Privacy policy

Privacy policy

Last updated: 01.09.2026

A. LEGAL FOUNDATION

1. Controller

The controller responsible for the processing of personal data in connection with the commercial activities described in this Privacy Policy is:

Green Cloud Nine e.U.
Registry No: FN552852 in Innsbruck (Austria)

AT- 6200 Jenbach
Telephone: +43 690 10348424
E-mail: support@greencloudnine.com
www.greencloudnine.com 

Green Cloud Nine e.U. operates the online store available through:

https://www.greencloudnine.com

This Privacy Policy applies specifically to the commercial activities of Green Cloud Nine e.U. conducted through the website, in particular the online sale of Kind Rituals cosmetics.

Other activities of Green Cloud Nine e.U., are not covered by this Privacy Policy. 

2. What personal data we process

Depending on how you use our website and whether you place an order, subscribe to our newsletter or consent to optional cookies and marketing technologies, we may process the following categories of personal data:

Information you provide to us

  • first and last name;
  • billing and delivery address;
  • e-mail address;
  • telephone number;
  • order and transaction information;
  • products purchased;
  • information you provide when contacting us;
  • information you provide when submitting a product review;
  • newsletter subscription information and communication preferences.

Information generated when you use our website

Depending on your consent and the applicable legal requirements, this may include:

  • IP address;
  • browser and operating-system information;
  • device information;
  • approximate location information;
  • pages visited and interactions with the website;
  • information concerning your use of our website and online store;
  • cookie identifiers and similar technical identifiers.

We only process optional analytics, personalisation and marketing data where the applicable legal requirements for doing so have been met, including obtaining consent where required. 

3. Purposes and legal bases for processing

We process personal data only where permitted by applicable data protection law. Depending on the circumstances, the legal basis for processing is:

Purpose               Main legal basis

3.1 Operation of the website and online store: Art. 6(1)(b) GDPR where necessary to provide requested services; Art. 6(1)(f) GDPR where based on legitimate interests

3.2 Processing and fulfilment of orders: Art. 6(1)(b) GDPR — performance of contract

3.3 Customer service and communications: Art. 6(1)(b) or 6(1)(f) GDPR, depending on the communication

3.4 Legal obligations, accounting and tax: Art. 6(1)(c) GDPR

3.5 Website security and prevention of misuse: Art. 6(1)(f) GDPR

3.6 Analytics: Art. 6(1)(a) GDPR where consent is required

3.7 Marketing and advertising: Art. 6(1)(a) GDPR where consent is required

3.8 Newsletter and direct marketing: Art. 6(1)(a) GDPR where consent is required, subject to applicable exceptions

3.9 Product reviews: Appropriate legal basis depending on the review functionality and consent/voluntary submission

4. Categories of personal data

Depending on how you interact with our website and online store, we may process the following categories of personal data:

a) Identification and contact data

This may include:

  • first and last name;
  • email address;
  • telephone number;
  • billing and delivery address;
  • other contact details provided to us when you contact us or place an order.

b) Order and transaction data

When you purchase products from our online store, this may include:

  • products ordered;
  • order number;
  • order date and time;
  • quantities and prices;
  • delivery information;
  • billing information;
  • payment status;
  • information necessary to process returns, refunds or withdrawals;
  • other information associated with the contractual relationship.

We do not generally receive or store the full payment-card details used to make a purchase. Payment information is processed through the payment providers described in Section 6.

c) Customer communications

When you contact us by email, telephone or other available communication channels, we may process:

  • your name and contact details;
  • the content of your communication;
  • information relating to your request or enquiry;
  • any other information that you voluntarily provide to us.

d) Review and user-generated content

If you voluntarily submit a product review, we may process:

  • your name or display name;
  • rating;
  • review text;
  • photographs or other content that you choose to submit;
  • information technically associated with the submission where provided by the review service.

e) Technical and device information

When you visit our website, certain technical information may be processed, depending on your consent and the technologies you use. This may include:

  • IP address;
  • browser type and version;
  • operating system;
  • device type;
  • language and regional settings;
  • approximate geographical information derived from technical data;
  • referring website or source;
  • pages visited and interactions with the website;
  • date and time of access;
  • information about downloads, outbound links, video interactions, site searches and other website events.

f) Cookie and online identifier information

Depending on the consent you provide and the technologies enabled on our website, we may process:

  • cookie identifiers;
  • advertising or analytics identifiers;
  • information about your consent and privacy preferences;
  • information about interactions with our website and marketing technologies.

