Skip to content

PRIVACY POLICY

From February 2020


THE TABLE OF CONTENTS


I. Identity and contact details of the data controller

II. Contact details of the data protection officer
III. General information on data processing
IV. Rights of the data subject
V. Provision of the website and creation of
log files
VI. Use of cookies
VII. Registration
VIII. Webshop
IX. Payment options
X. Shipping service provider
XI. Contact by e-mail
XII. Web presences of companies
XIII. Use of company presences in professional
oriented networks
XIV. Use of plugins
XV. Integration of plugins via external service providers


I. Identity and contact details of the data controller
Controller


The data controller is responsible for the processing of data in accordance with the purposes of the
General Data Protection Regulation (GDPR) of the European Union and
other national data protection laws of the Member States and other
data protection regulations:


Ultramera B.V.

Bar. S. vd Oyelaan 32

2252EB Voorschoten

The Netherlands

E-mail: info@ultramera.com


II. contact details of the data protection officer


The designated data protection officer is:


DataCo GmbH

Dachauer Str. 65

80335 Munich

Germany

+49 89 7400 45840

www.dataguard.de


III General information on data processing


a. Scope of the processing of personal data


In general, we process the personal data of our users only to the
extent necessary to provide a functioning website with our
content and services. The processing
of personal data is regularly carried out only with the consent of the
user. Exceptions are cases in which prior consent
cannot be obtained technically and the processing of the data
is permitted by law.


b. Legal basis for data processing


Art. 6 para. 1 s. 1 lit. a GDPR serves as the legal basis for obtaining the
consent of the data subject to the processing of his/her data.


As regards the processing of personal data necessary for the performance
of a contract to which the data subject is party,
Art. 6 para. 1 s. 1 lit. b GDPR serves as the legal basis. This also applies
to processing that is necessary for the performance of pre-contractual activities
.


If it is necessary to process personal data in order to comply with a legal
obligation to which our company is subject, Art. 6 para. 1 s. 1
lit. c GDPR serves as the legal basis.


If vital interests of the data subject or another
natural person require the processing of personal data, Art.
6 para. 1 s. 1 lit. d GDPR serves as the legal basis.
If the data processing is necessary to protect the legitimate interests
of our company or a third party and the fundamental rights
and freedoms of the data subject do not prevail, Art. 6 para. 1 s.
1 lit. f GDPR serves as the legal basis for the data processing. If the
data processing is necessary to protect the legitimate interests of our company or third parties and the fundamental rights and freedoms
of the data subject do not prevail, Art. 6 para. 1 s. 1 lit. f GDPR serves as
legal basis for the data processing.


c. Data removal and storage period


The personal data of the data subject will be deleted or
restricted as soon as the purpose of their storage has been fulfilled. Additional
storage may take place if provided for by the European or national
legislator under EU regulations, EU law or other
relevant regulations to which the data controller
is subject. Restriction or deletion of the data
will also take place after the expiry of the
retention period stipulated in the aforementioned standards, unless there is a need to extend the
retention of the data for the purpose of concluding or fulfilling
the relevant contract.


IV. Rights of the data subject


If your personal data is processed, you are subsequently a
data subject under the GDPR and have the following rights:


a. Right to information


You may request the data controller to
confirm whether your personal data is being processed by them.


If such processing is taking place, you may request the following
information from the data controller:


- The purposes for which the personal data is processed;
- The categories of personal data processed;
- The recipients or categories of recipients to whom the personal data relating to you
has been or will be disclosed
;
- The intended period of retention of your personal data or,
if certain information is not available, criteria for
determining the period of retention;
- The existence of a right to rectification or erasure of personal data concerning you
, a right to
restriction of processing by the
data controller or a right to
object to such processing;
- The existence of a right of appeal to a
supervisory authority;
- Any available information about the source of the data if the
personal data is not collected from the data subject
;
- The existence of automated decision-making
including profiling pursuant to Article 22 para. 1
and para 4 GDPR and, in certain cases, meaningful
information about the data processing system concerned
and the scope and intended result of such
processing for the data subject.


You have the right to request information on whether your personal
data is transferred to a third country or an international organisation
. In this context, you may then request the relevant
safeguards pursuant to Article 46 GDPR in connection with the transfer.


b. Right of rectification


You have the right to rectification and/or completion by the
controller if your processed personal
data is inaccurate or incomplete. The data controller
must correct the data without undue delay.


c. Right to restriction of processing


You may request the restriction of the processing of your personal data
under the following conditions:

o If you question the accuracy of your personal data for a period of time in
that allows the data controller
to verify the accuracy of your personal data;

o The processing is unlawful and you refuse to erase
the personal data and instead request the restriction of
use of the personal data;

o The representative no longer needs the personal data for the
purpose of the processing, but you need it to assert,
exercise or defend legal claims; or

o If you object to the processing under Article 21(1) of the GDPR and it is still
not certain whether the legitimate grounds of the data controller
override your grounds.
If the processing of personal data concerning you
has been restricted, such data - with the exception of data storage -
may only be used with your consent or for the purposes of asserting, exercising
or defending legal claims or protecting the rights of another
natural or legal person or for reasons of an
important public interest, an interest of the Union or of a
Member State.


If processing has been restricted in accordance with the above
conditions, you will be informed by the controller
before the restriction is lifted.


d. Right to erasure


1. obligation to erasure


If you ask the controller to erase your personal
data with immediate effect, the controller is obliged to do so without delay
because one of the following applies:


- Personal data relating to you is no longer necessary for the purposes
for which it was collected or processed.
- You withdraw your consent to which the processing is subject under Art. 6
para. 1 s. 1 lit. a or Art. 9 para. 2 lit. a GDPR and there is no
other legal basis for the processing of the data
- According to Art. 21 para. 1 GDPR you object to the processing of
data if the processing of the data is justified by a legitimate
interest or you object according to Art. 21
para. 2 GDPR.
- Your personal data has been processed unlawfully.
- The act of erasure of your personal data invokes a
legal obligation under Union law or the law of the
Member States to which the controller
is subject.
- Your personal data have been processed in connection with the business information services offered to
pursuant to Art. 8
para. 1 GDPR.


