Privacy Policy

Last updated: July 22, 2026

This Privacy Policy explains how THEKEY LLC, as the operator of Alma Pure™, collects, uses, stores, and shares personal data when you visit our website, place an order, use our services, or communicate with us.

1. Data Controller

The data controller for the processing of personal data via this website is:

THEKEY LLC
Alma Pure
30 N Gould St Ste R
Sheridan, WY 82801
United States

Email: contact@myalmapure.com

For questions about data protection or to exercise your data protection rights, you can contact us at the email address above.

2. Personal Data We Process

Depending on how you use our website and services, we may process the following categories of personal data in particular:

First and last name;
Email address and phone number;
Billing and shipping address;
Information regarding orders, purchases, returns, and refunds;
Information required for payment processing;
Content of your communication with our customer service;
Technical data such as IP address, device type, browser, operating system, and network data;
Information about your use of our website;
Marketing preferences and granted consents;
Information for fraud prevention and transaction security;
Account and login data, if you create a customer account;
Information about viewed products, shopping carts, and other interactions with our online store.

We generally do not store complete credit card or debit card data. This is processed by the payment service providers used on our website.

3. Sources of Personal Data

We may obtain personal data from the following sources:

Directly from you, for example, when placing an order, creating a customer account, subscribing to a newsletter, or contacting us;
Automatically when using our website through cookies, pixels, log files, and similar technologies;
From payment service providers, shipping service providers, logistics partners, and fraud prevention service providers;
From Shopify and other technical providers that support the operation of our online store;
From analytics, marketing, and advertising partners, insofar as this is legally permissible and, where applicable, with your consent.

4. Purposes and Legal Bases of Processing

Order Processing and Contract Fulfillment

We process personal data to:

Process orders and payments;
Prepare and deliver products;
Send delivery status and order information;
Process returns, refunds, and complaints;
Create and manage customer accounts;
Respond to pre-contractual inquiries;
Provide our customer service.

The legal basis is Article 6(1)(b) GDPR, insofar as the processing is necessary for the performance of a contract or pre-contractual measures.

If the data required for an order is not provided, we may not be able to process or fulfill the order.

Fulfillment of Legal Obligations

We process certain data insofar as this is necessary to fulfill legal, tax, commercial, accounting, or regulatory obligations.

The legal basis is Article 6(1)(c) GDPR.

Security and Fraud Prevention

We may process personal data to:

Protect our website, our customers, and our company;
Review suspicious or potentially fraudulent transactions;
Prevent misuse, unauthorized access, and illegal activities;
Detect technical faults and security incidents;
Assert, exercise, or defend legal claims.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the security of our services, fraud prevention, and the protection of our legal and economic interests.

Customer Service and Improvement of Our Services

We may use order information and the content of your communications to:

Answer your questions;
Resolve problems with an order;
Process complaints and claims;
Improve the functionality of our website and our services;
Identify recurring problems.

The legal basis is, depending on the situation, Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.

Direct Marketing

Where consent is required, with your prior consent, we may use your email address, phone number, or other contact details to send you the following:

Newsletters;
Product news;
Special offers and discount promotions;
Reminders about an abandoned shopping cart;
Requests to submit a product review;
Personalized commercial communications.

The legal basis is Article 6(1)(a) GDPR.

You can revoke your consent at any time with effect for the future by using the unsubscribe link in the respective message or by contacting us at contact@myalmapure.com.

The revocation does not affect the lawfulness of processing carried out before the revocation.

Where direct marketing is legally permissible based on a legitimate interest, you can object to this processing at any time.

Advertising, Analysis, and Performance Measurement

With your consent, we may use cookies, pixels, and similar technologies to:

Analyze the use and performance of our website;
Understand user behavior;
Personalize content and advertising;
Measure the effectiveness of our advertising campaigns;
Display relevant advertising to you on third-party platforms;
Form target audiences for advertising campaigns;
Recognize whether an advertisement led to a visit or purchase.

The legal basis for the processing of personal data is generally Article 6(1)(a) GDPR.

You can change or revoke your consent at any time via the cookie settings tool available on our website.

