Privacy Policy

Last updated: January 2026

Herbal Origo (“we”, “us”, “our”) respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what information we collect, how we use it, and the rights you have over your data.

This policy applies to our website, inquiry forms, email communications, and any related B2B services.

1. Who We Are (Data Controller)

The data controller responsible for your personal information is:

Herbal Origo
[Registered Address — please insert]
Email: herbalorigo@gmail.com

2. Information We Collect

We collect the following categories of information:

2.1 Information you provide directly

  • Inquiry and contact details: company name, contact name, email address, country or region, product interest, purchase quantity, and the content of your message;
  • Business information: company registration details, delivery address, tax or VAT identifiers, and payment information exchanged during order processing;
  • Communications: emails, messages, and documents exchanged with our export or commercial team.

2.2 Information collected automatically

  • Technical data: IP address, browser type and version, operating system, device type, screen resolution, and language preference;
  • Usage data: pages visited, time spent on pages, referring URL, and interactions with site features;
  • Approximate location: derived from your IP address at country or region level.

2.3 Information from third parties

  • Business contact details obtained through trade shows, industry directories, or referral partners;
  • Publicly available company information used for due diligence and compliance checks.

3. How We Use Your Information

We use personal information for the following purposes:

  • To respond to inquiries, provide quotations, and process orders;
  • To prepare samples, specifications, certificates, and shipping documents;
  • To communicate about products, services, and partnership opportunities;
  • To comply with export control, customs, tax, and regulatory obligations;
  • To improve our website, product offerings, and customer experience;
  • To detect and prevent fraud, abuse, and security incidents;
  • To send marketing communications where you have opted in, or where permitted by applicable law.

4. Legal Bases for Processing (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases:

  • Contract: to respond to your inquiry, prepare quotations, and fulfill orders;
  • Legitimate interests: to operate and improve our business, prevent fraud, and communicate with business contacts;
  • Legal obligation: to comply with export, customs, tax, and record-keeping requirements;
  • Consent: for optional cookies, analytics, and marketing communications. You may withdraw consent at any time.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to operate this website, remember your preferences, and understand how the site is used.

Cookies are grouped into the following categories:

  • Strictly necessary cookies: required for the website to function (for example, security, form submission, and consent preferences). These are always active.
  • Analytics cookies: help us understand how visitors interact with the site, which pages are most useful, and where improvements are needed. These are only set with your consent.
  • Marketing cookies: used to measure the effectiveness of campaigns and, where applicable, deliver relevant content. These are only set with your consent.

You can manage your cookie preferences at any time through the cookie banner shown on your first visit, or by adjusting your browser settings. Disabling certain cookies may affect site functionality.

6. Google Analytics and Consent Mode

We use Google Analytics 4 to measure website traffic and usage patterns. Google Consent Mode v2 is enabled so that analytics and advertising storage remain denied by default until you provide consent. Analytics scripts are loaded only after you accept analytics cookies.

Google may process data in accordance with its own privacy policy. You can review Google’s practices at https://policies.google.com/privacy.

7. How We Share Information

We do not sell personal information. We may share it with the following categories of recipients:

  • Service providers: hosting providers, email delivery services, analytics providers, and IT support vendors, all bound by confidentiality obligations;
  • Logistics and customs partners: freight forwarders, couriers, customs brokers, and inspection agencies, as required to deliver your order;
  • Certification and testing bodies: laboratories and auditors when batch testing or certification is required;
  • Professional advisers: legal, accounting, and compliance consultants;
  • Authorities: government or regulatory bodies where disclosure is required by law.

8. International Data Transfers

We operate internationally, and your information may be transferred to and processed in countries outside your own. When we transfer personal data from the EEA, UK, or Switzerland to other countries, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or equivalent mechanisms.

9. Data Retention

We retain personal information only as long as necessary for the purposes described in this policy:

  • Inquiry data: retained for up to 24 months after the last communication, unless it results in an order;
  • Customer and order records: retained for the duration of the business relationship and for as long as required by tax, export, and customs regulations (typically 5–10 years);
  • Analytics data: retained according to the settings configured in Google Analytics, typically up to 14 months;
  • Consent records: retained to demonstrate compliance with cookie and marketing consent requirements.

10. Your Rights (EEA, UK, Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the right to:

  • Access the personal data we hold about you;
  • Request correction of inaccurate or incomplete data;
  • Request deletion of your data, subject to legal retention obligations;
  • Object to or restrict certain processing activities;
  • Request data portability in a structured, machine-readable format;
  • Withdraw consent at any time for processing based on consent;
  • Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at herbalorigo@gmail.com. We will respond within the timeframe required by applicable law.

11. Your Rights (California Residents)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA, including:

  • The right to know what categories of personal information we collect, use, and disclose;
  • The right to request deletion of your personal information, subject to legal exceptions;
  • The right to correct inaccurate personal information;
  • The right to opt out of the “sale” or “sharing” of personal information — we do not sell personal information;
  • The right to non-discrimination for exercising your privacy rights.

To submit a request, email herbalorigo@gmail.com. We may need to verify your identity before processing the request.

12. Marketing Communications

We may send business-related communications such as product updates, market notes, or event invitations. You can unsubscribe at any time using the link in the email, or by contacting us directly. Transactional and order-related communications are not affected by marketing preferences.

13. Data Security

We implement reasonable technical and organizational measures to protect personal information against unauthorized access, loss, misuse, or alteration. These measures include encrypted connections (HTTPS), access controls, and restricted internal access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Children’s Privacy

This website and our services are intended for business users and are not directed to children. We do not knowingly collect personal information from anyone under 16 years of age. If you believe a child has provided us with personal information, please contact us so we can delete it.

15. Third-Party Websites

Our website may link to third-party sites, including social media platforms and industry resources. We are not responsible for their privacy practices. We encourage you to review their privacy policies before providing personal information.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The “Last updated” date at the top indicates the most recent revision. Material changes will be communicated through a notice on this website where appropriate.

17. Contact Us

For any questions about this Privacy Policy or to exercise your privacy rights, please contact:

Herbal Origo
Email: herbalorigo@gmail.com