2. information to third parties


If the data controller has published your personal data
and the data in accordance with Art. 17 (1) GDPR, they shall take
appropriate measures, including technical means, to inform the
data processors processing the personal data
that a request has been made to erase all links to such
personal data or copies or reproductions of the
personal data, taking into account the available
technology and the cost of carrying out the process
.


3. exceptions


The right to erasure does not exist if the processing is necessary:


- to exercise the right to freedom of speech and information;
- to comply with a legal obligation imposed by the law
of the Union or of the Member States to which the representative is subject
or to perform a task carried out in the public
interest or in the exercise of the
official authority vested in the representative;
- for reasons of public interest in the field of
public health pursuant to Art. 9 para. 2 lit. h and i and Art. 9
(3) GDPR;
- for archiving purposes of public interest,
scientific or historical research purposes or for
statistical purposes pursuant to Art. 89 (1) GDPR, to the extent that the law referred to in
(a) is likely to render impossible or seriously
prejudice the achievement of the purposes of such
processing; or
- for the enforcement, exercise or defence of
legal claims.


e. Right to information


If you have the right to rectification, erasure or restriction of
processing via the controller, the controller
is obliged to inform all recipients to whom your personal data have been disclosed
of the rectification or erasure of the data or the
restriction of processing, unless this proves
impossible or involves a disproportionate effort.


You reserve the right to be informed by the data controller
of the recipients of your data.


f. Right to data portability


You have the right to receive your personal data that you have provided to the
controller in a structured,
standardized and machine-readable format. In addition
you have the right to transfer this data to another person without hindrance from the
controller to whom the data was originally transferred
, as 1. the processing is based on
consent pursuant to Art. 6 para. 1 s. 1 lit. a GDPR or Art. 9
para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 s. 1 lit. b GDPR
and the processing is carried out by automated means.


In exercising this right, you also have the right to claim
that your personal data concerning you are transferred directly from one person to
another, where this is technically possible. The
freedoms and rights of other individuals will not be affected.


The right to data portability does not apply to the processing
of personal data necessary for the performance of a task carried out in the public
interest or in the exercise of official authority vested in the controller
.


g. Right to object


Subject to your situation, you have the right to object at any time to the
processing of your personal data pursuant to Art. 6 para. 1 s. 1 lit. e or f
GDPR; this also applies to profiling based on these provisions.


The data controller will no longer process the
personal data concerning you unless it can demonstrate
compelling legitimate grounds for the processing which override your
interests, rights and freedoms, or the processing is carried out
for the purpose of asserting, exercising or defending
legal claims.


If the personal data concerning you is processed for
direct marketing purposes, you have the right to object at any time to
processing of your personal data with regard to such
advertising; this also applies to profiling,
insofar as it is related to direct marketing.


If you object to processing for direct marketing purposes,
your personal data will no longer be processed for such purposes.


Notwithstanding Directive 2002/58/EC, in the context of the
use of information society services, you have the possibility to exercise your
right to object to automated procedures using technical
specifications.


h. Right to withdraw your data protection consent


You have the right to withdraw your consent at any time. The withdrawal
of consent will not affect the lawfulness of the processing
carried out on the basis of the consent until the withdrawal.


i. Automated decision-making on a case-by-case basis, including profiling.


You have the right not to be subject to a decision based
solely on automated processing - including profiling
- which produces legal effects or similarly affects you
. This does not apply if the decision:


- is necessary for the conclusion or performance of a contract between
you and the controller
,
- is authorised by Union or Member State law
to which the controller is subject
and where that law contains appropriate measures to
protect your rights and freedoms and your legitimate
interests, or
- with your explicit consent.


However, these decisions may not relate to special categories
of personal data under Article 9(1) GDPR, unless Article 9(2)
lit. a or g GDPR applies, and appropriate measures have been taken
to protect the rights and freedoms and your legitimate interests.


In relation to the cases referred to in paragraphs (1) and (3), the
controller shall take appropriate measures to safeguard your rights and
freedoms and legitimate interests, including the
right to obtain assistance from the controller or
its representative, to express your views on the matter
and to challenge the decision.


j. Right to complain to a supervisory authority


Without prejudice to any other administrative or judicial remedy,
you have the right to lodge a complaint with a supervisory authority in the Member State of your
residence, place of work or the place of the alleged
infringement if you believe that the processing
of personal data concerning you infringes the GDPR.


The supervisory authority to which the complaint has been submitted
will inform the complainant of the status and outcome of the
complaint, including the possibility of a legal remedy under Article 78
GDPR.


V. Provision of the website and creation of log files


a. Description and scope of data processing


Each time our website is accessed, our system automatically collects
data and relevant information from the computer system of the
calling device.


The following data is collected:


o Browser type and version
o The user's operating system
o Date and time of access
o Web pages from which the user's system accessed our website

o Web pages accessed by the user's system through our website

o Length of page visit/access


The data is also stored in the log files of our system.
Not included are the IP addresses of the users or other data that enable
to assign the data to a user. The data is
not stored together with the other personal data of the user
.


b. Purpose of the data processing


The storage in log files is done to ensure the functionality of the website
. The data is also used to optimise the website and to
ensure the security of our IT systems. An analysis
of the data for marketing purposes does not take place.