5. Cookies and Similar Technologies

We use technically necessary cookies and similar technologies that are required for the operation of the website, the shopping cart, checkout, security, and the provision of explicitly requested functions.

As required by law, we only use analytics, marketing, advertising, or personalization technologies after you have given your consent.

Non-essential cookies and similar technologies are not activated before your consent is given, unless a legal exception applies.

You can reject non-essential cookies without being denied access to the basic functions of our website or the possibility of making a purchase. However, certain personalized or optional functions may be limited.

You can change your selection at any time via the cookie settings on our website.

Further details on the technologies used, providers, purposes, and storage periods can be found in our Cookie Policy or in the cookie settings tool.

6. Recipients of Personal Data

We may disclose personal data only to the extent necessary for the respective purposes.

Recipients may include:

Shopify and technical providers that host or support our website;
Payment service providers and financial institutions;
Shipping companies, freight forwarders, manufacturers, and logistics partners;
Providers for order management, customer service, and communication;
Providers for IT security and fraud prevention;
Providers of analytics, marketing, and advertising services, where the necessary consent is present;
Providers of newsletter, SMS, or email services;
Providers of review and feedback systems;
Accountants, legal advisors, insurers, and other professional advisors;
Authorities, courts, or other authorized bodies, insofar as we are legally obliged to disclose data;
Potential acquirers, legal successors, or involved advisors in the context of a merger, restructuring, financing, or sale of our company or parts of the company.

Service providers may process personal data on our behalf as processors or, where legally provided, as independent controllers.

We do not sell our customers' personal data for financial compensation.

7. Shopify

Our online store is operated via Shopify.

Shopify provides, in particular, the technical infrastructure for our website, shopping cart, checkout, and order management.

Shopify may process certain personal data to provide, protect, operate, and improve its services.

Data may be processed by Shopify, affiliated companies, and subcontractors in various countries.

Further information on the processing of personal data by Shopify can be found in Shopify's privacy information.

8. Payment Service Providers

Payments are processed via the payment service providers offered on our website.

Depending on the selected payment method, the following data, in particular, may be transmitted to the respective provider:

Name;
Billing address;
Email address;
Order value;
Currency;
Transaction number;
Payment status;
Information required for verification and execution of payment.

Payment service providers may collect additional data for identity verification, fraud prevention, or compliance with legal obligations.

For independent processing by a payment service provider, their privacy policies also apply.

9. Shipping, Manufacturing, and Logistics

To manufacture, prepare, inspect, and deliver your order, we may share the necessary personal data with manufacturers, shipping companies, freight forwarders, and logistics partners.

This may include, in particular:

Name;
Delivery address;
Phone number;
Email address;
Order number;
Product and delivery information;
Information for customs clearance, if required.

Our products are manufactured in India. International order processing and logistics may be carried out, among others, via partners in India, China, Hong Kong, or other countries.

The respective recipients only receive the data necessary for the manufacture, processing, delivery, return, or tracking of the order.

10. International Data Transfers

THEKEY LLC is based in the United States. In addition, some of our service providers, manufacturers, and partners may operate outside the European Economic Area.

Personal data may therefore be processed in the following countries in particular:

United States;
Canada;
India;
China;
Hong Kong;
Singapore;
Other countries where Shopify or our service providers operate.

If personal data is transferred to a country outside the European Economic Area, we ensure, where necessary, that a legally recognized transfer mechanism is used.

This may include, in particular:

Adequacy decisions of the European Commission;
Standard contractual clauses of the European Commission;
Additional technical or organizational safeguards;
Other legally permissible transfer mechanisms;
Your explicit consent, if legally permissible in individual cases.

You can contact us to obtain further information about the safeguards used for a specific data transfer.

11. Storage Duration

We store personal data only for as long as necessary for the respective processing purposes or as long as statutory retention obligations exist.

