Privacy Policy

Thank you for your interest in natureplus. Protecting your personal data is important to us. This privacy policy explains which data we process, for what purpose, on what legal basis, and what rights you have. The terms used (e.g., "personal data", "processing", "controller", "processor") have the meanings defined in Art. 4 of the General Data Protection Regulation (GDPR).

This privacy policy applies to our websites natureplus.org and natureplus-label.org. You can generally use both without providing any personal data. We only collect data if you contact us, use a form, apply for membership, register for an event, subscribe to our newsletter, or if it is technically necessary for the operation of the websites.

1. Controller

International Association for Sustainable Building and Living – natureplus e.V. Dilsberger Str. 2 69151 Neckargemünd Germany

Phone: +49 (0)6223 – 8660170 Email: info@natureplus.org Website: www.natureplus.org

2. Data protection contact

For questions regarding data protection and the exercise of your rights, you can reach us at info@natureplus.org or at the address mentioned above.

3. Hosting and server log files

Our website is hosted by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. When you visit the website, data transmitted by your browser is automatically collected: browser type and version, operating system, referrer URL, pages visited, date and time of access, and your IP address. We require this data to deliver the website, ensure its security and stability, and defend against attacks. The legal basis is our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR).

Webflow provides content via a global content delivery network (CDN) to ensure that pages load quickly and reliably. We have entered into a data processing agreement with Webflow. Data transfers to the USA are based on EU standard contractual clauses and, where Webflow is certified accordingly, on the EU-US Data Privacy Framework. Further information: https://webflow.com/legal/eu-privacy-policy

4. Cloudflare

To protect our forms from spam and automated attacks, we use Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. In this process, your IP address and technical characteristics of your browser are processed to determine whether the form is being submitted by a human. The legal basis is our legitimate interest in the secure operation of our websites (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses apply. Further information: https://www.cloudflare.com/privacypolicy/

5. jsDelivr

Some features of our websites, such as share buttons, notification windows, and scroll behaviour, load program libraries via the content delivery network jsDelivr (https://www.jsdelivr.com). In doing so, the operator receives your IP address and technical data from your browser. The legal basis is our legitimate interest in a fast and functional website (Art. 6(1)(f) GDPR).

6. Cookies and consent

Our websites only use cookies and similar technologies that are technically necessary for operation (Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG), Art. 6(1)(f) GDPR). This also includes your browser's local storage, where we record, for example, which notification banner is displayed. We describe the third-party content we integrate and the data transferred in the sections regarding the individual services.

You can also manage and delete cookies in your browser. If you disable cookies, some features of the website may not be available.

7. Translation with Weglot

For parts of the English version of our websites, we currently use the translation service Weglot, provided by Weglot SAS, 138 rue Pierre Joigneaux, 92270 Bois-Colombes, France. When you visit a page, a script from Weglot is loaded. In the process, Weglot receives your IP address and technical data from your browser; the text on the page is processed for translation. The legal basis is our legitimate interest in providing a multilingual service (Art. 6(1)(f) GDPR). We will soon be switching entirely to Webflow's integrated language function. Once this is complete, this section will be removed. Further information: https://weglot.com/privacy/

8. Contact by email and telephone

When you contact us by email or telephone, we process your details (name, contact information, content of the enquiry) to handle your request. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to membership, certification, or a contract; otherwise, it is our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).

For email, calendar, and file storage, we use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We have a data processing agreement in place with Microsoft. Data transfer to the USA cannot be excluded; it is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses.

9. Membership application via our website

You can apply for membership via the form at natureplus.org/en/mitmachen. We process the information provided in the form, in particular the company or organisation, contact person, address, email, telephone number, desired type of membership, as well as bank details and SEPA direct debit mandate for fee collection.

The purpose is to review your application, for the board to decide on admission in accordance with our statutes, and for your subsequent membership support. For this purpose, board members receive the application data, excluding bank details. The legal basis is Art. 6(1)(b) GDPR (initiation and performance of membership).

The form and application management are handled via Bigin by Zoho CRM. The provider is Zoho Corporation B.V., Utrecht, Netherlands. Data is stored in Zoho's data centre in the EU. We have a data processing agreement in place with Zoho.

If an application is rejected or withdrawn, we will delete the application data after 6 months, provided there is no statutory retention obligation.

10. Membership administration, invoices, and fee collection

For invoices, membership fee collection, and accounting, we use Zoho Books (provider as per Section 9, storage in the EU). Bank details and SEPA mandates are stored exclusively there. For direct debit collection, we transmit the necessary payment data to our bank. Our accounting data is also provided to our tax advisers, which processes it for the preparation of accounts and tax returns.

The legal bases are the performance of membership (Art. 6(1)(b) GDPR) and our statutory accounting and retention obligations (Art. 6(1)(c) GDPR).

11. Forms for factsheets and enquiries

We offer forms on our websites, for example, to request our EmpCo factsheet and for enquiries regarding certification with the natureplus eco-label (natureplus-label.org). We process the information provided in the form, in particular your name, email address, organisation, position, and the content of your enquiry. The purpose is to provide you with the factsheet or to respond to your enquiry. For certification enquiries, the legal basis is Art. 6(1)(b) GDPR; otherwise, it is our legitimate interest in providing specialist information and contacting interested parties (Art. 6(1)(f) GDPR).

Forms are processed via Webflow (Section 3). Your details are stored by Webflow in the USA and forwarded to us by email. Spam protection is provided by Cloudflare Turnstile (Section 4). Please register separately for our newsletter (Section 12).

