Privacy Policy

§ 1 · Who is responsible (controller)

Jon Gore
Doc Bankman Apothecary
Alt-Stralau 32F
10245 Berlin, Germany
Email: jon@docbankman.com
VAT ID: DE460475453

Doc Bankman Apothecary is a one-person business. We are not required to appoint a data protection officer and have not appointed one. Write to the address above about anything in this policy.

§ 2 · What this covers

This website, docbankman.com, and the pre-orders placed through it. The checkout itself runs on Shopify's own pages at shop.docbankman.com. Shopify runs that step for us under a contract, and this policy applies to it. Sites we link to have their own policies and are not covered here.

§ 3 · When you visit the website

Our hosting provider, Vercel Inc. (United States), acting as our processor, records the usual server data on every page load: your IP address, the date and time, the page you asked for, the page you came from, and your browser and operating system. We use it to serve the site, keep it secure, and find faults. Server logs are kept for a short period, no longer than thirty days, and then deleted. Legal basis: our legitimate interest in a working, secure website (Art. 6(1)(f) GDPR).

Your cart is stored in your browser's local storage so that what you put in it is still there when you come back. That storage is needed for something you asked for, so it does not require consent (§25(2) TDDDG).

§ 4 · When you join the waitlist or sign up for emails

We collect:

• your email address;
• the campaign parameters on the link that brought you here - utm_source, utm_medium, utm_campaign, utm_content, utm_term, and the Google and Meta click identifiers gclid and fbclid - so we know which ad or post a signup came from;
• your answer to the optional one-question survey ("Where did you hear about us?"), if you choose to answer it.

We use this to send you email about the launch, the product, and the batch. Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by submitting the form and then confirming through the double opt-in email we send. Until you confirm, we send nothing else. You can withdraw your consent at any time through the unsubscribe link in any email, or by writing to jon@docbankman.com. Withdrawing does not make what we sent before unlawful.

Those campaign parameters are also stored in your browser before you sign up, with your consent. See section 7.

§ 5 · When you place a pre-order

An order is a contract, and what follows is what we need to perform it. Shopify collects it at checkout on our behalf:

• your name;
• your email address;
• your billing address and your delivery address;
• your phone number, if you give one;
• what you ordered, the price, the order number, the date, and the currency;
• which payment method you used and whether the payment went through;
• anything you write in an order note.

We use it to take your pre-order, charge you, keep you informed while your bottle is being made, dispatch it, handle returns and withdrawals, and answer your questions. Legal basis: performance of a contract with you (Art. 6(1)(b) GDPR). For invoices and bookkeeping we are also under a legal obligation (Art. 6(1)(c) GDPR, with §147 AO and §257 HGB).

A pre-order is paid now and dispatched later. Order email - a confirmation when you order, updates while you wait, and a note when your bottle ships - reaches you through our shop system (Shopify) and our email system (Klaviyo). These are part of the contract rather than marketing, and you get them whether or not you are on our mailing list. You cannot unsubscribe from them while your order is open, because they are how we keep you informed about it.

We ship within Germany. Your name and delivery address go to the carrier so it can deliver: DHL. The carrier decides for itself how it handles that data for the delivery it performs.

§ 6 · Paying

Payment is taken on Shopify's checkout pages, not on ours. You enter your payment details there and they go to the payment provider you choose. We never see and never store your full card number. What reaches us is the payment method, whatever reference or last digits the provider shows us, and confirmation that the payment succeeded.

Payments run through Shopify Payments, Shopify's own payment service, with Shop Pay, Apple Pay and Google Pay available as wallet layers on top of it, and Klarna (Klarna Bank AB (publ), Sweden) as a further payment option at checkout. Each provider decides for itself how it processes the payment, and its own privacy policy applies to that step. If we add a payment method, this list is updated.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR), and our legitimate interest in preventing fraud and non-payment (Art. 6(1)(f) GDPR).