In particular, the following criteria generally apply:

Order, invoice, payment, and transaction data are stored for the duration of the applicable tax, commercial, and accounting retention obligations;
Data on returns, refunds, and warranty cases are stored for the processing of the case and subsequently for the duration of possible legal claims;
Customer service communication is stored for as long as necessary to process the request, ensure quality, and protect legal interests;
Marketing data is stored until consent is withdrawn, an objection is raised, or the processing purpose ceases to apply;
Cookie consents and corresponding evidence are stored for as long as necessary to prove consent and fulfill legal obligations;
Technical security and fraud prevention data are stored for the period required to investigate and prevent security risks or fraud cases;
Data relating to legal disputes may be stored until the final conclusion of the proceedings and until the expiry of the applicable limitation periods.

After the respective storage period has expired, the data will be deleted or anonymized, unless there is another legal basis for its storage.

12. Data Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, and destruction.

Possible protective measures include, in particular:

Access restrictions;
Encrypted data transmission;
Security and authorization concepts;
Fraud and misuse detection;
Contractual obligations of our service providers;
Regular review of technical and organizational protective measures.

However, no electronic transmission or storage system can guarantee absolute security.

If you use a customer account, you are responsible for keeping your access data confidential and not sharing it with third parties.

13. Children's Data

Our website and services are not directed at children.

We do not knowingly collect personal data from children who cannot effectively consent to processing or enter into a purchase agreement under applicable law.

If you, as a parent or guardian, believe that a child has provided us with personal data without the necessary consent, please contact us at contact@myalmapure.com.

We will investigate the request and delete the data in question, unless there is a legal obligation or other legal basis for its continued storage.

14. Your Data Protection Rights

To the extent that the legal requirements are met, you have the following rights in particular:

Right to information about your personal data;
Right to rectification of inaccurate or incomplete data;
Right to erasure of your data;
Right to restriction of processing;
Right to data portability;
Right to object to processing based on a legitimate interest;
Right to object to direct marketing at any time;
Right to withdraw a granted consent with effect for the future;
Right to information about appropriate safeguards in international data transfers;
Right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, where the legal requirements are met.

The exercise of these rights is subject to legal requirements and exceptions.

For example, there is no right to erasure if storage is necessary to fulfill legal retention obligations, for fraud prevention, for contract fulfillment, or for the establishment, exercise or defense of legal claims.

To exercise your rights, please contact us at:

contact@myalmapure.com

To protect your data, we may request information reasonably necessary to verify your identity and your authorization to make the request.

Manifestly unfounded or excessive requests, particularly in the event of frequent repetition, may be refused or made dependent on the payment of a reasonable fee in accordance with legal provisions.

15. Right to Object

If we process your personal data on the basis of Article 6 (1) (e) or (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.

We will then generally no longer process the data concerned, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

If personal data is processed for direct marketing purposes, you can object to this processing at any time. After your objection, the data will no longer be used for direct marketing.

16. Automated Decision-Making

We may use automated systems for fraud prevention, security checks, or risk assessment of transactions.

To the extent that a decision is based solely on automated processing and produces legal effects concerning you or similarly significantly affects you, the legal safeguards apply.

This may include, in particular, the right to human intervention, the right to express one's point of view, and the right to challenge the decision.

Not every automated security or fraud check constitutes such a legally significant automated decision.

17. Complaints

For questions or complaints regarding the processing of your personal data, you can contact us initially at the following address:

contact@myalmapure.com

Regardless, you have the right to lodge a complaint with a data protection supervisory authority.

You can contact, in particular, the supervisory authority of your usual place of residence, your workplace, or the place of the alleged data protection violation.

18. Links and Third-Party Services

Our website may contain links to websites, applications, social networks, or services of third parties.

We do not control these external services and are not responsible for their content, data protection practices, or security measures.

If you use an external website or service, the data protection provisions of the respective provider apply.

We recommend reading the relevant data protection information before submitting personal data to a third party.

19. Changes to this Privacy Policy

We may update this Privacy Policy regularly, in particular due to:

legal or regulatory changes;
changes to our services;
the use of new technical providers;
changes in our processing practices;
organizational or business changes.

The current version will be published on this page. The date of the last update will be indicated at the beginning of this Privacy Policy.

20. Contact

For questions, requests, or communications related to this Privacy Policy or the processing of your personal data, you can reach us at: