secure payment
Before publishing: add the VAT number once you have it (matches the placeholder in your Terms and Conditions). Everything else is ready to use, based on your actual setup: Phytonatura Ltd, GDPR/Cyprus-focused, single accept/decline cookie mechanism, WooCommerce gift cards.
Our products are sold primarily within the European market, and in particular within Cyprus. At this time, herbolistique.cy ships only within Cyprus. If you are visiting our website from outside the EU/EEA — including, in the rare case, from the United States — most of this policy still describes how we handle your personal data. We do not currently target or knowingly sell to US residents, so US state-specific disclosures (such as under the California Consumer Privacy Act) are not included in this policy; if that changes in the future, we will update this policy accordingly.
Phytonatura Ltd ("we", "us", "our"), a company registered in Cyprus under registration number HE 495735, with its registered office at Ellados 12, 8020 Paphos, Cyprus, and VAT number [VAT NUMBER — TO BE ADDED], is the data controller responsible for your personal data when you visit or make a purchase on herbolistique.cy.
We only use your personal data for the purposes and legal grounds set out below, and only for as long as described under "How Long We Keep Your Data".
Purpose: to fulfil our contractual obligations to you when you buy our products (see our Terms and Conditions). Data: name, delivery/billing address, phone number, email address, order details, payment details (processed by our payment provider, Stripe — see "Who We Share Your Data With"), payment history. Legal ground: performance of a contract with you. Storage: for the duration of our contractual relationship, including the statutory legal guarantee period, after which we erase it — except where we must keep it longer under mandatory law (for example, accounting legislation).
Purpose: if you purchase a gift card, we process your data as described under "Purchases" above. If you receive a gift card purchased by someone else, we process your data to let you redeem it, using our e-commerce platform's gift card feature. Data: email address, name (if provided by the purchaser), gift message (if provided). Legal ground: our legitimate interest in fulfilling our obligation to the purchaser, and yours and our legitimate interest in letting you use the gift card. Storage: for the validity period of the gift card, after which we erase it.
Purpose: if you sign up for news, offers, or promotions, we process your data to send you these communications. We may personalise what we send you based on factors such as your previous purchases or interactions with our emails. Data: email address, order history, which emails you've opened or clicked, and pages you visited after clicking a link in our emails. Legal ground: our legitimate interest in maintaining a good customer relationship (or your consent, where required). Storage: until you unsubscribe, or after 36 months of no engagement with our marketing communications, whichever comes first — unless we have another legal ground to keep your data (such as an active order).
Purpose: to assist you when you contact us for support, whether by email or, if and when we introduce it, through live chat or an AI-assisted chat feature. Data: your name, email, order details, and the content of our correspondence. If you voluntarily share sensitive information with us in this context — for example, an allergy or health-related reason for a question about one of our products — we only use it to help resolve your query. Legal ground: performance of our contract with you, or our legitimate interest in providing good customer service. Storage: up to 3 years after your matter is resolved, except for sensitive information you've voluntarily shared (such as health-related details), which we erase as soon as your matter is resolved.
Purpose: if you start a purchase and provide your email but don't complete checkout, we may send you a reminder email with a link back to your cart. Data: the details you entered before leaving checkout. Legal ground: our legitimate interest in reminding you of an incomplete purchase. Storage: up to 1 month after the reminder, unless there's another legal ground to keep it (such as a completed order). You can opt out by contacting us at office@herbolistique.cy.
Purpose: to understand how visitors use our website and to improve it. Data: IP address, and, if you consent to analytics cookies, data such as pages viewed, time spent on pages, and products viewed. Legal ground: for strictly necessary cookies, our legitimate interest in providing a functioning website. For analytics cookies, your consent (see "Cookies" below). Storage: see "Cookies" below.
If you consent to marketing cookies, we may use tools provided by third-party advertising platforms such as Meta and Google to show you ads that are relevant to you, based on your browsing behaviour on our website. If you don't consent, you may still see our ads elsewhere, shown at random rather than based on your behaviour.
Because these are third-party platforms, Meta and Google each act as an independent controller for the data they collect through their own tools, and each publishes its own privacy information about how it processes that data:
We recommend reviewing those pages directly for full details on how each platform handles your data.
Purpose: to carry out risk analysis and prevent fraud. Data: name, address, phone number, email, order and payment history. Legal ground: our legitimate interest in preventing fraud. Storage: 6 months, or 2 years for a purchase cancelled due to suspected fraud, unless another legal ground applies.
We use cookies to run our website and, if you consent, to understand how it's used and to show you relevant marketing.
Strictly necessary cookies keep the website functioning (for example, remembering your cart) and don't require your consent.
Analytics and marketing cookies are only set if you click "Accept" on our cookie banner. These help us understand site usage and, once introduced, may support the advertising described above. Our consent cookie itself is stored for 365 days.
Changing your mind: you can change your cookie choice at any time by clicking "Manage your consent" in the website footer, or the button below. Both reopen the cookie banner so you can accept or decline again — withdrawing your consent is just as easy as giving it, as required by data protection law.
You can also block or delete cookies through your browser settings at any time, though this may affect some website functionality.
Only people who need your data for the purposes above have access to it. We share personal data with:
When we share your data with any of the above, we require them, by contract, to keep it confidential and use it only for the agreed purpose. Where any of these recipients are located outside the EU/EEA, the transfer is carried out in line with data protection law, such as through the European Commission's Standard Contractual Clauses.
Under the GDPR and Cyprus data protection law, you have the right to:
None of these rights are absolute — some requests may not lead to the action requested, depending on the circumstances. To exercise any of these rights, contact us using the details below. We may ask you to verify your identity before acting on your request.
We do not knowingly collect personal data from children under 14 (the digital age of consent under Cyprus law). If we become aware that we've collected data from a child under 14 without appropriate consent from a parent or guardian, we will delete it.
We use appropriate technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access, including secure connections and access controls. We review our security practices regularly.
For any question about this policy, our use of cookies, or to exercise your rights, contact us at office@herbolistique.cy.
If we change how we process your personal data or use cookies, we will update this policy and publish the revised version on this page.
Last updated: August 2026
