Spring naar de hoofdinhoud

Privacybeleid

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications, and within external online presences such as our social media profiles (hereinafter collectively referred to as the "online offering").

The terms used are not gender-specific.

Table of Contents

Controller

COSLINE Cosmetics GmbH
Am Reichenbach 1b
79249 Merzhausen
Germany

Email address: info@cosline.de Phone: +49 (0)761 / 870 703 - 0

Overview of Processing

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of Data Processed

  • Inventory data.
  • Payment data.
  • Contact data.
  • Content data.
  • Contract data.
  • Usage data.
  • Meta, communication, and procedural data.
  • Contact information (Facebook).
  • Event data (Facebook).

Categories of Data Subjects

  • Customers.
  • Interested parties.
  • Communication partners.
  • Users.
  • Business and contractual partners.

Purposes of Processing

  • Provision of contractual services and fulfillment of contractual obligations.
  • Contact inquiries and communication.
  • Security measures.
  • Direct marketing.
  • Reach measurement.
  • Tracking.
  • Office and organizational procedures.
  • Remarketing.
  • Conversion measurement.
  • Click tracking.
  • Audience creation.
  • Management and response to inquiries.
  • Feedback.
  • Marketing.
  • Profiles with user-related information.
  • Cross-device tracking.
  • Provision of our online offering and user-friendliness.
  • Information technology infrastructure.

Relevant Legal Bases

Relevant legal bases under the GDPR: The following provides an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence. If more specific legal bases are applicable in individual cases, we will inform you of them in this privacy policy.

  • Consent (Art. 6 para. 1 sentence 1 lit. a GDPR) - The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR) - Processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. This includes, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains specific provisions regarding the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission as well as automated individual decision-making, including profiling. Furthermore, data protection laws of individual German federal states may apply.

Relevant legal bases under the Swiss Data Protection Act: If you are located in Switzerland, we process your data based on the Federal Act on Data Protection (abbreviated "Swiss DPA"). This also applies if our processing of your data otherwise affects you in Switzerland and you are impacted by the processing. The Swiss DPA generally does not require (unlike, for example, the GDPR) that a legal basis for the processing of personal data be specified. We only process personal data when the processing is lawful, carried out in good faith, and proportionate (Art. 6 para. 1 and 2 of the Swiss DPA). Furthermore, we collect personal data only for specific and clearly identifiable purposes for the data subject and process it only in a manner that is compatible with those purposes (Art. 6 para. 3 of the Swiss DPA).

Notice on the applicability of the GDPR and the Swiss DPA: These privacy notices serve to provide information in accordance with both the Swiss Federal Act on Data Protection (Swiss DPA) and the General Data Protection Regulation (GDPR). For this reason, please note that the terminology of the GDPR is used for broader territorial applicability and better comprehensibility. In particular, instead of the terms used in the Swiss DPA such as "processing" of "personal data," "overriding interest," and "particularly sensitive personal data," the terms used in the GDPR — "processing" of "personal data," "legitimate interest," and "special categories of data" — are applied. However, the legal meaning of the terms continues to be determined according to the Swiss DPA within its scope of application.

Security Measures

In accordance with legal requirements and taking into account the state of the art, implementation costs, as well as the nature, scope, circumstances, and purposes of the processing, and the varying likelihood and severity of risks to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling both physical and electronic access to the data, as well as access, input, transmission, availability, and separation of the data. In addition, we have implemented procedures to ensure the exercise of data subjects’ rights, the deletion of data, and responses to data breaches. Furthermore, we take the protection of personal data into account during the development or selection of hardware, software, and processes in accordance with the principle of data protection through technology design and privacy-friendly default settings.

TLS/SSL encryption (https): To protect users’ data transmitted via our online services, we use TLS/SSL encryption. Secure Sockets Layer (SSL) is the standard technology for securing internet connections by encrypting the data transmitted between a website or app and a browser (or between two servers). Transport Layer Security (TLS) is an updated and more secure version of SSL. Hyper Text Transfer Protocol Secure (HTTPS) appears in the URL when a website is secured by an SSL/TLS certificate.

Transmission of Personal Data

As part of our processing of personal data, it may occur that data is transmitted to other entities, companies, legally independent organizational units, or individuals, or that it is disclosed to them. Recipients of such data may include, for example, service providers commissioned with IT tasks or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data to ensure its protection.

International Data Transfers

Data processing in third countries: If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if the processing occurs in the context of using third-party services, or through the disclosure or transfer of data to other persons, entities, or companies, this is done only in accordance with legal requirements. Where an adequate level of data protection has been recognized for the third country by means of an adequacy decision (Art. 45 GDPR), this serves as the basis for the data transfer. Otherwise, data transfers take place only when an adequate level of data protection is otherwise ensured, in particular through standard contractual clauses (Art. 46 para. 2 lit. c) GDPR), explicit consent, or in cases of contractual or legally required transmission (Art. 49 para. 1 GDPR). Furthermore, we inform you of the basis for third-country transfers for each respective provider from a third country, with adequacy decisions taking precedence as the primary basis. Information on third-country transfers and existing adequacy decisions can be found on the website of the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

EU-US Trans-Atlantic Data Privacy Framework: As part of the so-called "Data Privacy Framework" (DPF), the EU Commission has also recognized the level of data protection as adequate for certain companies in the United States through its adequacy decision of July 10, 2023. The list of certified companies, as well as further information about the DPF, can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/ (in English). In our privacy notices, we inform you which of the service providers we use are certified under the Data Privacy Framework.

Disclosure of personal data abroad: In accordance with the Swiss Data Protection Act (DPA), we only disclose personal data abroad if adequate protection of the affected individuals is ensured (Art. 16 Swiss DPA). If the Federal Council has not determined that adequate protection exists (list: https://www.bj.admin.ch/bj/de/home/staat/datenschutz/internationales/anerkennung-staaten.html), we implement alternative security measures. These may include international treaties, specific guarantees, data protection clauses in contracts, standard data protection clauses approved by the Swiss Federal Data Protection and Information Commissioner (FDPIC), or binding corporate rules that have been previously recognized by the FDPIC or another competent data protection authority of another country.

According to Art. 16 of the Swiss DPA, exceptions for the disclosure of data abroad may be permitted if certain conditions are met, including the consent of the data subject, performance of a contract, public interest, protection of life or physical integrity, publicly available data, or data from a legally prescribed register. Such disclosures are always made in compliance with legal requirements.

Deletion of Data

The data we process is deleted in accordance with legal requirements as soon as the consent allowing its processing is revoked or other permissions no longer apply (e.g., when the purpose of the processing no longer exists or the data is no longer necessary for that purpose). If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to those purposes. This means the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons, or whose storage is necessary for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person. Within our privacy notices, we may provide users with further information regarding the deletion and retention of data that specifically apply to the respective processing operations.

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject under the GDPR, you have various rights, in particular those arising from Articles 15 to 21 of the GDPR:

  • Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data that is carried out on the basis of Article 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling insofar as it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw consent that you have previously given at any time.
  • Right of access: You have the right to obtain confirmation as to whether or not data concerning you is being processed, and, where that is the case, access to the data and additional information as well as a copy of the data in accordance with legal requirements.
  • Right to rectification: In accordance with legal requirements, you have the right to request the completion of data concerning you or the correction of inaccurate data concerning you.
  • Right to erasure and restriction of processing: In accordance with legal requirements, you have the right to request the immediate deletion of data concerning you, or alternatively, to request the restriction of the processing of such data in accordance with legal requirements.
  • Right to data portability: You have the right to receive the data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller, in accordance with legal requirements.
  • Right to lodge a complaint with a supervisory authority: In accordance with legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular the authority in the Member State where you usually reside, your place of work, or the place of the alleged infringement, if you believe that the processing of personal data relating to you violates the GDPR.