For the aforementioned purposes, we have a legitimate interest in the
processing of the data pursuant to Art. 6 para. 1 s. 1 lit. f GDPR.


c. Legal basis for data processing


The legal basis for the temporary storage of data is
Art. 6 para. 1 s. 1 lit. f GDPR.


d. Duration of storage


The data is deleted as soon as it is no longer necessary for the purpose of its collection
. The session is closed when the collection
of data for the provision of the website is completed.


e. Objection and removal


The collection of data for the provision of the website and the
storage of data in log files are essential for the operation of the
website. Therefore, the user cannot object to the above
processes.


VI. Use of cookies


a. Description and scope of data processing


Our website uses cookies. Cookies are text files that are stored in the
Internet browser or in the Internet browser on the computer system of the
user. When a user visits a website,
may store a cookie on the user's operating system. These
cookies contain a string of characters that allows the browser to be uniquely identified when
is reopened.


We use cookies to make our website more user-friendly
. Some elements of our website require the calling
browser to be identified even after a page break.


The following data is stored and transmitted in the cookies:


o Language settings
o Items in shopping cart
o Login information.


We also use cookies on our website, which enable us to analyse
the surfing behaviour of our users.


As a result, the following data is transmitted:


o Search queries entered
o Frequency of page views
o Use of website functionalities


The user data collected in this way is pseudonymised by technical
measures. It is therefore not possible to allocate the data to the
user accessing the website. The data is not stored
together with other personal data of the users.


When accessing our website, the user is informed about the use of
cookies for analysis purposes and his consent to the
processing of the
personal data used in this context is obtained. In this context, reference is also made
to this privacy policy.


b. Purpose of data processing


The purpose of the use of technical cookies is to facilitate the use of
websites for users. Some functions of our
website cannot be offered without the use of cookies.
These require the browser to be recognised
even after a page change.


We require cookies for the following applications:


o Shopping cart
o Applying language settings
o Storing search terms
o Product interests


User data collected through technical cookies is not used to
create user profiles.


The analysis cookies are used to improve the quality of our website
and its content. Through the analysis cookies, we learn how the
website is used and can thus constantly optimize our offer.

c. Legal basis for data processing


The legal basis for the processing of personal data with
the help of cookies is Art. 6 para. 1 s. 1 lit. a GDPR.


The legal basis for processing personal data
using technical cookies is Art. 6 para. 1 s. 1 lit. f GDPR.


d. Duration of storage and possibility of objection and
Removal


Cookies are stored on the user's device and transferred to our website by the user
. Therefore, you as a user also have full
control over the use of cookies. You can disable or restrict the transfer of
cookies by changing the settings in your
Internet browser. Cookies that have already been stored can be deleted at any time
. This can also be done automatically. If cookies are disabled for
our website, it may not be possible to use all the functions of the
website in full.


If you use the Safari browser version 12.1 or higher,
cookies are automatically deleted after seven days. This also applies to opt-out cookies used to prevent the use of
tracking mechanisms.


VII. Registration


a. Description and scope of data processing


We offer users the opportunity to register by providing personal
data. The data is entered into an input mask
and transmitted to us and stored. The data will not be passed on to third parties
. The following data is collected during the
registration process:


o Email address
o Last name
o First name
o Address
o Telephone/mobile phone number.


As part of the registration process, consent is obtained from the user
to process this data.


b. Purpose of the data processing


Registration of the user is necessary for the performance of a contract with the
user or for the performance of pre-contractual measures.


commissioning and delivery of visitors ordered and bpaid goods.


c. Legal basis for data processing


The legal basis for the processing of data is Art. 6 para. 1 s. 1
lit. a GDPR, if the user has given his consent.


If the registration serves the fulfilment of a contract to which the user
is a party or the implementation of pre-contractual measures, the
additional legal basis for the processing of the data is Art. 6 para. 1 s. 1
lit. b GDPR.


d. Duration of storage


The data are deleted as soon as they are no longer necessary to achieve the purpose
for which they were collected.


This is the case for data collected during registration for the performance of a
contract or for the performance of pre-contractual measures
, if the data is no longer required for the performance of the contract
. Even after conclusion of the contract, it may be necessary to store
personal data of the contracting party in order to fulfil contractual
or legal obligations.


e. Objection and removal


As a user, you have the option to
delete your registration at any time. You can request a change of the
data stored about you at any time.


In the account area, the account can be completely deleted at any time if
no binding business relationship already exists or is open.


If the data is required to fulfil a contract or to carry out
pre-contractual measures, premature deletion of
data is only possible insofar as contractual or legal obligations do not prevent
deletion.


VIII. Webshop


We offer a web shop on our website. For this purpose, we use the
Software as a Service (SaaS) rental shop system of a
service provider commissioned by us.


The name of our SaaS rental shop system and the name and address
of the service provider are:


Shopify of the provider Shopify International Limited, 1-2 Haddington Road,
D04 XN32, Dublin, Ireland (hereinafter referred to as Shopify).


For more information, see the privacy policy of the
provider: https://www.shopify.com/legal/privacy


The servers automatically collect and store information in so
called server log files, which your browser automatically transmits when
you visit the website. The information stored is:


o Browser type and version
o Operating system used
o Referral URL
o Host name of the accessing computer
o Time and date of the server request
o IP address of the user's device.


A combination of this data with other data sources is not carried out
. The data is processed on the basis of Art. 6 para. 1 lit. f
GDPR. The website operator has a legitimate interest in the technically
error-free presentation and optimization of its website - for this purpose, the
server log files must be recorded.


We have concluded a contract with the respective service provider for
order processing, in which we oblige the respective service provider
to protect user data and not to pass it on to third parties.


The server of the website is geographically located in Germany.


