(c) GDPR. PayPal processes this data as an independent controller and may use affiliated companies and service providers outside the EEA; for this PayPal refers, among other things, to adequacy decisions and EU standard contractual clauses. Further information can be found in the PayPal privacy statement.
We process payments by credit card, Apple Pay and Google Pay through Stripe. The Stripe companies in Ireland are responsible, in particular Stripe Technology Europe, Limited for the payment services and Stripe Technology Company Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. For this we transfer in particular name, email address, billing and delivery address, telephone number where applicable, amount, currency and order number. You enter your card details directly into an input field provided by Stripe; they do not reach our servers. The legal basis is Art. 6(1)(b) GDPR. For fraud prevention Stripe additionally processes device and connection data and sets technically necessary cookies for this on the checkout page only; the legal basis for storing or reading information on your device is Section 25(2) No. 2 TDDDG, and for the subsequent processing our legitimate interest in secure payments (Art. 6(1)(f) GDPR). Stripe processes this data as an independent controller and may also transfer it to third countries, in particular the USA; Stripe relies on the EU-U.S. Data Privacy Framework and EU standard contractual clauses for this. Further information can be found in the Stripe privacy policy.
With Apple Pay and Google Pay you confirm the payment in your wallet. Apple or Google process data in accordance with their own privacy policies.
7. Contact form and communication
If you write to us through the contact form or by email, we process the data you provide. In the contact form, this is name, email address, type of enquiry, order number where applicable, message, time of sending and technically necessary delivery and security data. The information is sent to our mailbox by email.
For enquiries relating to an order or contract, the legal basis is Art. 6(1)(b) GDPR. We handle general enquiries on the basis of Art. 6(1)(f) GDPR; our legitimate interest lies in answering enquiries and handling them in a traceable way. Where there is a statutory documentation obligation, Art. 6(1)(c) GDPR applies in addition.
We delete contact enquiries once they have been dealt with and there are no longer any contractual, evidential or retention reasons. Communication relating to a contract may be subject to the periods mentioned in section 5.
We run our business email communication through Microsoft 365. The provider for customers in the European Economic Area is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes message content, sender and recipient details and technical delivery and security data on our behalf. This is based on a data processing agreement that provides for EU standard contractual clauses for transfers to third countries.
8. Local audience measurement
We measure the use of the shop on our own system in order to improve content, navigation and technical processes. The page accessed, the source of the visit, time and length of stay, rough information about browser, operating system and device and whether individual controls were used are processed. The data does not leave our system and is not transferred to third parties.
No cookie is set and no information is stored on or read from your device. IP address and browser identifier are not stored. You are not recognised across several days.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in data-minimising audience analysis run locally. The data is stored for a maximum of twelve months.
You can object to this measurement at any time without giving reasons via “Turn off local audience measurement” in the footer. So that the objection can be respected, a technically necessary cookie is stored for this purpose.
9. Google Analytics 4 with consent
Only if you consent to the “Statistics” category do we load Google Analytics 4. The provider for users in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before your consent, the Google tag is not loaded and no request is sent to Google Analytics. We thus use basic consent mode; the states for advertising, advertising user data and ad personalisation remain deactivated regardless of your statistics consent.
Google Analytics processes pseudonymous online identifiers, page and event data, approximate location information, browser, device and referrer information and e-commerce events. These may include product views, cart changes, checkout steps, time of purchase, order reference, currency, revenue, tax, shipping and item identifiers. Your contact details and the rest of the content of your order are not transferred.
After your consent, Google Analytics uses cookies to distinguish users and sessions. Google states a default duration of up to two years for these; browsers may shorten it. Google uses IP addresses during collection to derive rough location data and states that it discards IP addresses of users from the EU, Switzerland and the United Kingdom before logging. You can view the specific storage items in the “Cookie settings”.
The legal bases are your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via “Cookie settings”. Rejecting has no effect on the shop, cart or order.
The data is used exclusively for statistical purposes, not for advertising. Retention of detailed event and user data is set to 14 months; aggregated reports may remain available beyond that.
