PRIVACY POLICY

Last Update: 12.12.2024

Table of Contents

  1. Scope

  2. Legal Basis

  3. Controller Contact Informatio

  4. Rights under the General Data Protection Regulation

  5. Austrian Data Protection Authority

  6. Communication

    6.1. General Information about Communication

    6.2. Data Subjects

    6.3. Telephone

    6.4. Email

    6.5. Online Forms

    6.6. WhatsApp

7. Website

7.1. Squarespace

7.1.1. Visitor Data

7.1.2. Analytics

7.2. Google Analytics

7.3. Cookies

7.4. Email Marketing via Squarespace

7.5. Fonts

8. Social Media

8.1. General Information

8.2. Facebook

8.3. Instagram

8.4. TikTok

8.5. LinkedIn

9. Typeform - Survey System

10. Eventbrite - Workshop Booking System

11. Stripe Payment System

12. App

12.1. Registration/Login via Google

12.2. Data we collect through the App

12.3. How we use personal data

13. Explanation of Terms Used

Consent Personal Data Health Data Profiling

14. Conclusion

1. Scope

This privacy policy applies to all personal data processed by us in the company and to all personal data processed by companies commissioned by us (data processors). By personal data, we mean information within the meaning of Art. 4 No. 1 GDPR, such as a person's name and email address, including health data (cf. Art. 4 No. 15 GDPR). The processing of personal data ensures that we can offer and bill our services and products, whether online or offline. The scope of this privacy policy includes:

· all online presences (websites, online shops, apps) that we operate · social media presences and email communication

2. Legal Bases

In the following privacy policy, we provide you with transparent information about the legal principles and regulations, namely the legal bases of the General Data Protection Regulation, that enable us to process personal data.

Regarding EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can of course read this EU General Data Protection Regulation online on EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679

We only process your data if at least one of the following conditions applies:

  1. Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be storing your entered data from a contact form.

  2. Contract (Article 6(1)(b) GDPR): To fulfill a contract or pre-contractual obligations with you, we process your data. For example, if we enter into a purchase contract with you, we need personal information in advance.

  3. Legal obligation (Article 6(1)(c) GDPR): If we are subject to a legal obligation, we process your data. For example, we are legally required to keep invoices for accounting purposes. These usually contain personal data.

  4. Legitimate interests (Article 6(1)(f) GDPR): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we must process certain data to operate our website securely and economically efficiently. This processing is therefore a legitimate interest. Other conditions such as the performance of tasks carried out in the public interest and exercise of official authority as well as the protection of vital interests generally do not occur in our operations. Should such a legal basis be relevant, it will be indicated at the appropriate place.

In addition to the EU regulation, national laws also apply: · In Austria, this is the Federal Act concerning the Protection of Personal Data (Data Protection Act), abbreviated as DSG. · In Germany, the Federal Data Protection Act, abbreviated as BDSG applies. If other regional or national laws apply, we will inform you about them in the following sections.

3. Contact Details of the Controller

Should you have any questions about data protection or the processing of personal data, you will find the contact details of the responsible person or entity below:

FOOLPROOF SKIN FlexKapG (FN 633186 g)

Responsible Person: Karoline Strobl, PhD

Windmühlgasse 22/41, 1060 Vienna, Austria

Email: hello@foolproofskin.org

Phone: +43 660 4455747

4. Rights According to the General Data Protection Regulation

According to Articles 13, 14 GDPR, we inform you about the following rights to which you are entitled to ensure fair and transparent data processing:

According to Article 15 GDPR, you have the right to information about whether we process data about you. If this is the case, you have the right to receive a copy of the data and to learn the following information: o the purpose for which we carry out the processing; o the categories, i.e., the types of data that are processed; o who receives this data and if the data is transferred to third countries, how security can be guaranteed; o how long the data will be stored; o the existence of the right to rectification, erasure, or restriction of processing and the right to object to processing; o that you can lodge a complaint with a supervisory authority (links to these authorities can be found below); o the origin of the data if we did not collect it from you; o whether profiling is carried out, i.e., whether data is automatically evaluated to arrive at a personal profile of you.

According to Article 16 GDPR, you have the right to rectification of data, which means that we must correct data if you find errors.

According to Article 17 GDPR, you have the right to erasure ("right to be forgotten"), which specifically means that you can request the deletion of your data.