IX. Payment options


a. Description and scope of data processing


We offer our customers various payment options for the
processing of their orders. Depending on the payment option, we forward the
customers to the platform of the respective payment service provider. After
completion of the payment process, we receive the customer's payment data
from the payment service providers or our house bank and process this
in our systems for billing and accounting.


b. Payment via Amazon Pay


It is possible to process payment transactions with the payment service provider AmazonPay
. AmazonPay allows you to make online payments to third parties
using the payment and
shipping information stored in your Amazon account.


The European operating company of AmazonPay is Amazon Payments
Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg. If you already have
a customer account with Amazon.co.uk, you can pay immediately with the payment method stored there
- either by direct debit or
by credit card. This requires you to log in to your Amazon account
.


Amazon Pay does not pass on the
payment details stored in your Amazon.co.uk customer account to us and you do not need to enter these when placing your order
. There are no additional charges
when paying through Amazon. Data may be transferred to Amazon servers in the USA.
Amazon has submitted to the Privacy Shield Agreement concluded between the European Union and the USA
and is certified.
Amazon thereby undertakes to comply with the standards and regulations
of European data protection law. Further information can be found in
the following linked

Entry:\nhttps://www.privacyshield.gov/participant?id=a2zt0000000TOWQAA
4tatus=Active\n


For more information and to view your order summary for payment via
AmazonPay, please visit https://pays.amazon.de. If you pay via Amazon
Pay, any personal data provided to or collected by Amazon Pay for
will be processed primarily
by Amazon Pays s.c.a. and secondarily by Amazon EU SARL, Amazon
Services Europe SARL and Amazon Media EU SARL, all three located at 5,
Rue Plaetis L 2338, Luxembourg. For more information about AmazonPay's
processing of your data, please see Amazon Pay's
Privacy Policy


at: https://pay.amazon.com/de/help/201751600


c. Payment via Klarna


It is possible to process payment transactions with the
payment service provider Klarna.


Klarna is a payment service provider that enables purchase on account or
payment by instalments.


Klarna's European operating company is Klarna Bank AB (publ),
Sveavägen 46, 111 34 Stockholm, Sweden.


If you choose "Purchase on
Invoice" or "Installment Purchase" as payment option within the transaction via Klarna, your personal data
will be automatically transferred to Klarna. The
personal data transferred to Klarna are in particular the following.


o First name
o Last name
o Address
o Date of birth
o Gender
o E-mail address
o IP address of the user's device
o Telephone/mobile phone number
o Bank account details
o Credit card number incl. expiry date and CVC code
o Number of items
o Product code
o Data on goods and/or services
o Transaction amount and tax levies


The transmission of data serves in particular for identity verification,
payment management and fraud prevention. The personal data exchanged between Klarna and us
may be transferred by Klarna to credit agencies
.


The purpose of this transfer is to verify identity and
creditworthiness. Klarna may also transfer the personal data to
affiliated companies (Klarna Group) and service providers or
subcontractors if this is necessary to fulfil the contractual
obligations or if the data is to be processed on behalf of Klarna
.


For further information about the processing of your data by Klarna, please refer to
Klarna's privacy policy.


at: https://pay.amazon.com/de/help/201751600 https://cdn.klarna.com/1.0/s
hared/content/policy/data/en/data_protection.pdf.


d. Payment by credit card


It is possible to complete the payment process by credit card.


If you have chosen to pay by credit card, the
payment details will be passed on to payment service providers
for payment processing. All payment service providers comply with the
requirements of the "Payment Card Industry (PCI) Data Security Standards"
and have been certified by an independent PCI Qualified Security Assessor
.


The following data is transmitted on a regular basis as part of the
credit card payment process:


o Purchase amount
o Date and time of purchase
o First name and last name
o Address
o Email address
o Credit card number
o Credit card expiration date
o Card verification code (CVC)
o IP address of the user's device
o Phone number / mobile phone number


The payment data will be forwarded to the following payment service providers
:


o Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam,
Netherlands
o Shopify


For more information on the privacy policy and
opt-out and removal options for payment service providers, please click here
: Adyen: https://www.adyen.com/platform/terms-and-conditions


e. Payment via PayPal


It is possible to process payment transactions with the payment service provider PayPal
. PayPal offers a direct payment method as well as purchase on
invoice, direct debit, credit card and installment payment.


The European operating company of PayPal is PayPal (Europe) S.à.r.l.
& Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg.


If you choose PayPal as your payment method, your data required for the
payment process will be automatically transmitted to PayPal.


The following data will be processed:


o Last name
o Address
o Email address
o Telephone/mobile phone number
o IP address of the user's device
o Bank account details
o Credit card number
o Card validation date and code (CVC)
o Number of items
o Product code
o Data on goods and services
o Transaction amount and tax levies
o Information on previous purchasing behaviour.


The data transmitted to PayPal may be transferred by PayPal to credit agencies
. The purpose of this transmission is to verify
identity and creditworthiness.


PayPal may also transfer your data to third parties to the extent necessary to fulfil
your contractual obligations or to process the data on behalf
of PayPal. When transferring your personal data
within companies affiliated with PayPal, the
binding corporate rules approved by the relevant
supervisory authorities will apply. You can find them

here: https://www.paypal.com/de/webapps/mpp/ua/bcr. Other data transfers
may be based on contractual safeguards. For more information
, please contact PayPal.


All PayPal transactions are subject to PayPal's privacy policy.
You can find them at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full/.


f. Purpose of data processing


The transmission of payment data to payment service providers serves the
processing of payments, e.g. when you purchase a product and/or use a
service.


g. Legal basis for data processing


The legal basis for the data processing is Art. 6 para. 1 p. 1 lit. b
GDPR, as the processing of the data is necessary for the execution of the
concluded purchase contract.


h. Duration of storage


All payment data as well as data on possible chargebacks are stored only as
long as they are needed for payment processing and a possible
handling of chargebacks and debt collection as well as for combating
abuse.