12. Newsletter

When you subscribe to our newsletter, we process your email address and any voluntary information, such as your name, to send you information about natureplus. Registration uses a double opt-in process: you will receive an email asking you to confirm your subscription. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the unsubscribe link in any newsletter or by emailing us.

For sending newsletters, we use Mailchimp, provided by Intuit Inc., 2700 Coast Avenue, Mountain View, CA 94043, USA. We have a data processing agreement in place with Intuit; transfers to the USA are safeguarded by the EU-US Data Privacy Framework and standard contractual clauses. Mailchimp tracks whether a newsletter has been opened and which links have been clicked.

Once you unsubscribe, we will delete your email address from our mailing list. To provide evidence of prior consent, we may retain it in a suppression list for up to three years (Art. 6(1)(f) GDPR).

13. Events and registration via Eventbrite

For events such as the natureplus Late Lunch Sessions, we use the Eventbrite platform (Eventbrite, Inc., San Francisco, USA) for registration and, where applicable, ticket sales. When you register, we and Eventbrite process your name, email address, any additional information provided in the registration form, and, for paid events, payment details; payment is handled by Eventbrite. The purpose of this is to organise and conduct the event. The legal basis is Art. 6(1)(b) GDPR.

A registration widget from Eventbrite is embedded on our article and event pages. When these pages load, Eventbrite receives your IP address and technical data from your browser. The legal basis for this is our legitimate interest in providing a simple event registration process (Art. 6(1)(f) GDPR). Eventbrite processes data partly as an independent controller; Eventbrite's privacy policy applies: eventbrite.de. Transfers to the USA are secured by the EU-US Data Privacy Framework and Standard Contractual Clauses.

14. YouTube videos

On some pages, we embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit these pages, a connection to YouTube's servers is established. In the process, Google receives your IP address and information about which page you visited, among other things. If you are logged into Google, Google can associate your visit with your account. The legal basis is our legitimate interest in presenting our content in an engaging way (Art. 6(1)(f) GDPR). Transfers to the USA are secured by the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy

15. Links to social networks

We provide links to our profiles on LinkedIn, Instagram, and YouTube. These are simple links, not embedded plugins. Data is only transferred to the respective provider when you click a link; their privacy policies then apply.

16. Google Search Console

To improve the visibility of our website in Google search results, we use Google Search Console. It provides us with aggregated reports on how often our pages appear in search results. No personal data of our website visitors is transmitted to Google in this process.

17. Recipients and service providers

We only share your data where necessary for the stated purposes. We have contractually obligated service providers who process data on our behalf in accordance with Art. 28 GDPR:

  • Webflow, Inc. (USA) for hosting both websites and processing forms,
  • Zoho Corporation B.V. for managing membership applications (Bigin) as well as invoices and membership fees (Books), stored in the EU,
  • Microsoft Ireland Operations Limited for email, calendar, and file storage (Microsoft 365),
  • Intuit Inc. (Mailchimp, USA) for newsletter distribution,
  • Weglot SAS (France) for website translation, until the transition is complete,
  • Eventbrite, Inc. (USA) for event registrations,
  • Anthropic Ireland Limited for AI assistance with internal administrative tasks (Claude).

In addition, where necessary, our bank (for direct debits), our accounting firm (for bookkeeping), and the board (for decisions on membership applications) receive data.

18. Transfers to third countries

Some service providers are based in the USA or process data there. Transfers are based on the European Commission's adequacy decision regarding the EU-US Data Privacy Framework (Art. 45 GDPR), provided the provider is certified, and additionally on the basis of EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You may request a copy of these safeguards from us.

19. Legal bases and legitimate interests

We process personal data based on your consent (Art. 6(1)(a) GDPR), for the performance of membership or a contract and pre-contractual measures (lit. b), for compliance with legal obligations, such as tax retention requirements (lit. c), and based on legitimate interests (lit. f). Our legitimate interest is the pursuit of our association's statutory purposes, communication with members, partners, and interested parties, as well as the secure operation of our website and IT.

20. Retention periods

We only store personal data for as long as is necessary for the respective purpose or as required by statutory retention periods.

Webflow only stores server log files for as long as is necessary for the operation and security of the websites. We delete email enquiries and form submissions after final processing; submissions via Webflow are deleted after 12 months at the latest, provided there is no legal obligation to retain them. Data from rejected or withdrawn membership applications is deleted after 6 months.

We store membership data for the duration of the membership and thereafter until the expiry of statutory retention periods. We retain invoices and accounting records for 8 years, books and annual financial statements for 10 years, and commercial and business correspondence for 6 years (Section 147 AO, Section 257 HGB). We keep email addresses on a suppression list for up to 3 years after a newsletter unsubscribe.

21. Your rights

You have the following rights:

  • Access to your stored data (Art. 15 GDPR),
  • Rectification of inaccurate data (Art. 16 GDPR),
  • Erasure (Art. 17 GDPR),
  • Restriction of processing (Art. 18 GDPR),
  • Data portability (Art. 20 GDPR),
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): If we process data based on legitimate interests, you may object at any time for reasons relating to your particular situation. You may object to the use of your data for direct marketing purposes at any time without providing a reason.

For all requests, an informal message to the contact details provided in Section 1 is sufficient.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.

22. No automated decision-making

We do not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. Membership applications are decided by the board.

23. Last updated

This privacy policy was last updated in November 2026. We will update it if our website, our service providers, or the legal situation change.