According to Article 18 GDPR, you have the right to restriction of processing, which means that we may only store the data but not use it further.

According to Article 20 GDPR, you have the right to data portability, which means that we will provide you with your data upon request in a common format.

According to Article 21 GDPR, you have a right to object, which, once enforced, brings about a change in processing.

  • If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you can object to the processing. We will then check as quickly as possible whether we can legally comply with this objection.

  • If data is used to conduct direct advertising, you can object to this type of data processing at any time. We may no longer use your data for direct marketing afterward.

  • If data is used to conduct profiling, you can object to this type of data processing at any time. We may no longer use your data for profiling afterward.

According to Article 22 GDPR, you may have the right not to be subject to a decision based solely on automated processing (for example, profiling).

According to Article 77 GDPR, you have the right to lodge a complaint. This means that you can complain to the data protection authority at any time if you believe that the processing of personal data violates the GDPR.

If you believe that the processing of your data violates data protection law or your data protection rights have been violated in any other way, you can complain to the supervisory authority. For Austria, this is the Data Protection Authority, whose website you can find at https://www.dsb.gv.at/. In Germany, there is a data protection officer for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:

5. Austrian Data Protection Authority

Head: Mag. Dr. Andrea Jelinek ****

Address: Barichgasse 40-42, 1030 Vienna ****

Phone: +43 1 52 152-0 ****

Email: dsb@dsb.gv.at ****

Website: https://www.dsb.gv.at/

6. Communication

6.1. General Information about Communication

👥 Affected persons: All who communicate with us via telephone, email or online form, visitors to the website and app. 📓 Processed data: Data such as name, address, email address, telephone number, general content data, form data, and if applicable IP address. More details can be found under each specific type of contact method. 🤝 Purpose: Processing communication with customers, business partners, etc. 📅 Storage duration: Duration of the business case and statutory requirements ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR (legitimate interests)

When you contact us and communicate via telephone, email, or online form, personal data may be processed. The data is processed for handling and responding to your inquiry and the associated business transaction. The data is stored for as long as necessary and as required by law.

6.1.1. What are Messenger & Communication Functions?

We offer various ways to communicate with us on our website (such as messenger and chat functions, online contact forms, email, telephone). In this process, your data is processed and stored to the extent necessary for responding to your inquiry and our subsequent actions.

In addition to traditional communication methods like email, contact forms, or telephone, we also use chats and messengers. Currently, the most frequently used messenger function is WhatsApp, but there are naturally many different providers offering messenger functions specifically for websites. When content is end-to-end encrypted, this is indicated in the individual privacy notices or in the privacy policy of the respective provider. End-to-end encryption simply means that the contents of a message are not visible even to the provider. However, information about your device, location settings, and other technical data can still be processed and stored.

6.1.2. Why Do We Use Messenger & Communication Functions?

Communication possibilities with you are of great importance to us. After all, we want to talk to you and answer all possible questions about our service in the best possible way. Good communication is an important part of our service. With the practical messenger & communication functions, you can choose whichever method you prefer at any time. In exceptional cases, however, we may not be able to answer certain questions via chat or messenger. This is the case when it comes to internal contractual matters, for example. Here we recommend other communication methods such as email or telephone.

We generally assume that we remain responsible under data protection law, even when we use services of a social media platform. However, the European Court of Justice has ruled that in certain cases, the operator of the social media platform may be jointly responsible with us within the meaning of Art. 26 GDPR. Where this is the case, we specifically point this out and work on the basis of a corresponding agreement. The essential aspects of the agreement are reproduced below for the affected platform.

Please note that when using our embedded elements, your data may also be processed outside the European Union, as many providers, such as Facebook Messenger or WhatsApp, are American companies. As a result, you may not be able to assert or enforce your rights regarding your personal data as easily.

6.1.3. What Data is Processed?

Which data is exactly stored and processed depends on the respective provider of the messenger & communication functions. Generally, this includes data such as name, address, telephone number, email address, and content data such as all information you enter in a contact form. Usually, information about your device and IP address is also stored. Data collected through a messenger & communication function is also stored on the providers' servers.

If you want to know exactly what data is stored and processed by the respective providers and how you can object to the data processing, you should carefully read the privacy policy of the respective company.