Further information is provided in Section 12, Cookies and similar technologies.

g) Newsletter and marketing data

If you subscribe to our newsletter or otherwise consent to marketing communications, we may process:

  • your email address;
  • your name, where provided;
  • subscription and consent records;
  • information about whether communications have been opened or links have been clicked, where the relevant newsletter service provides such functionality;
  • your communication preferences and unsubscribe status.

h) Affiliate and referral information

When you interact with affiliate links contained in our editorial content, third-party affiliate networks or merchants may process technical and referral information associated with your visit. We do not use affiliate links to obtain or receive our customers' order databases or customer profiles.

Further information is provided in Section 16, Affiliate links and affiliate marketing.

i) Information required for legal and accounting purposes

Where required by law, we may process information contained in invoices, payment records, contractual records and other business documentation, including information necessary to comply with tax, accounting and other statutory obligations.


B. SPECIFIC PROCESSING ACTIVITIES/PROVIDERS

5. Shopify

Our online store is operated using Shopify, a commerce platform provided by Shopify.

Shopify processes personal data in connection with the operation of our online store, including information relating to customers, orders, checkout, payments, website activity and the technical operation and security of the store.

Shopify may process personal data as our processor where it acts on our instructions, while Shopify may also process certain data as an independent controller for purposes described in its own privacy documentation. Shopify's current documentation expressly distinguishes these roles.

For further information, please refer to:

Shopify Privacy Policy and Shopify Data Processing Addendum. 

6. Payment processing

Payments in our online store are processed using payment services made available through Shopify and third-party payment providers.

Depending on the payment method selected, these may include:

Payment Providers

  • Shopify Payments / Shop Pay: Operated by Shopify Inc.
  • PayPal: Operated by PayPal Holdings, Inc.
  • Klarna: Registered as Klarna Bank AB
  • MobilePay: operated by Vipps MobilePay AS.
  • Apple Pay: Operated by Apple Inc.
  • Google Pay: Operated by Google LLC.

Regional Payment Schemes & Standards

  • Bancontact: Managed by Bancontact Payconiq Company NV/SA.
  • iDEAL: Managed by EPI Company
  • EPS (Electronic Payment Standard): Operated by STUZZA (Studiengesellschaft für Zusammenarbeit im Zahlungsverkehr GmbH) alongside PSA Payment Services Austria GmbH

Payment information is processed by the relevant payment service provider for the purpose of authorising, processing and securing the payment and, where applicable, preventing fraud.

We do not need to receive or store your complete payment-card details ourselves where payment processing is performed directly by the relevant payment provider.

The applicable payment provider may process additional personal data according to its own privacy policy. 

7. Order fulfilment — SIA “Cosmetics NORD” / Selfnamed

Kind Rituals cosmetic products sold through our online store are fulfilled using Selfnamed, operated by:

SIA “Cosmetics NORD”
Registration number: 40103277805
Address: Lielmani, Mārupe parish, Mārupe municipality, Latvia

For the purpose of fulfilling your order, relevant customer and order information is transmitted to SIA “Cosmetics NORD”. This may include:

  • name;
  • e-mail address;
  • telephone number;
  • billing and/or delivery address;
  • order details;
  • products ordered;
  • information required for fulfilment and shipping.

The processing is necessary for the fulfilment of the purchase contract and therefore generally relies on Art. 6(1)(b) GDPR.

Selfnamed may also process technical and device-related information in connection with its services. The precise scope and purposes of such processing are governed by Selfnamed's own privacy documentation.

You can find Selfnamed's privacy policy here: Selfnamed Privacy Policy

8. Customer service and communications

When you contact us by email, telephone or through other available communication channels, we process the personal data you provide to us to the extent necessary to handle your enquiry.

This may include your name, contact details, the content of your enquiry, information relating to your order and any other information you voluntarily provide. We process this information to respond to your enquiry, provide customer support and, where applicable, perform a contract or take pre-contractual steps at your request.

Depending on the nature of the enquiry, the legal basis may be Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR or, where legally required, Art. 6(1)(c) GDPR. We retain customer-service communications only for as long as necessary to handle the enquiry and to comply with any applicable legal retention requirements.