Rights of data subjects under the Swiss DPA:

As a data subject, you have the following rights under the provisions of the Swiss Data Protection Act (DPA):

  • Right of access: You have the right to request confirmation as to whether personal data concerning you is being processed and to receive the information necessary to exercise your rights under this law and to ensure transparent data processing.
  • Right to data release or transfer: You have the right to request the release of your personal data that you have provided to us in a commonly used electronic format.
  • Right to rectification: You have the right to request the correction of inaccurate personal data concerning you.
  • Right to object, erasure, and destruction: You have the right to object to the processing of your data and to request that personal data concerning you be deleted or destroyed.

Use of Cookies

Cookies are small text files or other memory markers that store information on end devices and read information from them. For example, they can store the login status of a user account, the contents of a shopping cart in an online store, the accessed content, or the functions used in an online service. Cookies can also serve various purposes, such as ensuring the functionality, security, and convenience of online offerings, as well as generating analyses of visitor behavior.

Notes on consent: We use cookies in accordance with legal requirements. Therefore, we obtain prior consent from users unless this is not legally required. Consent is not necessary in particular when the storage and reading of information, including cookies, are strictly necessary to provide users with a telemedia service (i.e., our online offering) that they have explicitly requested. Strictly necessary cookies generally include those that serve purposes such as displaying and operating the online offering, load balancing, security, storing user preferences and options, or similar purposes related to the provision of the main and ancillary functions of the online service requested by users. Revocable consent is clearly communicated to users and includes information about the respective cookie use.

Notes on data protection legal bases: The legal basis on which we process users’ personal data using cookies depends on whether we ask users for consent. If users give their consent, the legal basis for processing their data is the declared consent. Otherwise, data processed through cookies is based on our legitimate interests (e.g., in the efficient operation of our online offering and the improvement of its usability) or, if necessary for the performance of our contractual obligations, when the use of cookies is required to fulfill our contractual duties. The specific purposes for which we process cookies are explained in the course of this privacy policy or within our consent and processing procedures.

Storage duration: With regard to the storage duration, the following types of cookies are distinguished:

  • Temporary cookies (also known as session cookies): Temporary cookies are deleted at the latest after a user leaves an online service and closes their end device (e.g., browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status can be saved, or preferred content can be displayed directly when the user revisits a website. Likewise, data collected from users via cookies can be used for reach measurement. Unless we explicitly inform users of the type and storage duration of cookies (e.g., when obtaining consent), users should assume that cookies are permanent and may be stored for up to two years.

General information on withdrawal and objection (so-called "opt-out"): Users may withdraw their consent at any time and object to the processing in accordance with legal requirements. Among other options, users can restrict the use of cookies in their browser settings (although this may limit the functionality of our online offering). An objection to the use of cookies for online marketing purposes can also be declared via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

  • Types of data processed: Usage data (e.g., websites visited, interest in content, access times).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of our online offering and user-friendliness.
  • Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Further information on processing activities, procedures, and services:

  • Processing of cookie data based on consent: We use a consent management procedure to obtain, record, manage, and revoke consent — in particular, for the use of cookies and similar technologies for storing, reading, and processing information on users’ end devices, as well as for the subsequent processing of such data. Within this framework, users’ consent to the use of cookies or to the processing operations and providers specified in the consent management procedure can be obtained, managed, and revoked. The consent declaration is stored to avoid repeated requests and to provide proof of consent in accordance with legal obligations. Storage may take place server-side and/or in a cookie (so-called opt-in cookie or using comparable technologies) to assign consent to a user or their device. Unless otherwise specified by individual cookie management service providers, the following applies: the duration of consent storage can be up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information on the scope of consent (e.g., which categories of cookies and/or service providers), as well as the browser, system, and end device used; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).
  • Pandectes GDPR Compliance: Consent management: procedure for obtaining, recording, managing, and revoking consent, in particular for the use of cookies and similar technologies for storing, reading, and processing information on users’ end devices, as well as for their processing; Service provider: Pandectes, Pudisoo küla, Männimäe/1, 74626, Kuusalu vald, Estonia; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://pandectes.io/. Privacy policy: https://pandectes.io/privacy-policy/.

Business Services

We process data from our contractual and business partners, e.g., customers and prospective clients (collectively referred to as "contractual partners"), within the framework of contractual and comparable legal relationships, as well as related measures and communications with the contractual partners (including pre-contractual communication), e.g., to respond to inquiries.

We process this data to fulfill our contractual obligations. This includes, in particular, obligations to provide the agreed services, any update obligations, and remedies for warranty and other performance issues. In addition, we process the data to protect our rights and for administrative purposes associated with these obligations and the organization of our business. Furthermore, we process the data based on our legitimate interests in proper and economically efficient business management, as well as in implementing security measures to protect our contractual partners and our business operations from misuse and the endangerment of their data, secrets, information, and rights (e.g., by involving telecommunications, transport, and other auxiliary services, subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). In accordance with applicable law, we only disclose data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed about further forms of processing, e.g., for marketing purposes, within this privacy policy.

We inform contractual partners which data is required for the aforementioned purposes prior to or during data collection, e.g., in online forms, through specific markings (such as colors) or symbols (such as asterisks or similar), or in person.

We delete the data after the expiration of statutory warranty and comparable obligations, i.e., generally after four years, unless the data is stored in a customer account—for example, as long as it must be retained for statutory archiving purposes. The statutory retention period for tax-relevant documents as well as for commercial books, inventories, opening balances, annual financial statements, work instructions, and other organizational documents and accounting records required to understand these documents is ten years, while for received commercial and business letters and copies of sent commercial and business letters it is six years. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, opening balance, annual financial statement, or management report was prepared, the commercial or business letter was received or sent, the accounting record was created, or the recording or other documents originated.

If we use third-party providers or platforms to provide our services, the terms and conditions and privacy policies of the respective third-party providers or platforms apply in the relationship between users and the providers.

  • Types of data processed: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contact data (e.g., email addresses, phone numbers); contract data (e.g., contract subject, duration, customer category); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Data subjects: Customers; prospective clients; business and contractual partners.
  • Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; security measures; inquiries and communication; office and administrative procedures; management and response to inquiries; conversion measurement (evaluation of the effectiveness of marketing activities); profiling with user-related information (creation of user profiles).
  • Legal bases: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing activities, procedures, and services:

  • Customer account: Customers can create an account within our online offering (e.g., customer or user account, hereinafter referred to as “customer account”). If the registration of a customer account is required, customers are informed of this as well as of the information necessary for registration. Customer accounts are not public and cannot be indexed by search engines. As part of the registration process and subsequent logins and use of the customer account, we store the customers’ IP addresses together with the access times in order to be able to verify the registration and prevent misuse of the customer account. If the customer account is terminated, the data in the customer account will be deleted after the termination date, unless it must be retained for purposes other than providing the customer account or must be kept for legal reasons (e.g., internal storage of customer data, order processes, or invoices). It is the responsibility of customers to back up their data when terminating the customer account; Legal basis: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).
  • Economic analyses and market research: For business management reasons and to identify market trends and the needs of contractual partners and users, we analyze the data available to us regarding business transactions, contracts, inquiries, etc. The affected groups may include contractual partners, prospective clients, customers, visitors, and users of our online offering. The analyses are conducted for the purpose of business evaluations, marketing, and market research (e.g., to determine customer groups with different characteristics). Where available, we may consider the profiles of registered users along with their provided information, such as the services they have used. The analyses are intended solely for our internal use and are not disclosed externally unless they consist of aggregated, anonymous data. Furthermore, we respect the privacy of users and process data for analytical purposes as pseudonymously as possible and, where feasible, anonymously (e.g., in aggregated form); Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • Online shop, order forms, e-commerce, and delivery: We process our customers’ data to enable them to select, purchase, or order the chosen products, goods, and related services, as well as to handle their payment and delivery or execution. Where necessary for the fulfillment of an order, we use service providers, in particular postal, freight, and shipping companies, to carry out the delivery or execution for our customers. For payment processing, we use the services of banks and payment service providers. The required information is identified as such in the ordering or comparable acquisition process and includes the data necessary for delivery, provision, and billing, as well as contact information to allow for any follow-up communication; Legal basis: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Use of Online Platforms for Offering and Sales Purposes

We offer our services on online platforms operated by other service providers. In this context, the privacy policies of the respective platforms apply in addition to our own privacy policy. This is particularly relevant with regard to payment processing and the measurement and interest-based marketing methods used on the platforms.

  • Types of data processed: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contact data (e.g., email addresses, phone numbers); contract data (e.g., contract subject, duration, customer category); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Data subjects: Customers.
  • Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; marketing.
  • Legal bases: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing activities, procedures, and services:

  • Shopify: Platform through which e-commerce services are offered and conducted. The services and related processes include, in particular, online shops, websites, their offerings and content, community elements, purchasing and payment processes, customer communication, as well as analytics and marketing; Service provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.shopify.com/de/. Privacy policy: https://www.shopify.com/de/legal/datenschutz.

Providers and Services Used in the Course of Business Activities

In the course of our business activities, we use, in compliance with legal requirements, additional services, platforms, interfaces, or plug-ins from third-party providers (collectively referred to as “services”). Their use is based on our interests in the proper, lawful, and efficient management of our business operations and internal organization.

  • Types of data processed: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contact data (e.g., email addresses, phone numbers); content data (e.g., entries in online forms); contract data (e.g., contract subject, duration, customer category); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Data subjects: Customers; prospective clients; users (e.g., website visitors, users of online services); business and contractual partners; communication partners.
  • Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; office and administrative procedures; inquiries and communication; management and response to requests; marketing; provision of our online offering and user-friendliness.
  • Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing activities, procedures, and services:

  • Xentral: Order processing, payment reconciliation, inventory management, and customer data administration; Service provider: Xentral ERP Software GmbH, Fuggerstraße 11,
    86150 Augsburg, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://xentral.com/de; Privacy policy: https://xentral.com/de/legal/datenschutz.
  • Bundle Bear: Creation of bundle offers and discounts; Service provider: Conversion Bear, Israel; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.conversionbear.com/; Privacy policy: https://www.conversionbear.com/privacy-policy.
  • ChatGPT Plus: AI-based service designed to understand and generate natural language and related inputs and data, analyze information, and make predictions ("AI", i.e., "Artificial Intelligence", is to be understood in the legally applicable sense of the term); Service provider: OpenAI Ireland Ltd, 117-126 Sheriff Street Upper, D01 YC43 Dublin 1, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://openai.com/product; Privacy policy: https://openai.com/de/policies/eu-privacy-policy. Opt-out option: https://docs.google.com/forms/d/e/1FAIpQLSevgtKyiSWIOj6CV6XWBHl1daPZSOcIWzcUYUXQ1xttjBgDpA/viewform.
  • EasyDHL: Returns processing and parcel shipments; Service provider: 247APPS UG (haftungsbeschränkt), In der Goldgrube 28, 56073 Koblenz, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://247apps.dev/apps/easydhl; Privacy policy: https://247apps.dev/datenschutz.
  • Loox: Creation of testimonials, customer experience and review reports, as well as a customer reward system; Service provider: Loox Online Ltd., Rehov Har Sinai 2, 6581602 Tel Aviv-Yafo, Israel; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://loox.app/; Privacy policy: https://loox.io/legal/privacy_policy_users.pdf.
  • Ordersify Product Alerts: Instant notifications when products are back in stock; Service provider: Execution on Shopify servers; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://ordersify.com/.
  • Post & DHL Shipping: Logistics company providing shipping and delivery services. We share certain personal data with DHL to enable the shipment and delivery of parcels, as well as shipment tracking and recipient notifications. This information may include the recipient’s name, address, and contact details; Service provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: http://www.dhl.com/; Privacy policy: https://www.dhl.com/de-de/home/fusszeile/datenschutzhinweis.html.
  • POWR Contact Form Builder: Creation of online forms and collection of user responses; Service provider: POWR Inc., 44 Tehama St, San Francisco, CA 94110, USA; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.powr.io/; Privacy policy: https://www.powr.io/privacy.
  • Swiss Customs Clearance: Interface for transferring order and customer data to MeinEinkauf.ch for customs clearance and order fulfillment; Service provider: TFTW GmbH, Hochstrasse 83, 4053 Basel, Switzerland; Website: https://www.tftw.ch/; Privacy policy: https://www.tftw.ch/disclaimer.
  • Wishlist Hero: Wishlist creation within the customer account; Service provider: Revamp Consulting Ltd., 23 Elbatrawy Street, Al Manteqah Al Oula, Nasr City, Cairo, Governorate 4450153, Egypt; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.revampco.com/wishlist-hero/; Privacy policy: https://www.revampco.com/privacy-policy/.

Payment Methods

As part of contractual and other legal relationships, due to legal obligations, or based on our legitimate interests, we offer data subjects efficient and secure payment options and, in addition to banks and credit institutions, use other service providers for this purpose (collectively referred to as "payment service providers").

The data processed by payment service providers includes inventory data such as name and address, banking information such as account numbers or credit card numbers, passwords, TANs, and checksums, as well as contract-, amount-, and recipient-related details. This information is necessary to carry out the transactions. However, the entered data is processed and stored only by the respective payment service providers. This means we do not receive any account or credit card information, but only information confirming or rejecting the payment. In some cases, payment service providers may transmit data to credit agencies. This transmission serves the purpose of identity and creditworthiness verification. For more information, please refer to the terms and conditions and privacy policies of the respective payment service providers.

The terms and conditions and privacy policies of the respective payment service providers apply to payment transactions and can be accessed on their respective websites or within their transaction applications. We also refer to these sources for further information and for exercising rights of withdrawal, access, and other data subject rights.

  • Types of data processed: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contract data (e.g., contract subject, duration, customer category); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Data subjects: Customers; prospective clients.
  • Purposes of processing: Provision of contractual services and fulfillment of contractual obligations.
  • Legal basis: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Further information on processing activities, procedures, and services:

  • Amazon Payments: Payment services (technical integration of online payment methods); Service provider: Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg; Legal basis: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Website: https://pay.amazon.de/; Privacy policy: https://pay.amazon.de/help/201212490.
  • Klarna: Payment services (technical integration of online payment methods); Service provider: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden; Legal basis: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Website: https://www.klarna.com/de; Privacy policy: https://www.klarna.com/de/datenschutz.
  • PayPal: Payment services (technical integration of online payment methods) (e.g., PayPal, PayPal Plus, Braintree); Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Legal basis: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); Website: https://www.paypal.com/de; Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Provision of the Online Offering and Web Hosting

We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or end device.

  • Types of data processed: Usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices such as computers and servers); security measures.
  • Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing activities, procedures, and services:

  • Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files.” Server log files may include the address and name of the accessed web pages and files, date and time of access, amount of data transferred, message about successful retrieval, browser type and version, user’s operating system, referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. Server log files may be used for security purposes, e.g., to prevent server overload (particularly in cases of abusive attacks such as DDoS attacks), and also to ensure server utilization and stability; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Data deletion: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data that must be retained for evidentiary purposes is excluded from deletion until the incident is finally resolved.
  • Hetzner: Services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacity); Service provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.hetzner.com; Privacy policy: https://www.hetzner.com/de/rechtliches/datenschutz; Data processing agreement: https://docs.hetzner.com/de/general/general-terms-and-conditions/data-privacy-faq/.

Blogs and Publication Media

We use blogs or comparable means of online communication and publication (hereinafter referred to as "publication medium"). The data of readers is processed for the purposes of the publication medium only to the extent necessary for its presentation and for communication between authors and readers or for security reasons. Otherwise, we refer to the information on the processing of visitors to our publication medium as outlined in this privacy notice.

  • Types of data processed: Inventory data (e.g., names, addresses); contact data (e.g., email addresses, phone numbers); content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; feedback (e.g., collecting feedback via online forms); provision of our online offering and user-friendliness; security measures; management and response to inquiries.
  • Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing activities, procedures, and services:

  • Comments and posts: When users leave comments or other contributions, their IP addresses may be stored based on our legitimate interests. This is for our security in case someone leaves unlawful content in comments or posts (e.g., insults, prohibited political propaganda, etc.). In such cases, we ourselves could be held liable for the comment or post and therefore have an interest in the identity of the author.

    Furthermore, we reserve the right to process users’ information based on our legitimate interests for the purpose of spam detection.

    On the same legal basis, we also reserve the right, in the case of surveys, to store users’ IP addresses for the duration of the survey and to use cookies to prevent multiple voting.

    The personal information provided within comments and posts, including any contact or website details, as well as the content itself, will be stored by us permanently until users object; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Contact and Inquiry Management

When contacting us (e.g., by mail, contact form, email, telephone, or via social media) and in the context of existing user and business relationships, the data of the inquiring persons is processed to the extent necessary to respond to the contact inquiries and any requested measures.

  • Types of data processed: Contact data (e.g., email addresses, phone numbers); content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status); inventory data (e.g., names, addresses); contract data (e.g., contract subject, duration, customer category).
  • Data subjects: Communication partners; customers; prospective clients; business and contractual partners.
  • Purposes of processing: Inquiries and communication; management and response to requests; feedback (e.g., collecting feedback via online forms); provision of our online offering and user-friendliness; performance of contractual services and fulfillment of contractual obligations; marketing.
  • Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR).

Further information on processing activities, procedures, and services:

  • Contact form: When users contact us via our contact form, email, or other communication channels, we process the data provided in this context to handle the communicated concern; Legal basis: Performance of contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • Wowing: Creation of personalized video messages, analysis of interactions with these videos, management of contact data and communication processes; Service provider: Wowing GmbH, Europastr. 12, 72622 Nürtingen, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://wowing.com/; Privacy policy: https://wowing.com/datenschutz/; Data processing agreement: Provided by the service provider.

Communication via Messenger

We use messengers for communication purposes and therefore ask you to take note of the following information regarding the functionality of the messengers, encryption, the use of communication metadata, and your right to object.

You can also contact us through alternative means, e.g., by phone or email. Please use the contact options provided to you or those listed within our online offering.

In the case of end-to-end encryption of content (i.e., the content of your message and attachments), we point out that the communication content (i.e., the message text and attached images) is encrypted end-to-end. This means that the content of the messages cannot be viewed, not even by the messenger providers themselves. You should always use an up-to-date version of the messenger with encryption enabled to ensure that message content remains encrypted.

However, we also inform our communication partners that while the messenger providers cannot view the content, they may still be able to determine that and when communication partners are interacting with us and may process technical information about the communication partners’ devices and, depending on the settings of their device, also location information (so-called metadata).

Notes on legal bases: If we ask communication partners for permission before communicating with them via messenger, the legal basis for processing their data is their consent. Otherwise, if we do not request consent and they contact us on their own initiative, we use messengers in relation to our contractual partners and in the context of contract initiation as a contractual measure, and in the case of other interested parties and communication partners, based on our legitimate interests in fast and efficient communication and in meeting our communication partners’ needs for messenger-based communication. Furthermore, we inform you that we do not transmit your contact details to the messengers for the first time without your consent.

Withdrawal, objection, and deletion: You may withdraw your consent at any time and object to communication with us via messenger at any time. In the case of communication via messenger, we delete messages in accordance with our general deletion policies (i.e., for example, as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise as soon as we can assume that we have answered any inquiries from communication partners, that no reference to a previous conversation is to be expected, and that no statutory retention obligations prevent deletion.

Reservation of reference to other communication methods: Finally, we would like to point out that, for your safety, we reserve the right not to respond to inquiries via messenger. This applies, for example, if contract-related information requires special confidentiality or if a response via messenger does not meet formal requirements. In such cases, we will refer you to more appropriate communication channels.

  • Types of data processed: Contact data (e.g., email addresses, phone numbers); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Data subjects: Communication partners.
  • Purposes of processing: Inquiries and communication; direct marketing (e.g., by email or postal mail); reach measurement (e.g., access statistics, recognition of returning visitors); marketing; audience building.
  • Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing activities, procedures, and services:

  • WhatsApp: WhatsApp Messenger with end-to-end encryption; Service provider: WhatsApp Ireland Limited, 4 Grand Canal Quay, Dublin 2, D02 KH28, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.whatsapp.com/; Privacy policy: https://www.whatsapp.com/legal; Basis for third-country transfer: EU-US Data Privacy Framework (DPF).
  • chatarmin: Software for managing and conducting campaigns, sales activities, personalization, and communication with users via the WhatsApp platform; Service provider: chatarmin.com GmbH, Kaiserstraße 89, 1070 Vienna, Austria; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://chatarmin.com/; Privacy policy: https://chatarmin.com/privacy-policy.

Newsletter and Electronic Notifications

We send newsletters, emails, and other electronic notifications (hereinafter referred to as "newsletters") only with the consent of the recipients or based on legal permission. If the content of the newsletter is specifically described during the subscription process, it is decisive for the user’s consent. Otherwise, our newsletters contain information about our services and about us.

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for personalized addressing in the newsletter or other information if required for the purpose of the newsletter.

Double opt-in procedure: Subscription to our newsletter follows a so-called double opt-in procedure. This means that after signing up, you will receive an email asking you to confirm your subscription. This confirmation is necessary to prevent anyone from registering using someone else’s email address. Newsletter registrations are logged in order to verify the subscription process in accordance with legal requirements. This includes storing the time of registration and confirmation as well as the IP address. Changes to the data stored by the email service provider are also logged.

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them, to be able to prove prior consent. The processing of this data is limited to the purpose of possible defense against claims. An individual deletion request is possible at any time, provided that the existence of prior consent is confirmed at the same time. In cases where objections must be permanently observed, we reserve the right to store the email address solely for this purpose in a suppression list (so-called “blocklist”).

Logging of the subscription process is based on our legitimate interests for the purpose of verifying its proper execution. If we commission a service provider to send emails, this is done based on our legitimate interest in an efficient and secure mailing system.

Content:

Information about us, our services, promotions, and offers.