6.1.4. How Long is Data Stored?

How long the data is processed and stored primarily depends on our tools used. You can learn more about the data processing of individual tools below. The privacy policies of the providers usually specify exactly which data is stored and processed for how long. In principle, personal data is only processed for as long as necessary for the provision of our services. When data is stored in cookies, the storage duration varies greatly. The data can be deleted immediately after leaving a website, but it can also be stored for several years. Therefore, you should look at each individual cookie in detail if you want to know more about data storage. Usually, you can find informative details about individual cookies in the privacy policies of the respective providers.

6.1.5. Right to Object

You also have the right and option to revoke your consent to the use of cookies or third-party providers at any time. This works either through our cookie management tool or through other opt-out functions. For example, you can also prevent data collection through cookies by managing, deactivating, or deleting cookies in your browser. For more information, we refer you to the section on consent.

Since cookies may be used in messenger & communication functions, we also recommend our general privacy policy on cookies. To learn exactly what data about you is stored and processed, you should read the privacy policies of the respective tools.

6.1.6. Legal Basis

If you have consented to your data being processed and stored by integrated messenger & communication functions, this consent serves as the legal basis for data processing (Art. 6(1)(a) GDPR). We process your inquiry and manage your data within the framework of contractual or pre-contractual relationships to fulfill our pre-contractual and contractual obligations or to respond to inquiries. The basis for this is Art. 6(1)(1)(b) GDPR. In principle, if consent exists, your data is also stored and processed based on our legitimate interest (Art. 6(1)(f) GDPR) in fast and good communication with you or other customers and business partners.

6.2. Affected Persons

All persons who seek to contact us through the communication channels we provide are affected by the mentioned processes.

6.3. Telephone

When you call us, call data is stored in pseudonymized form on the respective end device and by the telecommunications provider used. Additionally, data such as name and telephone number may subsequently be sent via email and stored for inquiry response. The data is deleted as soon as the business case is completed and legal requirements permit.

6.4. Email

When you communicate with us via email, data may be stored on the respective end device (computer, laptop, smartphone,...) and data is stored on the email server. The data is deleted as soon as the business case is completed and legal requirements permit.

6.5. Online Forms

When you communicate with us via online form, data is stored on our web server and may be forwarded to an email address of ours. The data is deleted as soon as the business case is completed and legal requirements permit.

6.6. Messenger: WhatsApp

We use the instant messaging service WhatsApp on our website. The service provider is the American company WhatsApp Inc., a subsidiary of Meta Platforms Inc. (until October 2021 Facebook Inc.). For the European region, the responsible company is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

What is WhatsApp? We probably don't need to introduce WhatsApp to you in detail. The probability that you use this well-known messaging service on your smartphone yourself is relatively high. For many years, there have been voices criticizing WhatsApp and its parent company Meta Platforms regarding their handling of personal data. The main criticism in recent years focused on the merging of WhatsApp user data with Facebook. In response, Facebook reacted in 2021 and adjusted its terms of use. Facebook stated that currently (as of 2021) no personal data from WhatsApp users is shared with Facebook.

However, of course, numerous personal data about you is processed by WhatsApp if you use WhatsApp and have consented to data processing. This includes, alongside your phone number and chat messages, also sent photos, videos, and profile data. Photos and videos are supposed to be only temporarily stored, and all messages and calls are equipped with end-to-end encryption. Therefore, they should not be viewable even by Meta itself. Additionally, information from your address book and other metadata is stored at WhatsApp.

Why do we use WhatsApp? We want to stay in contact with you, and this works best via WhatsApp. Firstly, because the service works flawlessly, and secondly, because WhatsApp is still the most widely used instant messaging tool worldwide. The service is practical and enables uncomplicated and quick communication with you.

How secure is data transfer with WhatsApp? WhatsApp processes your data, among other places, in the USA. We point out that according to the European Court of Justice, there is currently no adequate level of protection for data transfer to the USA. This can be associated with various risks for the lawfulness and security of data processing.