In addition, payment data may be stored beyond this,
if and as long as this is necessary to comply with statutory retention periods or
to prosecute a specific case of abuse.


Your personal data will be deleted after expiry of the statutory
retention period, i.e. after 10 years at the latest.


i. Objection and removal


You may withdraw your consent to the processing of your payment data at any time
by notifying the data controller or
the payment service provider used. However, the
payment service provider used may still be entitled to process your
payment data if and as long as this is necessary for the contractual
payment processing.


X. Shipping service providers


a. Description and scope of data processing


When you order products or services on our website that are delivered
by a shipping service provider, you will receive your order
and shipping confirmation via your email address and, depending on the
shipping service provider, a notification of the arrival of your shipment
and/or a notification of the arrival of the package and possible
delivery options.


The data will be transmitted to the following shipping service providers:


o DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany
o FIEGE Logistik Stiftung & Co. KG (logistics service provider).


The transmitted data are regular:


o Last name
o Address
o E-mail address


b. Purpose of the data processing


The purpose of processing personal data is to enable the
shipping service providers to inform recipients of the progress of a shipment by e-mail
and thus increase the probability
of successful delivery.


c. Legal basis for data processing


The legal basis for the transmission of the email address to the
respective shipping service provider and its use is Art. 6 para. 1 lit. f
GDPR, based on our legitimate interest in being able to offer the
notification service to our customers and thus make the
shipping as customer-friendly as possible.


d. Duration of storage


The transmitted data will be deleted by the respective shipping service provider,
when the package has been successfully delivered.


e. Appeal and removal


The notification service of the shipping service provider can be cancelled by the affected
user at any time. For this purpose, a corresponding opt-out link is included in every
e-mail.


XI. Contact via E-Mail


a. Description and scope of data processing
You can contact us via the e-mail address
provided on our website. In this case, the user's personal data transmitted with the e-mail
will be stored.
The data will be used exclusively for processing the conversation
.

b. Purpose of the data processing


If you contact us by e-mail, this also constitutes the
necessary legitimate interest in processing the data.


c. Legal basis for data processing


If the user has given consent, the legal
basis for processing the data is Article 6(1)(a) GDPR.
The legal basis for the processing of data provided in the context of sending an email
is Art. 6 (1) lit. f GDPR.
If the purpose of the email contact is to conclude a contract, the
additional legal basis for the processing is Art. 6 (1) lit. b
GDPR.


d. Duration of storage


The data will be deleted as soon as they are no longer necessary to achieve the purpose
for which they were collected. In the case of personal data sent via
email, this is the case when the respective conversation with
the user has ended. The conversation ends when it can be concluded from the circumstances
that the matter in question has been definitively resolved
.


The additional
personal data collected during the sending process will be deleted after seven days at the latest.


e. Objection and removal


The User has the possibility to withdraw the consent to the processing of his/her
personal data at any time. If the user contacts us by e-mail
, he can object to the storage of his personal data
at any time. In such a case, the conversation cannot be continued
.


Please send an e-mail to support.shop@ledvance.com.


In this case, all
personal data stored in connection with the contact will be deleted.


Please write by e-mail to support.shop@ledvance.com.


XII. Company websites


Use of company presences in social networks


a. Instagram:


Instagram, part of Facebook Ireland Ltd, 4 Grand Canal Square Grand
Canal Harbour, Dublin 2 Ireland.


On our company website, we provide information and offer
to Instagram users to communicate. When you take an action (e.g., comment,
post, like, etc.) on
our Instagram company website, you may post personal information (e.g., unique name
or photo of your user profile). However, since we generally or
largely have no influence on the processing of your personal data
by Instagram, the company co-responsible for the [name of customer] - company presence
, we cannot make any binding
statements about the purpose and scope of the processing of your data.


Our company presence in social networks serves the
communication and the exchange of information with (potential) customers.
In particular, we use the company presence for:
brand awareness, products, events.


Company presence publications may include the following content:


o information about products
o advertising.


Each user is free to publish personal data through activities on
.


The legal basis for data processing is Art. 6 para. 1 p.1 lit. a
GDPR.


The data generated for the company website is not stored in our own
systems.


Instagram has signed the Privacy Shield Agreement between the European
Union and the United States and is certified in accordance with this
agreement. This ensures Instagram's commitment to
compliance with the standards and regulations of European
data protection law. For more information, please see the following
linked entry:


https://www.privacyshield.gov/participant?id=a2zt0000000GnywAACtatus=Acti
ve


You can object at any time to the processing of your personal data that we collect in the
context of your use of our Instagram corporate website
and exercise your rights as a data subject mentioned in IV. of this
Privacy Policy. Please send us
an informal email to support.shop@ledvance.com. For more
information about Instagram's processing of your personal data
and the relevant ways to object, please click here:


Instagram: https://help.instagram.com/519522125107875


b. YouTube:


YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, United States.


On our corporate website, we provide information
and offer YouTube users the opportunity to communicate. When you
take an action on our YouTube corporate website (e.g.,
comments, posts, likes, etc.), you may post personal information (e.g.,
unique name or photo of your user profile). However, as we
generally or largely have no influence on the processing
of your personal data by YouTube, the company co-responsible for the [name of
customer] - corporate presence, we
cannot make any binding statements about the purpose and scope of the processing of your
data.


Our company presence in social networks serves the
communication and the exchange of information with (potential) customers.
In particular, we use the company presence for:
brand awareness, products, events.


Company presence publications may include the following content:


o information about products
o advertising.


Each user is free to publish personal data through activities on
.


The legal basis for data processing is Art. 6 para. 1 p.1 lit. a
GDPR.