9. Product reviews — Judge.me

We use Judge.me to display and manage product reviews and review-related content.

Judge.me is integrated into our Shopify store using Shopify's app and theme-extension framework.

Depending on the functionality used, technical information and information relating to interactions with product and review content may be processed by Judge.me.

Our Shopify configuration is designed so that the relevant app-pixel processing is subject to Shopify's customer privacy and consent mechanisms where consent is required.

If you submit a review, the information you voluntarily provide in connection with the review may be processed and displayed on our website.

Further information is available in Judge.me's privacy documentation: Judge.me Privacy / GDPR information. 

10. Website analytics — Google Analytics

We use Google Analytics 4 (GA4) to understand how visitors use our website and to improve its functionality and content.

Our current GA4 property is 417572600, with the active website measurement ID: G-S51MJ61N58

Analytics processing may include information such as:

  • pages visited;
  • interactions with the website;
  • approximate location;
  • browser and device information;
  • IP-related technical information;
  • information concerning visits and sessions.

We use Google Analytics only in accordance with our consent configuration where consent is required.

If you do not consent to analytics cookies/technologies, the corresponding analytics processing is not activated through the relevant Shopify customer-event mechanism.

The legal basis for optional analytics processing is generally your consent under Art. 6(1)(a) GDPR, where consent is legally required.

You can change or withdraw your cookie choices at any time through our Cookie Preferences. 

11. Marketing technologies — Meta, Google and TikTok

Our Shopify store currently has integrations available for:

  • Meta (Facebook and Instagram);
  • Google & YouTube;
  • TikTok.

These technologies may process information relating to website interactions and conversion events for advertising, measurement and campaign optimisation.

We currently do not actively run advertising campaigns through these services, but the integrations remain available for potential future marketing activities.

Our current Shopify configuration uses the Optimised data-sharing setting.

The relevant marketing pixels are configured to respect Shopify's customer privacy mechanisms. During our testing, the Meta and TikTok pixels show "Pixel is awaiting consent" when marketing consent has not been given.

Marketing-related processing is therefore not treated as automatically permitted merely because the integration exists.

Where consent is required, the legal basis for such optional processing is Art. 6(1)(a) GDPR.

You can refuse or withdraw consent to optional marketing technologies through the cookie preferences.

12. Cookies and similar technologies

Our website uses cookies and similar technologies.

Some cookies are technically necessary for the operation of the online store, including functions such as:

  • shopping cart;
  • checkout;
  • security;
  • basic website functionality;
  • remembering privacy preferences.

These necessary technologies do not require consent where they are genuinely necessary for the requested service.

Other technologies may be used for:

  • personalisation;
  • analytics;
  • marketing.

Where required by applicable law, these optional technologies are activated only after you have given the relevant consent.

Our cookie banner provides the following choices:

  • Required;
  • Personalisation;
  • Marketing;
  • Analytics.

You can select Accept all, Decline all or manage individual preferences.

You can subsequently change or withdraw your consent through the Cookie Preferences function. 

13. Newsletter

We currently use MailerLite for newsletter subscriptions.

However, our current Shopify/MailerLite integration is not actively used for synchronising Shopify customers or orders. Newsletter subscribers currently enter our mailing list through our newsletter subscription form.

When you subscribe to our newsletter, we process:

  • your e-mail address;
  • your name, if provided;
  • your subscription and communication preferences;
  • information concerning your consent.

Newsletter subscription is based on your consent pursuant to Art. 6(1)(a) GDPR and applicable electronic-marketing law.

You may withdraw your consent at any time by using the unsubscribe link contained in our newsletter or by contacting us.

We are planning to migrate our newsletter service from MailerLite to Sender before our next commercial launch. We will update this Privacy Policy and the relevant data-processing documentation when that migration takes place.

For MailerLite's privacy information: MailerLite Privacy Policy 

14. Google Merchant Center

We use Google Merchant Center to make information about our products available to Google for commerce-related purposes.

Our Shopify integration currently uses the Shopify Channel App to connect the online store with Google Merchant Center.

The current Merchant Center destination is: MC-28R3ML68YB

Product information and relevant commerce information may be transmitted to Google through this integration.

This is primarily related to our product catalogue and the presentation and availability of our products through Google's commerce services.

The processing of personal data, where applicable, is governed by the relevant Google services and our configuration of those services. 