As a basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, particularly in the USA) or data transfer there, WhatsApp uses so-called standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (Standard Contractual Clauses – SCC) are template contracts provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when transferred to third countries (such as the USA) and stored there. Through these clauses, WhatsApp commits to comply with European data protection levels when processing your relevant data, even when the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

Information about data transfer at WhatsApp that complies with the standard contractual clauses can be found at https://www.whatsapp.com/legal/business-data-transfer-addendum-20210927

We hope we have brought you closer to the most important information about the use and data processing by WhatsApp. You can learn more about the data processed through the use of WhatsApp in the Privacy Policy at https://www.whatsapp.com/privacy.[MOU1]

7. Website

7.1. Squarespace

7.1.1. Visitor Data

This website is hosted by Squarespace. Squarespace collects personal data when you visit this website. This includes: · Information about your browser, network, and device · Websites you visited before accessing this website · Pages you access on this website · Your IP address

Squarespace needs this data to operate this website and to protect and improve its platform and services. Squarespace analyzes the data in de-personalized form.

7.1.2. Analytics

This website collects personal data that serves as the basis for our website analytics. This includes: · Information about your browser, network, and device · Websites you visited before accessing this website · Your IP address

This information may also include details about your use of this website, including: · Clicks · Internal links · Pages visited · Scrolling · Search operations · Timestamps

We share this information with Squarespace, our website analytics provider, to learn more about the traffic and activity on this website.

7.2. Google Analytics

👥 Affected Persons: Website visitors 🤝 Purpose: Analysis of visitor information to optimize the website offering 📓 Processed Data: Access statistics containing data such as access locations, device data, access duration and time, navigation behavior, click behavior, and IP addresses. More details can be found below in this privacy policy. 📅 Storage Duration: depends on the properties used ⚖️ Legal Bases: Art. 6 Para. 1 lit. a GDPR (Consent), Art. 6 Para. 1 lit. f GDPR (Legitimate Interests)

How long and where is the data stored? Google has servers distributed worldwide. Most servers are located in America, and consequently, your data is mostly stored on American servers. You can read exactly where Google's data centers are located here: https://www.google.com/about/datacenters/locations/?hl=de

Your data is distributed across various physical storage devices. This has the advantage that the data can be accessed more quickly and is better protected against manipulation. Every Google data center has appropriate emergency programs for your data. If, for example, Google's hardware fails or natural disasters disable servers, the risk of service interruption at Google remains low.

The storage duration of the data depends on the properties used. When using the newer Google Analytics 4 properties, the storage duration of your user data is fixed at 14 months. For other so-called event data, we have the option to choose a storage duration of 2 months or 14 months.

For Universal Analytics properties, Google Analytics has a standardized storage duration of 26 months for your user data. After this, your user data is deleted. However, we have the option to choose the storage duration of usage data ourselves. We have five options available: · Deletion after 14 months · Deletion after 26 months · Deletion after 38 months · Deletion after 50 months · No automatic deletion

Additionally, there is the option that data is only deleted when you no longer visit our website within our chosen time period. In this case, the retention period is reset each time you visit our website within the specified period.

When the specified period has expired, the data is deleted once a month. This retention period applies to your data associated with cookies, user identification, and advertising IDs (e.g., cookies from the DoubleClick domain). Report results are based on aggregated data and are stored independently of user data. Aggregated data is a merger of individual data into a larger unit.

How can I delete my data or prevent data storage? Under European Union data protection law, you have the right to access, update, delete, or restrict your data. Using the browser add-on to deactivate Google Analytics JavaScript (ga.js, analytics.js, dc.js), you can prevent Google Analytics from using your data. You can download and install the browser add-on at https://tools.google.com/dlpage/gaoptout?hl=de. Please note that this add-on only deactivates data collection by Google Analytics.

If you want to generally deactivate, delete, or manage cookies, you can find the corresponding links to the instructions for the most common browsers in the "Cookies" section.

Legal Basis The use of Google Analytics requires your consent, which we have obtained through our cookie popup. This consent represents according to Art. 6 Para. 1 lit. a GDPR (Consent) the legal basis for the processing of personal data, as it may occur in the collection by web analytics tools.

In addition to consent, we have a legitimate interest in analyzing the behavior of website visitors and thus improving our offering technically and economically. With the help of Google Analytics, we can identify website errors, detect attacks, and improve economic efficiency. The legal basis for this is Art. 6 Para. 1 lit. f GDPR (Legitimate Interests). However, we only use Google Analytics if you have given consent.

Google processes your data in the USA, among other places. We would like to point out that according to the European Court of Justice, there is currently no adequate level of protection for data transfer to the USA. This may be associated with various risks to the lawfulness and security of data processing.