The data generated for the company website is not stored in our own
systems.


YouTube has signed the Privacy Shield Agreement between the European Union
and the United States and is certified according to this agreement
. This ensures that YouTube complies with the standards and
regulations of European data protection law. For more
information, please see the following linked entry:
https://www.privacyshield.gov/participant?id=a2zt000000001L5AAItatus=Activ
e


You may object at any time to the processing of your personal data that
we collect in the course of your use of our YouTube corporate web presence
and exercise your rights as a data subject as mentioned in IV.
of this Privacy Policy. Please send us
an informal email to support.shop@ledvance.com. For more
information about YouTube's processing of your personal data
and how to object, please click here:


YouTube: https://policies.google.com/privacy?gl=DEl=en


XIII Use of company presences in professionally oriented networks
Networks


a. Scope of data processing


We use company presences in professionally oriented networks. We
are present in the following professionally oriented networks:


Linked In:


LinkedIn, Unlimited Company Wilton Place, Dublin 2, Irleand.


On our website we provide information and offer
users the opportunity to communicate.


Company presence is used for job applications, information/PR and
active sourcing.


We have no information about the processing of your personal data
by the companies collectively responsible for the corporate presence
. For more information, please see the
privacy policy of: https://www.linkedin.com/legal/privacypolicy?trk=hb_ft_priv


When you take an action on our company website (e.g.,
comments, posts, likes, etc.), you may post personal information (e.g.,
unique name or photo of your user profile).


b. Legal basis for data processing


The legal basis for processing your data in connection
with the use of our website is Art. 6 para. 1 p.1 lit.f GDPR.


c. Purpose of the data processing


Our corporate website serves to inform users about our
services. Every user is free to publish personal data through
activities.


d. Duration of storage


We store your activities and personal data published through our
company website until you withdraw your consent.
We also comply with legal retention periods.


e. Objection and removal


You can object at any time to the processing of your personal data that
we collect in the context of the use of our company website,
and assert your rights as a data subject under IV. of this
privacy policy. Please send us an informal EMail to the email address provided in this Privacy Policy.


LinkedIn has also signed the Privacy Shield Agreement between the European
Union and the United States and is certified under this
agreement. LinkedIn is committed to complying with the standards and
provisions of European data protection law. For more
information, please see the following linked entry:
https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0tatus=Acti
ve


For more information on how to object and opt-out, please visit
here: https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv


XIV Use of plugins


We use plugins for various purposes. The plugins
used are listed below:


A. Use of Google Analytics


1. scope of the processing of personal data


We use Google Analytics, a web analytics service provided by Google
LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA and
its representative in the Union Google Ireland Ltd, Gordon House, Barrow
Street, D04 E5W5, Dublin, Ireland (hereinafter referred to as Google),
. Google Analytics examines, among other things, the origin of
visitors, the length of time spent on individual pages and the use of
search engines, thus enabling better monitoring of the success of
advertising campaigns. Google places a cookie on your computer. This allows
to store and analyse personal data,
in particular the activity of the user (especially which pages were visited
and which elements were clicked on), device and browser information
(especially the IP address and the operating system), data on the
ads displayed (especially which ads were displayed and
whether the user clicked on them) and data on advertising partners
(especially pseudonymised user IDs). The information generated by the cookie
about your use of this website will be transmitted to and stored by Google on
servers in the United States
. However, if IP anonymisation is activated on this online presence
, Google will truncate your IP address beforehand within the member states of the
European Union or other signatory states to the Agreement on
the European Economic Area. Only in
exceptional cases will the full IP address be transmitted to a Google server in
the USA and truncated there.
Google has signed the Privacy Shield Agreement between the European Union
and the United States and is certified under this agreement
. Google thus undertakes to comply with the standards and
regulations of European data protection law. For more information
, please see the following linked entry
: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAItatus=Acti
ve


IP anonymization is active on this online presence. On behalf of
, the operator of this online presence, Google will use this information to evaluate
your use of the online presence, to compile reports on the activities
of the online presence and to provide
, the operator of the online presence, with further services associated with the use of the online presence and the internet
. The IP address transmitted by your browser in the
context of Google Analytics is not combined with other
data from Google. You can prevent the installation of cookies by
setting your browser software accordingly; however, we would like to point out
that in this case you may not be able to use all
functions of this website to their full extent.\ Further
information on data collection and storage by Google can be found
here: https://policies.google.com/privacy?gl=ENl=en


2. purpose of the data processing


The purpose of processing personal data is to target
to a group of people who have already expressed an initial interest by visiting
website.


3. legal basis for the processing of personal data


The legal basis for the processing of personal data is
the consent given by the user in accordance with Art. 6 Para. 1 S.1 lit. a
GDPR.


4. duration of storage


Your personal data will be stored for as long as is necessary for
to fulfil the purposes described in this privacy policy
or as required by law. The advertising data in the
server logs are anonymized by Google's own
to delete parts of the IP address and cookie information
after 9 and 18 months respectively.


5. possibility of revocation of consent and removal


You have the right to revoke your declaration of consent at any time
data protection. The withdrawal of consent does
not affect the lawfulness of the processing carried out on the
basis of consent until the withdrawal.
You can prevent the collection and processing of your personal data
by Google by preventing third parties from storing cookies
on your computer, by using the "Do not track
" feature of a supporting browser, by disabling
execution of script code in your browser or by installing a
script blocker such as NoScript(https://noscript.net/) or
Ghostery(https://www.ghostery.com) in your browser. Your
IP address) to Google and prevent Google from processing this
data by downloading and installing the browser plugin available at the following link
:
https://tools.google.com/dlpage/gaoptout?hl=en.