  • Types of data processed: Inventory data (e.g., names, addresses); contact data (e.g., email addresses, phone numbers); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status); usage data (e.g., websites visited, interest in content, access times).
  • Data subjects: Communication partners; users (e.g., website visitors, users of online services).
  • Purposes of processing: Direct marketing (e.g., by email or postal mail); provision of contractual services and fulfillment of contractual obligations.
  • Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • Opt-out option: You can unsubscribe from our newsletter at any time, i.e., withdraw your consent or object to further receipt. A link to unsubscribe is provided at the end of every newsletter, or you can contact us using one of the contact methods listed above, preferably via email.

Further information on processing activities, procedures, and services:

  • Condition for using free services: Consent to receive mailings may be required as a condition for accessing free services (e.g., access to certain content or participation in specific promotions). If users wish to use the free service without subscribing to the newsletter, we ask that they contact us directly.
  • Klick-Tipp: Service provider: KLICK-TIPP Ltd., 15 Cambridge Court, 210 Shepherd’s Bush Road, London W6 7NJ, UK; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.klick-tipp.com; Privacy policy: https://www.klick-tipp.com/datenschutzerkl%C3%A4rung.

Web Analysis, Monitoring, and Optimization

Web analysis (also referred to as "reach measurement") serves to evaluate the visitor traffic of our online offering and may include information about the behavior, interests, or demographic characteristics of visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, determine at what times our online offering or its functions or content are most frequently used or encourage repeated use. We can also identify which areas need improvement.

In addition to web analysis, we may also use testing procedures to, for example, test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles—i.e., data combined into a usage process—may be created for these purposes, and information may be stored in and retrieved from a browser or end device. The collected information includes, in particular, the websites visited and elements used there, as well as technical details such as the browser used, the computer system employed, and information about access times. If users have consented to the collection of their location data, either by us or by the providers of the services we use, location data may also be processed.

The IP addresses of users are also stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. In general, within the scope of web analysis, A/B testing, and optimization, no clear data of users (such as email addresses or names) is stored, but rather pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, only the information stored in their profiles for the purposes of the respective procedures.

  • Types of data processed: Usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Remarketing; audience building; reach measurement (e.g., access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles); provision of our online offering and user-friendliness.
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Further information on processing activities, procedures, and services:

  • Google Analytics 4: We use Google Analytics to measure and analyze the use of our online offering based on a pseudonymous user identification number. This identification number does not contain any unique data such as names or email addresses. It serves to assign analytical information to a device in order to identify which content users have accessed within one or multiple usage sessions, which search terms they have used, whether they have revisited certain pages, or how they have interacted with our online offering. The time and duration of usage, the sources referring users to our site, and technical details about users’ devices and browsers are also recorded. Pseudonymous user profiles may be created with information derived from the use of multiple devices, and cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides approximate geographic location data by deriving the following metadata from IP addresses: city (and the corresponding latitude and longitude of the city), continent, country, region, and subcontinent (and ID-based counterparts). For EU traffic, IP address data is used solely for this geolocation derivation before being immediately deleted. It is not logged, accessible, or used for any other purpose. When Google Analytics collects measurement data, all IP queries are handled on EU-based servers before the traffic is forwarded to Analytics servers for processing; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymization of the IP address); Privacy policy: https://policies.google.com/privacy; How Google uses personal data: https://business.safety.google/privacy/; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third-country transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms); Opt-out option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, ad personalization settings: https://myadcenter.google.com/personalizationoff; Further information: https://business.safety.google/adsservices/ (types of processing and processed data).
  • Notes on consent recipients: The consent granted by users within a consent dialog (also known as "cookie opt-in/consent," "cookie banner," etc.) serves multiple purposes. Firstly, it enables us to fulfill our obligation to obtain consent for the storage and retrieval of information on and from users’ devices (in accordance with the ePrivacy Directive). Secondly, it covers the processing of users’ personal data in compliance with data protection regulations. Additionally, this consent also applies to Google, as the company is required under the Digital Markets Act to obtain consent for personalized services. Therefore, we share the status of the consents granted by users with Google. Our consent management software informs Google whether consent has been granted or not. The goal is to ensure that the granted or withheld consents of users are taken into account when using Google Analytics and integrating functions and external services. This allows user consents and their withdrawal to be dynamically and contextually managed within Google Analytics and other Google services in our online offering; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://support.google.com/analytics/answer/9976101?hl=de; Privacy policy: https://policies.google.com/privacy; How Google uses personal data:

 

Online Marketing

We process personal data for the purposes of online marketing, which may include, in particular, the marketing of advertising space or the display of promotional and other content (collectively referred to as "content") based on users’ potential interests, as well as measuring their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (known as a "cookie"), or similar methods are used to store information relevant to the display of the aforementioned content. This information may include, for example, viewed content, visited websites, used online networks, as well as communication partners and technical details such as the browser used, the computer system employed, and information about usage times and utilized functions. If users have consented to the collection of their location data, such data may also be processed.

The IP addresses of users are also stored. However, we use available IP masking procedures (i.e., pseudonymization by shortening the IP address) to protect users. In general, within the framework of online marketing procedures, no plain data of users (such as email addresses or names) is stored, but rather pseudonyms. This means that neither we nor the providers of the online marketing procedures know the actual identity of the users, only the information stored in their profiles.

The information in the profiles is usually stored in cookies or through similar technologies. These cookies can later generally be read on other websites that use the same online marketing procedure, analyzed for the purpose of displaying content, and supplemented with additional data, which may then be stored on the server of the provider of the online marketing procedure.

In exceptional cases, plain data may be assigned to profiles. This is the case, for example, when users are members of a social network whose online marketing tools we use and the network links users’ profiles with the aforementioned data. We ask users to note that they may make additional agreements with the providers, e.g., by granting consent during registration.

We generally only receive access to aggregated information about the success of our advertisements. However, within the framework of so-called conversion measurements, we can determine which of our online marketing measures have led to a so-called conversion, i.e., for example, to a contract conclusion with us. Conversion measurement is used solely to analyze the success of our marketing activities.

Unless otherwise stated, please assume that the cookies used are stored for a period of two years.

  • Types of data processed: Content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status); event data (Facebook) ("Event data" refers to data that may be transmitted by us to Facebook via the Facebook Pixel (through apps or other means) and that relates to individuals or their actions; such data may include information about visits to websites, interactions with content, use of features, app installations, product purchases, etc. Event data is processed for the purpose of creating target groups for content and advertising information (Custom Audiences). Event data does not include the actual content (e.g., written comments), login information, or contact details (such as names, email addresses, and phone numbers). Event data is deleted by Facebook after a maximum of two years, as are the target groups created from it when our Facebook account is deleted.); contact information (Facebook) ("Contact information" refers to data that clearly identifies individuals, such as names, email addresses, and phone numbers, which may be transmitted to Facebook via the Facebook Pixel or upload for matching purposes in order to create Custom Audiences. After the matching process for audience creation, the contact information is deleted.).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Reach measurement (e.g., access statistics, recognition of returning visitors); tracking (e.g., interest-/behavior-based profiling, use of cookies); conversion measurement (measuring the effectiveness of marketing activities); audience creation; marketing; user profiling (creation of user profiles); provision of our online offering and user-friendliness; remarketing; click tracking; cross-device tracking (cross-device processing of user data for marketing purposes).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
  • Opt-out option: We refer to the privacy policies of the respective providers and the opt-out options provided by them. If no explicit opt-out option has been specified, you may disable cookies in your browser settings. However, this may limit the functionality of our online offering. Therefore, we additionally recommend the following opt-out options, which are offered collectively for different regions:

    a) Europe: https://www.youronlinechoices.eu.
    b) Canada: https://www.youradchoices.ca/choices.
    c) USA: https://www.aboutads.info/choices.
    d) Cross-regional: https://optout.aboutads.info.