As a basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, thus particularly in the USA) or data transfer there, Google uses so-called Standard Contractual Clauses (= Art. 46. Para. 2 and 3 GDPR). Standard Contractual Clauses (Standard Contractual Clauses – SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when transferred to third countries (such as the USA) and stored there. Through these clauses, Google commits to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Google Ads Data Processing Terms, which refer to the Standard Contractual Clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.

We hope we could provide you with the most important information about data processing by Google Analytics. If you want to learn more about the tracking service, we recommend these two links: https://marketingplatform.google.com/about/analytics/terms/de/ and https://support.google.com/analytics/answer/6004245?hl=de.

7.3. Cookies

This website uses cookies and similar technologies, which are small files or short texts that are downloaded to a device when a visitor accesses a website or app. Information about viewing the cookies placed on your device can be found under About Cookies Used by Squarespace. These functional and required cookies are always used as they enable Squarespace, our hosting platform, to securely provide this website to you. These analytics and performance cookies are only used on this website, as described below, if you confirm our cookie banner. This website uses analytics and performance cookies to gain insight into website traffic, website activity, and other data.

Cookie Storage Duration

The storage duration depends on the specific cookie and is detailed further below. Some cookies are deleted after less than an hour, while others can remain stored on a computer for several years. You also have control over the storage duration. You can manually delete all cookies through your browser at any time (see "Right to Object" below). Furthermore, cookies that are based on consent will be deleted at the latest when you withdraw your consent, though this does not affect the lawfulness of storage up to that point.

Right to Object – How Can I Delete Cookies?

You decide whether and how you want to use cookies. Regardless of which service or website the cookies come from, you always have the option to delete, deactivate, or only partially allow cookies. For example, you can block third-party cookies but allow all other cookies. If you want to determine which cookies are stored in your browser, or if you want to change or delete cookie settings, you can find this in your browser settings: Chrome: Delete, enable, and manage cookies in Chrome Safari: Manage cookies and website data in Safari Firefox: Delete cookies to remove data that websites have stored on your computer Internet Explorer: Delete and manage cookies Microsoft Edge: Delete and manage cookies If you generally don't want any cookies, you can set up your browser to notify you whenever a cookie is about to be set. This way, you can decide for each individual cookie whether you want to allow it or not. The procedure varies depending on the browser. It's best to search for instructions in Google using the search term "delete cookies Chrome" or "disable cookies Chrome" in the case of a Chrome browser.

Legal Basis

Since 2009, there have been so-called "Cookie Guidelines". These stipulate that the storage of cookies requires your consent (Article 6(1)(a) GDPR). However, there are still very different responses to these guidelines within EU countries. In Austria, these guidelines were implemented in Section 96(3) of the Telecommunications Act (TKG). In Germany, the Cookie Guidelines were not implemented as national law. Instead, these guidelines were largely implemented in Section 15(3) of the Telemedia Act (TMG). For absolutely necessary cookies, even where no consent exists, there are legitimate interests (Article 6(1)(f) GDPR), which are mostly economic in nature. We want to provide website visitors with a pleasant user experience, and certain cookies are often absolutely necessary for this. Where non-essential cookies are used, this only occurs with your consent. The legal basis for this is Article 6(1)(a) GDPR. In the following sections, you will be informed in more detail about the use of cookies if deployed software uses cookies.

Cookies Summary

👥 Affected Parties: Website visitors 🤝 Purpose: depends on the respective cookie. More details can be found below or from the software manufacturer that sets the cookie. 📓 Processed Data: Depends on the cookie being used. More details can be found below or from the software manufacturer that sets the cookie. 📅 Storage Duration: depends on the respective cookie, can vary from hours to years ⚖️ Legal Bases: Art. 6(1)(a) GDPR (Consent), Art. 6(1)(f) GDPR (Legitimate Interests)

7.4. Email Marketing via Squarespace

We may send you marketing emails, from which you can unsubscribe by clicking the link at the end of the email. We share your contact information with Squarespace, our email marketing provider, so that Squarespace can send these emails on our behalf.