Recipients may be Google Ireland Limited, Google LLC and other Google companies or processors. Processing in the USA and other third countries is possible. For transfers, Google refers in particular to adequacy decisions including the EU-US Data Privacy Framework and to EU standard contractual clauses. Further information can be found in Google’s privacy policy.
10. Links to Instagram and YouTube
No videos or social network posts are embedded on our website. In the footer we link to our profiles on Instagram and YouTube. As long as you do not click these links, no connection to the providers is established. Only with the click do you move to their pages; there, Instagram’s privacy policy (Meta Platforms Ireland Limited) or Google’s privacy policy (Google Ireland Limited) applies.
11. Advertising by email and product reviews
At checkout you can voluntarily tick that you would like to receive offers, news and review requests about your purchases by email. The box is not preselected; your order does not depend on your decision. If you agree, we store your email address, the time, the order in which you agreed, the language and the version of the consent text.
We use your address to send you information about our products and offers and to ask you once, about 14 days after an order has been shipped, whether you would like to review the products you bought. The legal basis is your consent under Art. 6(1)(a) GDPR. We send these emails through Microsoft 365, the service named in section 7.
You can withdraw your consent at any time with effect for the future, through the unsubscribe link in each of these emails or by a message to privacy@fuwa-europe.com. After that you will no longer receive advertising or review requests from us; you will still receive emails about your orders. So that we can prove consent and withdrawal (Art. 7(1) GDPR), we keep the information named above for three years after the withdrawal and then delete it. The legal basis for this is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.
If you review a product through the link in the email, we store your star rating, your text, the time, the related order, your email address and, unless you choose anonymous publication, your name. After a check we publish the review on the product page with your first name, the first letter of your last name, the date and the note “Verified purchase”. If you choose anonymous publication, we store and show “Anonymous” instead of your name. Your email address is not published. The legal basis is your consent, which you give by submitting the review (Art. 6(1)(a) GDPR). You can request the deletion of your review at any time by a message to privacy@fuwa-europe.com.
12. Recipients and transfers to third countries
Within our business, only people who need the data for the purposes mentioned have access. The only external recipients are the processors, independent controllers and necessary professional or fulfilment service providers named in this policy.
For a transfer outside the EEA, we check whether an adequacy decision exists or whether appropriate safeguards, in particular EU standard contractual clauses and, where necessary, supplementary measures, are in place. Consent to the statistics does not replace these transfer safeguards. Despite such safeguards, recipients in third countries may be exposed to a risk of government access that differs from the EU level.
We will provide you with a copy of the EU standard contractual clauses and supplementary safeguards we use on request. An informal message to privacy@fuwa-europe.com or to the postal address given in section 1 is sufficient. You can also view the wording of the EU standard contractual clauses at any time in the Official Journal of the European Union.
13. Your rights
Subject to the statutory requirements, you have the right of access to your personal data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent you have given at any time with effect for the future (Art. 7(3)). The lawfulness of processing carried out until withdrawal remains unaffected.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg)
Lautenschlagerstraße 20
70173 Stuttgart
Phone: +49 711 6155410
Email: poststelle@lfdi.bwl.de
To exercise your rights, a message to privacy@fuwa-europe.com or to the address given in section 1 is sufficient. If there are reasonable doubts about your identity, we may request additional information. With pseudonymous statistical data, it may be technically impossible to link the data to you; Art. 11 GDPR remains unaffected.
14. Special right to object
You can object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. We will then no longer process the data concerned unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can also object to the local audience measurement under section 8 directly via the switch in the footer, without giving reasons.
15. Obligation to provide data and automated decisions
You do not have to actively provide any information simply to visit the site. Technical connection data is, however, generated automatically. The order details marked as mandatory fields are required for the contract; without them we cannot complete the order. The optional statistics and the consent to advertising and review requests by email are voluntary. We do not make decisions based solely on automated processing with legal or similarly significant effects within the meaning of Art. 22 GDPR.
16. Security and changes to this policy
We use appropriate technical and organisational measures to protect your data. No transmission over the internet is completely free of risk.
We adapt this policy when the legal situation, services or data flows change. If optional services change significantly, we will ask for the choice concerned again. The version published on this page applies.