§ 7 · Analytics and advertising

With your consent we use three tools that store data on your device or read it from there:

• Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It counts visits and shows which pages get used, across both docbankman.com and our shop domain.
• The Meta Pixel, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It measures whether our ads work and builds advertising audiences. For the collection of this data and its transmission to Meta, we and Meta are joint controllers under Art. 26 GDPR; Meta publishes the essential terms of that arrangement in its controller addendum. What Meta then does with the data is Meta's own responsibility.
• Klaviyo's onsite script, provided by Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. If you are on our mailing list, it links what you look at here to your profile.

We also store the campaign parameters from the link that brought you here in your browser's local storage, so that a signup or an order later in the same visit can be matched to the ad or post it came from.

Legal basis for storing and reading data on your device: your consent (§25(1) TDDDG). Legal basis for what we do with it afterwards: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time through the Cookie settings link in the footer; withdrawing is exactly as easy as consenting was. Withdrawal takes effect from then on.

You can also turn off personalised advertising directly in your Meta ad preferences or at youronlinechoices.eu.

§ 8 · Who we share data with

• Shopify International Limited (Ireland) - the shop, the checkout, order records, and fraud analysis. Acts on our instructions under Shopify's data processing addendum.
• Klaviyo, Inc. (USA) - the mailing list, the order confirmations, and the pre-order updates. Acts on our instructions. Order and customer data reaches Klaviyo through its Shopify integration.
• Vercel Inc. (USA) - serving this website. Acts on our instructions.
• The payment providers in section 6 - each decides for itself.
• The carrier in section 5 - decides for itself, for the delivery.
• Google Ireland Limited and Meta Platforms Ireland Limited - only as described in section 7.
• The tax authorities, where the law requires it.

We do not sell your data and we do not pass it to anyone else for their own marketing.

§ 9 · Data outside the EU

Klaviyo and Vercel are in the United States. Shopify may process data outside the EU, including in Canada and the United States. Where that happens, it is covered by one of: an adequacy decision of the European Commission, the EU-U.S. Data Privacy Framework where the recipient is certified under it (Klaviyo is), or the European Commission's standard contractual clauses. Ask us at jon@docbankman.com and we will send you a copy of the safeguards that apply.

§ 10 · How long we keep things

• Mailing list: until you unsubscribe or ask to be deleted. After that we keep your email address on a suppression list so we cannot accidentally mail you again, which is the only way to honour your objection.
• Orders and invoices: as long as German tax and commercial law requires - up to ten years, each period running from the end of the calendar year in which the record was made.
• Order correspondence: three years from the end of the year the order was placed, matching the ordinary limitation period for claims (§§195, 199 BGB), unless something is still unresolved.
• Analytics: Google Analytics data for up to fourteen months. Meta sets its own periods.
• Server logs: no longer than thirty days.
• Cart data in your browser: expires on its own after about ten days of inactivity. You can clear it yourself at any time.

§ 11 · Your rights

Under the GDPR you can:

• ask what we hold about you and get a copy (Art. 15);
• have anything wrong corrected (Art. 16);
• have your data deleted (Art. 17), except where tax or commercial law makes us keep it;
• have processing restricted (Art. 18);
• get the data you gave us in a machine-readable form, or have it sent on (Art. 20);
• withdraw any consent you gave, at any time, with effect from then on (Art. 7(3));
• object to anything we do on the basis of our legitimate interests (Art. 21 - see the next section);
• complain to a supervisory authority (Art. 77).

There is no charge, and we answer within one month.

§ 12 · Your right to object

This section is set apart because the law requires it to be (Art. 21(4) GDPR).

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. If your data is being used for direct marketing, you can object at any time without giving any reason, and we will stop using it for that. Write to jon@docbankman.com.

§ 13 · Complaints

You can complain to any data protection supervisory authority. Ours is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin, Germany

§ 14 · Do you have to give us this data

No. But without an email address we cannot put you on the list, and without a name and a delivery address we cannot conclude or perform a sale. Everything else is optional, and the survey question says so.

§ 15 · Automated decisions

We do not make decisions about you by automated means alone. Shopify's checkout produces a fraud-risk indication on orders; a person looks at anything flagged before we act on it.

§ 16 · Changes

We update this policy when what we do changes. The version in force is the one on this page.

§ 17 · Contact

Email jon@docbankman.com about anything here, including to exercise any of the rights in section 11.