Further information on processing activities, procedures, and services:

  • Meta Pixel and Audience Creation (Custom Audiences): With the help of the Meta Pixel (or comparable functions for transmitting event data or contact information via app interfaces), Meta can identify visitors to our online offering as a target group for displaying advertisements (so-called "Meta Ads"). Accordingly, we use the Meta Pixel to display the Meta Ads we place only to those users on Meta’s platforms and within the services of Meta’s partner networks (the so-called "Audience Network" https://www.facebook.com/audiencenetwork/) who have shown an interest in our online offering or who display certain characteristics (e.g., interest in specific topics or products inferred from visited websites) that we transmit to Meta (so-called "Custom Audiences"). With the help of the Meta Pixel, we also aim to ensure that our Meta Ads correspond to users’ potential interests and do not appear intrusive. The Meta Pixel also enables us to measure the effectiveness of our Meta Ads for statistical and market research purposes by tracking whether users were redirected to our website after clicking on a Meta Ad (so-called "conversion measurement"); Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Data processing agreement: https://www.facebook.com/legal/terms/dataprocessing; Basis for third-country transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum); Further information: User event data, i.e., behavioral and interest information, is processed for targeted advertising and audience creation purposes based on the joint controllership agreement ("Controller Addendum," https://www.facebook.com/legal/controller_addendum). The joint controllership is limited to the collection and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, particularly concerning the transfer of data to its parent company, Meta Platforms, Inc., in the USA (based on the Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
  • Advanced Matching for the Meta Pixel: In addition to processing event data when using the Meta Pixel (or comparable functions, e.g., in apps), contact information (personally identifiable data such as names, email addresses, and phone numbers) is also collected by Meta within our online offering or transmitted to Meta. The processing of contact information serves the creation of target audiences (so-called "Custom Audiences") for displaying content and advertising information based on users’ presumed interests. The collection, transmission, and matching with data already held by Meta do not occur in plain text but as so-called "hash values," which are mathematical representations of the data (this method is, for example, used for storing passwords). After the matching for the purpose of audience creation, the contact information is deleted; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Privacy policy: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Data processing agreement: https://www.facebook.com/legal/terms/dataprocessing; Basis for third-country transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum). Further information: https://www.facebook.com/legal/terms/data_security_terms.
  • Meta – Audience Creation via Data Upload: Audience creation for marketing purposes – We transmit contact information (names, email addresses, and phone numbers) in list form to Meta for the creation of target audiences (so-called "Custom Audiences") for displaying content and advertising information based on users’ presumed interests. The transmission and matching with data already held by Meta do not occur in plain text but as so-called "hash values," which are mathematical representations of the data (this method is, for example, used for storing passwords). After the matching for the purpose of audience creation, the contact information is deleted; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Data processing agreement: https://www.facebook.com/legal/terms/dataprocessing. Basis for third-country transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
  • Google Ad Manager: We use the "Google Ad Manager" service to place ads within the Google advertising network (e.g., in search results, videos, on websites, etc.). Google Ad Manager enables ads to be displayed in real time based on users’ presumed interests. This allows us to show ads for our online offering to users who may be potentially interested in our services or have shown prior interest, as well as to measure the performance of these ads; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; How Google uses personal data: https://business.safety.google/privacy/; Basis for third-country transfer: EU-US Data Privacy Framework (DPF); Further information: Types of processing and categories of processed data: https://business.safety.google/adsservices/; Data processing terms for Google advertising products: Information on controller-to-controller data processing terms and Standard Contractual Clauses for international data transfers: https://business.safety.google/adscontrollerterms; where Google acts as a processor, data processing terms for Google advertising products and Standard Contractual Clauses for international data transfers: https://business.safety.google/adsprocessorterms.
  • Google Ads and Conversion Tracking: Online marketing method used to place content and advertisements within the service provider’s advertising network (e.g., in search results, videos, on websites, etc.) so that they are displayed to users who are presumed to be interested in the ads. We also measure the conversion of the ads, i.e., whether users interact with the ads and take advantage of the promoted offers (so-called conversion). However, we only receive anonymized information and no personal data about individual users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; How Google uses personal data: https://business.safety.google/privacy/; Basis for third-country transfer: EU-US Data Privacy Framework (DPF); Further information: Types of processing and categories of processed data: https://business.safety.google/adsservices/; Data processing terms between controllers and Standard Contractual Clauses for international data transfers: https://business.safety.google/adscontrollerterms.
  • Pinterest Tag: Interest- and behavior-based measurement and analysis of user interactions with our online services (in particular page visits, search queries, transactions, video and page views, as well as time and duration) for the purpose of creating target audiences for displaying content and advertisements within the Pinterest platform and its advertising network partners; Service provider: Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://help.pinterest.com/en/business/article/track-conversions-with-pinterest-tag; Privacy policy: https://policy.pinterest.com/en/privacy-policy; Opt-out option: https://help.pinterest.com/en/article/personalized-ads-on-pinterest. Further information: Joint controllership agreement in the “Pinterest Advertising Services Agreement, Annex B: Pinterest Controller Addendum” https://business.pinterest.com/en/pinterest-advertising-services-agreement/.
  • TikTok Pixel: Code that is loaded when a user visits our online offering and tracks the user’s behavior and conversions while storing them in a profile (possible use cases: measuring campaign performance, optimizing ad delivery, building custom and lookalike audiences); Service provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, United Kingdom, EC1A 9HP; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://ads.tiktok.com/help/article/tiktok-pixel. Privacy policy: https://www.tiktok.com/en/privacy-policy.
  • mable: Conversion tracking and analysis of user behavior regarding usage and interests related to features and content as well as their duration of use based on a pseudonymous user identification number and profile creation; Service provider: Mable GmbH, Bahnhofplatz 12, 76137 Karlsruhe, Germany; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://de.mable.ai/; Privacy policy: https://www.mable.ai/privacy. Data processing agreement: Provided by the service provider.
  • Microsoft Clarity: Microsoft Clarity is a solution that allows us to measure and track interactions, heatmaps, and session recordings. These website movement data are stored in first- and third-party cookies. We use this data to optimize our online offering; Service provider: Microsoft Corporation, One Microsoft Way, Redmond WA 98052-6399, USA; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://clarity.microsoft.com/; Privacy policy: https://privacy.microsoft.com/en-us/privacystatement; Basis for data transfer to third countries: EU-US Data Privacy Framework (DPF): https://www.dataprivacyframework.gov/.
  • ablyft: ablyft is a solution that allows us to conduct A/B tests on the website in order to display different content to different users. For this purpose, we track and store website movement data in first- and third-party cookies. We use this data to optimize our online offering; Service provider: Conversion Expert GmbH, Zeppelinring 52c, 24146 Kiel, Germany; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://ablyft.com/; Privacy policy: https://ablyft.com/en/privacy-notice.