15. Google Tag Manager

We maintain a Google Tag Manager container (GTM-P2MRKHK), but the container is currently not installed on the active Shopify storefront and contains no active tags in the current workspace.

We therefore do not currently rely on Google Tag Manager as an active website tracking mechanism. 

16. Affiliate links and affiliate marketing

Some of our website and blog content may contain affiliate links. These links allow us to receive a commission if you click on the link and subsequently make a qualifying purchase from the relevant third-party website. The price you pay is not increased because of the affiliate relationship.

We currently use, or may use in the future, affiliate programmes including Amazon Associates and Awin.

When you click an affiliate link, the relevant affiliate provider or merchant may process information relating to the referral, including technical information and identifiers used to attribute a purchase to the referring website. Such processing is carried out by the relevant third party in accordance with its own privacy and cookie policies.

We do not provide these providers with our GC9 customer database or customer order information for the purpose of affiliate marketing.

Where affiliate tracking involves cookies or similar technologies requiring consent under applicable law, such technologies will only be used after the required consent has been obtained. 

 

C. General GDPR information

17. Legal obligations and accounting

We may process and retain personal data where necessary to comply with legal obligations, including:

  • accounting and tax requirements;
  • statutory record-keeping;
  • consumer-protection obligations;
  • responding to lawful requests from authorities;
  • establishing, exercising or defending legal claims.

The legal basis is Art. 6(1)(c) GDPR and, where applicable, Art. 6(1)(f) GDPR.

Data relating to completed transactions may therefore need to be retained for statutory periods even if you request deletion of other personal data. 

18. Data recipients

Depending on the circumstances, personal data may be disclosed to or processed by:

We do not sell customer personal data. 

19. International transfers

Some of our service providers and their subprocessors may process personal data outside the European Economic Area (EEA).

Where personal data is transferred to a country outside the EEA that does not benefit from an adequacy decision, we rely on an appropriate legal transfer mechanism under Chapter V GDPR, such as:

  • an adequacy decision where applicable;
  • Standard Contractual Clauses;
  • or another legally recognised transfer mechanism.

For example, Shopify states that personal data concerning individuals in the EEA may be transferred to locations including Canada and the United States and that it uses applicable safeguards for such transfers.

The specific international-transfer arrangements of individual service providers are governed by their respective privacy policies and contractual data-processing arrangements.

For provider-specific information concerning international data transfers, including the transfer mechanisms used, recipient countries and applicable safeguards, please refer to the respective privacy policies and data-protection documentation of those providers. The relevant links are provided in the corresponding sections of this Privacy Policy.

20. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required by law. In particular:

Contract and order data

We retain data relating to purchases for as long as necessary to process the contractual relationship and subsequently for the periods required by applicable accounting, tax, consumer-protection and other statutory obligations.

Newsletter data

Newsletter subscription data is retained until you withdraw your consent or unsubscribe, unless another lawful reason requires us to retain particular information.

Consent records

Where necessary, we retain appropriate records of consent and withdrawal in order to demonstrate compliance with applicable legal requirements.

Analytics and marketing data

Optional analytics and marketing data is retained according to the applicable provider's configured retention periods. 

21. Your rights

Subject to the applicable legal requirements and limitations, you have the following rights under the GDPR:

  • right of access to your personal data;
  • right to rectification of inaccurate or incomplete data;
  • right to erasure ("right to be forgotten");
  • right to restriction of processing;
  • right to data portability;
  • right to object to certain processing;
  • right to withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

You may also object to processing based on legitimate interests where the legal requirements for such an objection are met.

To exercise your rights, please contact us using the contact details in Section 1. 

22. Right to lodge a complaint

You also have the right to lodge a complaint with a data protection supervisory authority if you believe that your personal data is being processed unlawfully.

For Austria, the competent supervisory authority is:

Österreichische Datenschutzbehörde (DSB)
Barichgasse 40–42
1030 Wien
Austria

Austrian Data Protection Authority

You are free to contact the supervisory authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement, subject to the applicable rules. 

23. Data security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure. 

24. Changes to this Privacy Policy

We may update this Privacy Policy where our website, services, data-processing activities or applicable legal requirements change.

The current version will always be made available on:

https://www.greencloudnine.com

The date of the most recent update is shown at the beginning of this Privacy Policy.