With the following link you can deactivate the use of your personal
data by Google
: https://adssettings.google.de\ Further information on
objection and removal options against Google can be found
at:
https://policies.google.com/privacy?gl=ENl=en


B. Use of the Google Tag Manager


1. scope of the processing of personal data


We use the Google Tag
Manager(https://www.google.com/intl/de/tagmanager/) of Google LLC, 1600
Amphitheatre Parkway, Mountain View, CA 94043, USA and its
representative in the Union Google Ireland Ltd, Gordon House, Barrow Street,
D04 E5W5, Dublin, Ireland (hereinafter referred to as Google). With the Google
Tag Manager, tags from Google and third-party services can be managed
and bundled and embedded into an online presence. Tags are
small elements of code on an online presence that are used to, among other things, measure
visitor numbers and behavior, track the impact of online advertising
and social channels, use remarketing and targeting
and test and optimize online presences. When a user visits
online presence, the current tag configuration is sent to the user's
browser. It contains statements about which tags
should trigger. Google Tag Manager triggers other tags that
itself can collect data. Information on this can be found in the
passages on the use of the relevant services in this
privacy policy. Google Tag Manager does not access this data,
and the data may be transferred to Google servers in the United States
. Google has signed a privacy agreement
with the European Union and the United States and has certified
. This commits Google to comply with the standards and
provisions of European data protection law. For more information
, please see the following linked entry:


https://www.privacyshield.gov/participant?id=a2zt000000001L5AAItatus=Activ
e. For more information about Google Tag Manager, please visit
at https://www.google.com/intl/de/tagmanager/faq.html and
Google's Privacy Policy at
: https://policies.google.com/privacy?hl=en


2. purpose of data processing


The purpose of the processing of personal data lies in the
collected and clearly arranged administration as well as in the efficient
integration of third party services.


3. legal basis for the processing of personal data


The legal basis for the processing of personal data is
the consent given by the user in accordance with Art. 6 Para. 1 S.1 lit. a
GDPR.


4. duration of storage


Your personal data will be stored for as long as is necessary for
to fulfil the purposes described in this privacy policy
or as required by law. The advertising data in the
server logs are anonymized by Google's own
to delete parts of the IP address and cookie information
after 9 and 18 months respectively.


5. possibility of revocation of consent and removal


You have the right to revoke your consent at any time
data protection. The withdrawal of consent does
not affect the lawfulness of the processing carried out on the
basis of consent until the withdrawal.
You can prevent the collection and processing of your personal data
by Google by preventing third parties from storing cookies
on your computer, by using the "Do not track
" feature of a supporting browser, by disabling
execution of script code in your browser or by installing a
script blocker such as NoScript(https://noscript.net/) or
Ghostery(https://www.ghostery.com) in your browser. Your
IP address) to Google and prevent the processing of this
data by Google by downloading and installing the browser plugin available at the following link
:
https://tools.google.com/dlpage/gaoptout?hl=en.
You can deactivate the use of your personal
data by Google
with the following link: https://adssettings.google.de\ Further information on
objection and removal options against Google can be found
at: https://policies.google.com/privacy?gl=ENl=en


C. Use of Google AdWords


1. scope of the processing of personal data


We use Google AdWords from Google LLC, 1600 Amphitheatre
Parkway, Mountain View, CA 94043, USA and its representative in the Union
Google Ireland Ltd, Gordon House, Barrow Street, D04 E5W5, Dublin, Ireland
(hereinafter referred to as Google). We use this service to serve ads.
Google places a cookie on your computer. This allows
to store and analyse personal data, in particular
the user's activity (especially which pages were visited and which
elements were clicked on), device and browser information
(especially the IP address and the operating system), data about the
ads displayed (especially which ads were displayed and
whether the user clicked on them) as well as data from advertising partners
(especially pseudonymised user IDs). Google has signed and certified a
agreement on the protection of privacy with the European Union and the
United States. With this
Google commits itself to comply with the standards and regulations of the European
data protection law. For more information, please see the following linked
entry: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAItat
us=Active.
Further information about the collection and storage of data by
Google can be found here: https://policies.google.com/privacy?gl=DEl=de


2. purpose of the data processing


We will only be aware of the total number of users who have responded to
our ad. We will not share any information
that could be used to identify you.
use is not for traceability purposes.


3. legal basis for the processing of personal data


The legal basis for the processing of personal data is
the consent given by the user in accordance with Art. 6 para. 1 p.1 lit. a
GDPR.


4. duration of storage


Your personal data will be stored for as long as is necessary for
fulfilment of the purposes described in this Privacy Policy
or as required by law, e.g. for tax and
accounting purposes.


5. Possibility of revoking consent and removal
You have the right to revoke your declaration of consent at any time
data protection. The withdrawal of consent does
not affect the lawfulness of the processing carried out on the
basis of consent until the withdrawal.
You can prevent the collection and processing of your personal data
by Google by preventing cookies from
third parties from being stored on your computer, by using the "Do Not Track"
feature of a supporting browser, by disabling the execution
of script code in your browser, or by using a script blocker
such as a browser browser.B. Install
NoScript(https://noscript.net/) or Ghostery(https://www.ghostery.com)
in your browser.
You can opt out of Google's use
of your personal information using the following link: https://adssettings.google.de.
For more information about Google's opt-out and
removal options, please visit:
\https://policies.google.com/privacy?gln=ENl=en