  • Klar! Insights - Attribution: We use the services of Klar Insights GmbH, Marktstr. 18, 80802 Munich, Germany, a SaaS provider for business intelligence solutions for eCommerce companies. Klar Insights GmbH collects, processes, and stores data (user and session IDs, IP address, online identifiers (cookie ID, device ID)) on this website and its subpages for reach measurement and statistical analysis on our behalf. For this purpose, we have concluded a data processing agreement with Klar Insights GmbH. The collection of personal data is based on the legal basis of consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR. If consent is given by the user, the data to be processed is collected in a user-related manner, taking into account § 25 para. 1 sentence 1 TDDDG. For the aforementioned different types of collection, the following cookies are used to ensure the respective type of collection: september_id september_has_consent september_do_not_track (in case of objection). Cookie - Objection To generally object to the use of Klar! Insights, please use this Link. This will set a cookie with the name "september_do_not_track" from the domain "cosline.de". Please do not delete this, otherwise it cannot be guaranteed that you will not be tracked by Klar. Information on data protection and data use by Klar can be found on the following website: https://app.getklar.com/legal/data-protection

Presence on Social Networks (Social Media)

We maintain online presences within social networks and, in this context, process user data in order to communicate with active users there or to provide information about us.

We point out that user data may be processed outside the European Union. This may pose risks for users, as it could, for example, make it more difficult to enforce their rights.

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles may be created based on user behavior and resulting interests. These usage profiles can, in turn, be used to display advertisements within and outside the networks that are presumably in line with the users’ interests. For these purposes, cookies are usually stored on users’ computers, which store their usage behavior and interests. Additionally, the usage profiles may also store data independent of the devices used by the users (especially if users are members of the respective platforms and logged in to them).

For detailed information on the respective processing methods and options for objection (opt-out), we refer to the privacy policies and information provided by the operators of the respective networks.

Even in the case of information requests and the exercise of data subject rights, we note that these can be most effectively asserted with the providers. Only the providers have access to user data and can directly take appropriate actions and provide information. However, if you need assistance, you can contact us.

  • Types of data processed: Contact data (e.g., email addresses, telephone numbers); content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Contact requests and communication; feedback (e.g., collecting feedback via online forms); marketing.
  • Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures, and services:

  • Instagram: Social network; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.instagram.com. Privacy policy: https://instagram.com/about/legal/privacy.
  • Facebook Pages: Profiles within the social network Facebook; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Basis for third-country transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum); Further information: We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data from visitors to our Facebook page (so-called "Fanpage"). This data includes information about the types of content users view or interact with or the actions they take (see "Things you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data; see "Device Information" in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under "How do we use this information?", Facebook also collects and uses information to provide analytics services, known as "Page Insights," to page operators, helping them understand how people interact with their pages and related content. We have entered into a specific agreement with Facebook ("Page Insights Information," https://www.facebook.com/legal/terms/page_controller_addendum), which outlines, among other things, the security measures Facebook must observe and Facebook's commitment to fulfilling data subject rights (i.e., users can, for example, direct access or deletion requests directly to Facebook). The rights of users (particularly to access, deletion, objection, and complaint to the competent supervisory authority) are not limited by the agreements with Facebook. Further information can be found in the "Page Insights Information" (https://www.facebook.com/legal/terms/information_about_page_insights_data). The joint responsibility is limited to the collection and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, particularly regarding the transfer of data to the parent company Meta Platforms, Inc. in the USA.
  • LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://de.linkedin.com/; Privacy policy: https://de.linkedin.com/legal/privacy-policy.
  • Pinterest: Social network; Service provider: Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.pinterest.com. Privacy policy: https://policy.pinterest.com/en/privacy-policy.
  • TikTok: Social network / video platform; Service provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, United Kingdom, EC1A 9HP; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.tiktok.com. Privacy policy: https://www.tiktok.com/en/privacy-policy.
  • X: Social network; Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Privacy policy: https://twitter.com/privacy, (Settings: https://twitter.com/personalization).
  • YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Privacy policy: https://policies.google.com/privacy; How Google uses personal data: https://business.safety.google/privacy/; Basis for third-country transfer: EU-US Data Privacy Framework (DPF). Opt-out option: https://myadcenter.google.com/personalizationoff.

Plugins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos, or maps (collectively referred to as “content”).

The integration always requires that the third-party providers of this content process the users’ IP address, as they could not send the content to their browsers without the IP address. The IP address is therefore necessary to display this content or functionality. We make every effort to use only content whose respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on the users’ device and may contain, among other things, technical information about the browser and operating system, referring websites, visit time, as well as other details about the use of our online offering, and may be linked to such information from other sources.

  • Types of data processed: Usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status); inventory data (e.g., names, addresses); contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); event data (Facebook) (“Event Data” refers to data that can be transmitted from us to Facebook via the Facebook Pixel (via apps or other means) and that relate to individuals or their actions; this includes, for example, information about visits to websites, interactions with content, functions, app installations, product purchases, etc. Event Data are processed to create target groups for content and advertising information (Custom Audiences). Event Data do not include actual content (such as written comments), login information, or contact details (i.e., no names, email addresses, or phone numbers). Event Data are deleted by Facebook after a maximum of two years, and the target groups derived from them are deleted upon deletion of our Facebook account).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of our online offering and user-friendliness; marketing; creation of user-related profiles (user profiling).
  • Legal basis: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures, and services:

  • Integration of third-party software, scripts, or frameworks (e.g., jQuery): We integrate software into our online offering that we retrieve from the servers of other providers (e.g., function libraries used to display or improve the user-friendliness of our online offering). The respective providers collect the users’ IP address and may process it to deliver the software to the users’ browser, for security purposes, and for the evaluation and optimization of their services; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
  • Facebook plugins and content: Facebook social plugins and content – these may include elements such as images, videos, text, and buttons that allow users to share content from this online offering within Facebook. The list and appearance of Facebook social plugins can be viewed here: https://developers.facebook.com/docs/plugins/. We are jointly responsible with Meta Platforms Ireland Limited for the collection or receipt (but not the further processing) of “Event Data” that Facebook collects through the Facebook social plugins (and embedded content functions) executed on our online offering or receives through a transfer for the following purposes: (a) displaying content and advertising information that match the presumed interests of users; (b) delivering commercial and transactional messages (e.g., addressing users via Facebook Messenger); (c) improving ad delivery and personalizing features and content (e.g., enhancing recognition of which content or advertising information likely corresponds to users’ interests). We have concluded a special agreement with Facebook (“Controller Addendum,” https://www.facebook.com/legal/controller_addendum), which sets out, in particular, the security measures Facebook must observe (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook agrees to fulfill data subject rights (i.e., users can, for example, direct information or deletion requests directly to Facebook). Note: When Facebook provides us with metrics, analyses, and reports (aggregated and anonymous, containing no user-specific data), this processing does not take place under joint controllership but based on a data processing agreement (“Data Processing Terms,” https://www.facebook.com/legal/terms/dataprocessing), the “Data Security Terms” (https://www.facebook.com/legal/terms/data_security_terms), and, regarding processing in the USA, on the basis of standard contractual clauses (“Facebook EU Data Transfer Addendum,” https://www.facebook.com/legal/EU_data_transfer_addendum). The rights of users (in particular access, deletion, objection, and complaints to competent supervisory authorities) remain unaffected by the agreements with Facebook; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/; Basis for third-country transfer: EU-US Data Privacy Framework (DPF).
  • Google Fonts (retrieved from Google server): Retrieval of fonts (and icons) for the purpose of technically secure, maintenance-free, and efficient use of fonts and icons with regard to their timeliness and loading times, their consistent display, and consideration of possible licensing restrictions. The provider of the fonts is informed of the user’s IP address so that the fonts can be provided in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) are transmitted, which are necessary to provide the fonts depending on the devices used and the technical environment. These data may be processed on a server of the font provider in the USA. When visiting our online offering, users’ browsers send their HTTP requests to the Google Fonts Web API (i.e., a software interface for retrieving fonts). The Google Fonts Web API provides users with the Cascading Style Sheets (CSS) of Google Fonts and then the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the user to access the Internet, (2) the requested URL on the Google server, and (3) the HTTP headers, including the user agent that describes the browser and operating system versions of the website visitors, as well as the referrer URL (i.e., the web page on which the Google Font is to be displayed). IP addresses are neither logged nor stored on Google servers and are not analyzed. The Google Fonts Web API logs details of the HTTP requests (requested URL, user agent, and referrer URL). Access to these data is restricted and strictly controlled. The requested URL identifies the font families the user wants to load. These data are logged so Google can determine how often a particular font family is requested. The Google Fonts Web API requires the user agent to customize the font generated for each browser type. The user agent is primarily logged for debugging and used to generate aggregated usage statistics that measure the popularity of font families. These aggregated statistics are published on the “Analytics” page of Google Fonts. Finally, the referrer URL is logged so that the data can be used for production maintenance and to generate an aggregated report of top integrations based on the number of font requests. According to Google, none of the information collected by Google Fonts is used to create user profiles or serve targeted ads; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://fonts.google.com/; Privacy policy: https://policies.google.com/privacy; Basis for third-country transfer: EU-US Data Privacy Framework (DPF). Further information: https://developers.google.com/fonts/faq/privacy?hl=de.
  • Instagram plugins and content: Instagram plugins and content – These may include elements such as images, videos, text, and buttons that allow users to share content from this online offering within Instagram. We are jointly responsible with Meta Platforms Ireland Limited for the collection or receipt (but not the further processing) of "Event Data" that Facebook collects through functions of Instagram (e.g., embedding functions for content) executed on our online offering, or receives through transmission for the following purposes: a) displaying content and advertising information that match the presumed interests of users; b) delivery of commercial and transactional messages (e.g., contacting users via Facebook Messenger); c) improving ad delivery and personalization of functions and content (e.g., improving recognition of which content or advertising information likely correspond to users' interests). We have concluded a special agreement with Facebook ("Controller Addendum," https://www.facebook.com/legal/controller_addendum), which specifies the security measures Facebook must observe (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook agrees to fulfill data subject rights (i.e., users can, for example, make access or deletion requests directly to Facebook). Note: When Facebook provides us with metrics, analyses, and reports (which are aggregated, i.e., contain no data about individual users and are anonymous for us), this processing does not take place under joint controllership but on the basis of a data processing agreement ("Data Processing Terms," https://www.facebook.com/legal/terms/dataprocessing), the “Data Security Terms” (https://www.facebook.com/legal/terms/data_security_terms), and, with regard to processing in the USA, on the basis of standard contractual clauses ("Facebook-EU Data Transfer Addendum," https://www.facebook.com/legal/EU_data_transfer_addendum). The rights of users (in particular the right of access, deletion, objection, and complaint to the competent supervisory authority) are not limited by the agreements with Facebook; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.instagram.com. Privacy policy: https://instagram.com/about/legal/privacy/.
  • Pinterest plugins and content: Pinterest plugins and content – These may include elements such as images, videos, texts, and buttons that allow users to share content from this online offering within Pinterest; Service provider: Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.pinterest.com; Privacy policy: https://about.pinterest.com/de/privacy-policy;
  • X plugins and content: Plugins and buttons of the “X” platform – These may include elements such as images, videos, texts, and buttons that allow users to share content from this online offering within X; Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://twitter.com/de; Privacy policy: https://twitter.com/de/privacy, (Settings: https://twitter.com/personalization); Data Processing Agreement: https://privacy.twitter.com/en/for-our-partners/global-dpa. Basis for third-country transfer: Standard Contractual Clauses (https://privacy.twitter.com/en/for-our-partners/global-dpa).
  • YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy; How Google uses personal data: https://business.safety.google/privacy/; Basis for third-country transfer: EU-US Data Privacy Framework (DPF). Opt-out option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, ad personalization settings: https://myadcenter.google.com/personalizationoff.
  • TikTok plugins and content: TikTok plugins and content – These may include elements such as images, videos, texts, and buttons; Service provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, United Kingdom, EC1A 9HP; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.tiktok.com. Privacy policy: https://www.tiktok.com/legal/privacy-policy?lang=de.

Amendments and Updates to This Privacy Policy

We ask that you regularly review the content of our privacy policy. We will update this privacy policy as soon as changes in our data processing activities make this necessary. We will inform you if such changes require any action on your part (e.g., consent) or any other individual notification.

If we provide addresses and contact details of companies and organizations in this privacy policy, please note that these addresses may change over time, and we ask you to verify the information before making contact.

Definitions of Terms

This section provides an overview of the terminology used in this privacy policy. Where terms are legally defined, those legal definitions apply. The following explanations are intended primarily to facilitate understanding.

  • Cross-device tracking: Cross-device tracking is a form of tracking in which behavioral and interest information of users is collected across devices in so-called profiles by assigning an online identifier to the users. This allows user information to be analyzed for marketing purposes regardless of the browsers or devices used (e.g., mobile phones or desktop computers). In most cases, the online identifier is not linked to clear data such as names, postal addresses, or email addresses.
  • Click tracking: Click tracking makes it possible to observe user movements within an entire online offering. Since the results of these tests are more accurate when user interaction can be tracked over a certain period (e.g., to determine whether a user returns frequently), cookies are usually stored on users’ devices for testing purposes.
  • Conversion measurement: Conversion measurement (also referred to as "visit action evaluation") is a method used to determine the effectiveness of marketing activities. A cookie is typically stored on the users’ devices within the websites where marketing measures take place and is then retrieved again on the target website. For example, this allows us to determine whether ads we placed on other websites were successful.
  • Personal Data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter referred to as the "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
  • Profiles with user-related information: The processing of "profiles with user-related information," or simply "profiles," includes any form of automated processing of personal data that involves using such personal data to analyze, evaluate, or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include various information concerning demographics, behavior, and interests, such as interaction with websites and their content, etc.). Cookies and web beacons are often used for profiling purposes.
  • Reach measurement: Reach measurement (also known as web analytics) is used to analyze the flow of visitors to an online offering and may include visitor behavior or interests in specific information, such as the content of websites. With the help of reach analysis, operators of online services can determine, for example, when users visit their websites and which content they are interested in. This enables them to better tailor website content to the needs of their visitors. Pseudonymous cookies and web beacons are often used for reach analysis to recognize returning visitors and obtain more precise insights into the use of an online service.
  • Remarketing: "Remarketing" or "retargeting" refers to the practice of noting which products a user has shown interest in on a website, for example, for advertising purposes, in order to remind the user of these products on other websites, e.g., in ads.
  • Tracking: "Tracking" refers to the ability to follow user behavior across multiple online services. Typically, behavioral and interest information related to the online services used is stored in cookies or on the servers of the providers of tracking technologies (so-called profiling). This information can then be used, for example, to display advertisements to users that are likely to match their interests.
  • Controller: The term "controller" refers to the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: "Processing" means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and encompasses virtually any handling of data, whether it be collection, evaluation, storage, transmission, or deletion.
  • Audience creation: "Audience creation" (also known as "custom audiences") refers to the process of defining target groups for advertising purposes, e.g., displaying ads. For example, based on a user’s interest in certain products or topics online, it can be inferred that this user may be interested in ads for similar products or the online shop where they viewed the products. "Lookalike audiences" refer to users who are shown similar content because their profiles or interests presumably match those of the original audience. Cookies and web beacons are generally used to create custom and lookalike audiences.

© 2026 COSLINE Cosmetics

American Express Apple Pay Google Pay Mastercard PayPalVisa KlarnaiDEAL Wero EPS