Back to the home page

Privacy policy

Version of 18.09.2026

This website works without tracking, without advertising services and without external fonts. Only the data required to run the site and to answer an enquiry are processed. A consent banner is therefore not necessary.

1 Controller

The controller for the processing of data on this website is:

Freilandhof Binder, Michael Binder
Im Krustrain 10
75443 Ötisheim
Phone: 07041 7193
Email: info@binderland.online

We are not required to appoint a data protection officer, because the statutory thresholds are not met.

2 Your rights

You have the right at any time to information about the data stored about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). You may withdraw consent you have given at any time; the lawfulness of the processing carried out up to that point remains unaffected.

To exercise these rights, please contact us at the address given above. Independently of this, you may lodge a complaint with a supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart.

3 Hosting and server log files

This website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When the website is accessed, the server automatically processes data transmitted by your browser:

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in technically faultless operation and in defending against attacks. The log files are deleted after [7 / 14 / 30] days. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

4 Encryption

The website is delivered over HTTPS with TLS encryption. You can tell whether a connection is encrypted by the padlock symbol in your browser's address bar.

5 Cookies and storage on your device

On the pages of this website we set no cookies and use neither local storage nor session storage. Visitors are not recognised.

There is a single exception in the Kräutershop: anyone who logs in there receives a strictly necessary session cookie named shopsess. It contains a random number, no identifier of your person, and is deleted when you log out or close the browser. Without this cookie logging in would not be technically possible; under section 25(2) no. 2 TDDDG no consent is required for it. Details are given in section 9.

That is why there is no consent banner. We show none because we need none, not because we forgot one.

6 Fonts, scripts and external content

All fonts (EB Garamond, Poppins) and all scripts, including the 3D library three.js, are loaded from our own server. There is no connection to third-party font, script or content delivery networks. No maps, videos or social media elements are embedded. Simply visiting this site therefore transfers no data to third parties.

7 Audience measurement

We use no analytics or tracking tools. No profiling takes place.

8 Contact form, email and telephone

If you contact us via the contact form, by email or by telephone, we process the data you provide in order to answer your enquiry.

Data processed via the form: name, email address, optionally the telephone number, the subject you selected and your message. The time of sending and the IP address are also transmitted for technical reasons, in order to detect misuse.

Legal basis: Art. 6(1)(b) GDPR where the enquiry is aimed at a contract, otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in answering enquiries. The consent you give in the form is based on Art. 6(1)(a) GDPR.

Recipients: The message is delivered by email to our mailbox and processed by our hosting provider. It is not passed on to any other third parties.

Deletion: We delete the data once the enquiry has been dealt with in full and no statutory retention obligations apply. Retention periods under commercial and tax law of six and ten years respectively remain unaffected.

Spam protection: The form contains a hidden field that is invisible to people. If it is filled in, we discard the message. No external service such as a captcha is used.

9 Customer account in the Kräutershop

To place an order in Binderlands Kräutershop you need an account. We store your email address, password, form of address, first and last name, company, address and, if you provide it, your phone number. In addition, the time of your last login and, if you mistyped, the number of failed attempts.

We do not store the password in plain text, but as a hash value. The password cannot be calculated back from it. We do not know it either, and if you forget it we cannot tell you what it was, only let you set a new one.

The legal basis is Art. 6(1)(b) GDPR, performance of the contract. You can have your account deleted at any time. The invoice data belonging to completed orders is not affected: it is subject to the retention obligation under section 147 of the German Fiscal Code and section 14b of the German VAT Act and is kept for ten years.

When you log in we set a strictly necessary cookie named shopsess. It contains no identifier of your person, only a random number, and it is deleted when you close the browser or log out. Without this cookie you could not log in; under section 25(2) TDDDG (German Digital Services Data Protection Act) no consent is required for it.

10 Orders and invoices

For an order we additionally store: the products ordered with quantity and price, the shipping costs, the tax amount, the delivery address, the payment method chosen, your note if you wrote one, and the times of order, payment and dispatch. From this data the invoice is produced as a PDF file on our server.

The delivery address is recorded in the order as it stood at the time of the order. If you change your address in your account later, the old order does not change: an invoice that changes retrospectively would not be an invoice.

The legal basis is Art. 6(1)(b) GDPR for processing the order and Art. 6(1)(c) GDPR for retention. Retention period: ten years after the end of the calendar year in which the invoice was issued.

For delivery we pass your name and delivery address to the shipping company. Nothing more, in particular not your email address or what you ordered.

11 Payment methods

Payment in advance. You make the transfer yourself. We learn from your bank that an amount has arrived quoting your order number as the reference. We do not store your account details in our system.

PayPal. If you choose PayPal, you are forwarded to PayPal and enter your details there, not with us. We transmit to PayPal the amount, the currency, our order number and the products ordered; in return we receive confirmation that payment has been made and a transaction number. We do not see your payment details. The controller is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Their privacy policy applies. The legal basis is Art. 6(1)(b) GDPR.

We do not embed any PayPal script in our pages. As long as you do not choose PayPal, PayPal learns nothing about your visit.

12 Emails from the shop

In connection with an account and an order we send you: the confirmation of your email address, the order confirmation, the confirmation that payment has arrived, the dispatch confirmation, where applicable a payment reminder and, if you request it, a link for a new password. All these messages are part of the contract and are not advertising. There is no newsletter.

The messages are sent via our host's mail server, see section 3. There is no measurement of whether or when you opened a message.

13 Log in the administration area

Operations in the administration area are logged: who logged in and when, who changed a product, when an incoming payment was recorded. The log serves traceability and security. It contains no customer data apart from order numbers. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in an operation that can be traced.

14 Registration requirement for accommodation

Where a stay actually takes place, we are required by law as an accommodation business to have a registration form completed and signed on arrival and to keep it for one year (Sections 29 and 30 of the Bundesmeldegesetz, the German Federal Registration Act). The following are recorded: date of arrival and departure, first and last names, date of birth, nationality, address and number of accompanying persons; for guests from abroad, also the type, number and issuing state of the identity document. The legal basis is Art. 6(1)(c) GDPR. Once the period has expired, the registration forms are destroyed. They are passed on only to the authorities entitled to receive them under the Federal Registration Act.

15 No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

16 Obligation to provide data

Providing your data is voluntary. Without a name, email address and message, however, we cannot answer an enquiry.

17 Changes

We adapt this policy when our processing activities or the legal situation change. The version published on this page at any given time applies.

Last updated: 2026