D. Use of the Google marketing platform


1. scope of the processing of personal data


We use the marketing platform of Google LLC, 1600 Amphitheatre
Parkway, Mountain View, CA 94043, USA and the representation in the Union
Google Ireland Ltd, Gordon House, Barrow Street, D04 E5W5, Dublin, Ireland
(hereinafter referred to as Google). Google places a cookie on your
computer. This allows personal data to be stored and
analysed, in particular the user's activity (in particular
which pages were visited and which elements were clicked on), device and
browser information (in particular the IP address and operating system),
data on the ads displayed (in particular which ads
were displayed and whether the user clicked on them) and data from
advertising partners (in particular pseudonymised user IDs). nOn
account of the marketing tools used, your browser automatically establishes a
direct connection with the Google server. This enables the
transfer of data to Google servers in the USA. Google has signed and certified a
agreement on the protection of privacy with the European Union and the
United States. With this
Google commits itself to comply with the standards and regulations of the European
data protection law. More detailed information can be found in the following
linked entry:
https://www.privacyshield.gov/participant?id=a2zt000000001L5AAItatus=Activ
e. We have no influence on the scope and further use of the
data collected by Google through the use of this tool and therefore inform
you to the best of our knowledge. If you are registered with a Google service
, Google can associate the visit with your account. Even if
you are not registered with Google or have not logged in, it is
possible for the provider to find out and store your IP address.\
Further information on data collection and storage by Google
can be found here
: https://policies.google.com/privacy?gl=ENl=en


2. purpose of data processing

The purpose of using the Google Marketing Platform is to serve
relevant ads to the user, to improve reports on
campaign performance or to prevent users from viewing
the same ads more than once.

3. legal basis for the processing of personal data


The legal basis for the processing of personal data is
the consent given by the user in accordance with Art. 6 para. 1 p.1 lit. a
GDPR.


4 Duration of storage

The Google marketing platform stores your data until the fulfilment
of the stated purpose, whereby the maximum storage period is 18 months
.


5. Possibility of revocation of consent and removal

You have the right to revoke your declaration of consent at any time
data protection. The withdrawal of consent does
not affect the lawfulness of the processing carried out on the
basis of consent until the withdrawal.
You can prevent the collection and processing of your personal data
by Google by preventing cookies from
third parties from being stored on your computer, by using the "Do not track"
feature of a supporting browser, by disabling the execution
of script code in your browser, or by using a script blocker
such as a browser browser.B. Install NoScript
(https://noscript.net/) or
Ghostery(https://policies.google.com/privacy?gl) in your browser.
You can opt out of Google's use of your personal
data by clicking on the following link: https://adssettings.google.de.
For more information on how to object to Google and
deletion options, please visit:
www.ghostery.com=ENl=en


E. Use of Klaviyo


1. extent of the processing of personal data


We use the service provider
MailChimp from Global HQ, 125 Summer St, Floor 6 Boston, MA 02111,
USA (hereinafter referred to as Klaviyo) to send our newsletter. Klaviyo is an email marketing provider and allows us to communicate directly with
potential customers via email newsletters. If you register for the newsletter
, the data you enter when registering for the newsletter
will be transmitted to Klaviyo and stored there. This allows
to store and evaluate further personal data,
in particular the user's activity (especially which pages
visited and which elements were clicked on) as well as device and
browser information (especially the IP address and the
operating system). Klaviyo has signed and is certified to the Privacy Shield Agreement between the
European Union and the United States. Klaviyo
is committed to complying with the standards and regulations of the European
Data Protection Act. For more information, please see the
following linked
entry: https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAA
Gtatus=Active.


Therefore, your data will also be stored by Klaviyo. Your data
will not be shared with third parties to receive the newsletter and
Klaviyo does not have the right to share your data. After
registration Klaviyo will send you an email to confirm your
registration. In addition, Klaviyo provides various
analytics on how the newsletters sent are opened and
used, such as how many users received an email, whether
emails were rejected, and whether users unsubscribed from the list after receiving an email. \For more information about Klaviyo's
data collection and storage practices, please click here:
https://www.klaviyo.com/privacy


2. purpose of the data processing


The
personal data collected when registering for the newsletter will be used exclusively for sending
our newsletter, if necessary for invitations to events and, if
you are already a customer of ours, for our customer e-mail.
In addition, subscribers to the newsletter could be informed by e-mail
if this is necessary for the operation of the newsletter service
or the related registration, as could be the case with
changes to the newsletter offer or changes to the
technical conditions.
3. legal basis for the processing of personal data
The legal basis for the processing of personal data is
the consent given by the user in accordance with Art. 6 Para. 1 S.1 lit. a
GDPR.


4. duration of storage


Your personal information will be retained for as long as is necessary for
to fulfill the purposes described in this Privacy Policy
or as required by law. In addition, you can contact
Klaviyo and request that your data be deleted.
5. Option to Revoke Consent and Remove
You have the right to revoke your consent at any time
data protection. The revocation of consent does
not affect the lawfulness of the processing that was carried out on the
basis of consent until the revocation.
Your consent to the storage of data, as well as its use
for sending the newsletter by MailChimp can be revoked at any time
. You can exercise your right of revocation
at any time by sending an email to Klaviyo or by clicking on
the link provided in each newsletter.\ For more
information on how to object to and remove
Klaviyo, please visit: https://www.klaviyo.com/privacy


XV. Integration of plugins via external service providers


a. Description and scope of data processing


We integrate certain plugins on our website via external
service providers in the form of content delivery networks. When you access our
website, a connection is established to the servers of the providers
used by us to retrieve content and
stored in the cache of the user's browser. This allows
to store personal data, in particular device and browser information
(e.g. IP address and operating system), in server log files
and to analyse it. We use the following services: Shopify.


b. Purpose of data processing


The use of the functions of these services serves to provide and
accelerate online applications and content.


c. Legal basis for data processing
This data is processed on the basis of Art. 6 (1) lit. f GDPR. The
website operator has a legitimate interest in the technically correct
presentation and optimisation of the website.


d. Duration of storage


Your personal data will be retained for as long as is necessary to fulfil the
purposes described in this privacy policy or as
required by law.


This privacy policy was created with the help of DataGuard.