Email Marketing Summary

👥 Affected persons: Newsletter subscribers 🤝 Purpose: Direct email advertising, notification of system-relevant events 📓 Processed data: Data entered during registration, but at minimum the email address. More details can be found in the respective email marketing tool being used. 📅 Storage duration: Duration of the subscription ⚖️ Legal basis: Art. 6 Para. 1 lit. a GDPR (consent), Art. 6 Para. 1 lit. f GDPR (legitimate interests)

To keep you up to date, we also use email marketing. In this process, if you have consented to receiving our emails or newsletters, your data will be processed and stored. Email marketing is a subset of online marketing. Through this, news or general information about a company, products, or services are sent via email to a specific group of interested people.

If you want to participate in our email marketing (usually via newsletter), you normally only need to register with your email address. For this, you fill out an online form and submit it. However, we may also ask for your form of address and name so that we can address you personally.

Generally, newsletter registration works using the "double opt-in procedure". After you register for our newsletter on our website, you receive an email through which you confirm your newsletter registration. This ensures that the email address belongs to you and that no one has registered using someone else's email address. We or a notification tool we use logs each individual registration. This is necessary so that we can prove the legally correct registration process. Usually, the time of registration, time of confirmation, and your IP address are stored. Additionally, any changes you make to your stored data are also logged.

What data is processed?

When you become a subscriber to our newsletter through our website, you confirm membership in an email list via email. In addition to IP address and email address, your form of address, name, postal address, and telephone number may also be stored. However, this only occurs if you consent to this data storage. The data marked as such is necessary for you to participate in the offered service. Providing this information is voluntary, but not providing it means you cannot use the service. Additionally, information about your device or your preferred content on our website may be stored. For more information about data storage when you visit a website, see the section "Automatic Data Storage". We record your declaration of consent so that we can always prove that it complies with our laws.

Duration of data processing

If you remove your email address from our email/newsletter distribution list, we may store your address for up to three years based on our legitimate interests, so that we can still prove your previous consent. We may only process this data if we need to defend against potential claims.

However, if you confirm that you gave us consent for newsletter registration, you can submit an individual deletion request at any time. If you permanently object to the consent, we reserve the right to store your email address in a blocklist. As long as you voluntarily subscribe to our newsletter, we will of course retain your email address.

Right to object

You have the option to cancel your newsletter subscription at any time. To do this, you simply need to revoke your consent to the newsletter subscription. This usually only takes a few seconds or one or two clicks. You will usually find a link at the end of every email to cancel the newsletter subscription. If the link really cannot be found in the newsletter, please contact us by email and we will immediately cancel your newsletter subscription.

Legal basis

The sending of our newsletter occurs on the basis of your consent (Article 6 Para. 1 lit. a GDPR). This means we may only send you a newsletter if you have actively registered for it beforehand. If applicable, we may also send you advertising messages on the basis of § 7 Para. 3 UWG, provided you have become our customer and have not objected to the use of your email address for direct advertising.

Information about specific email marketing services and how they process personal data can be found - if available - in the following sections.

7.5. Fonts

This website provides and displays font files from Google Fonts and Adobe Fonts. To properly display this website to you, these third parties may receive personal data about you, including: · Information about your browser, network, or device · Information about this website and the page you are visiting on the website · Your IP address

8. Social Media

8.1. General Information about Social Media

👥 Affected persons: Website visitors 🤝 Purpose: Presentation and optimization of our service, contact with visitors, interested parties and others, advertising 📓 Processed data: Data such as phone numbers, email addresses, contact information, user behavior data, information about your device and your IP address. More details can be found in the respective social media tool section. 📅 Storage duration: depends on the social media platforms used ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate Interests)

What is Social Media? In addition to our website, we are also active on various social media platforms. User data may be processed so that we can target users who are interested in us through social networks. Furthermore, elements of a social media platform may be directly embedded in our website. This is the case, for example, when you click a so-called social button on our website and are redirected directly to our social media presence. Social media or social networks are websites and apps through which registered members can produce content, share content openly or in specific groups, and network with other members.

What data is processed? Which data is exactly stored and processed depends on the respective provider of the social media platform. But usually, it involves data such as phone numbers, email addresses, data you enter into a contact form, user data like which buttons you click, who you like or follow, when you visited which pages, information about your device and your IP address. Most of this data is stored in cookies. Especially if you have your own profile on the visited social media channel and are logged in, data can be linked to your profile.

Duration of data processing We will inform you about the duration of data processing below if we have further information. For example, the social media platform Facebook stores data until it is no longer needed for its own purposes. However, customer data that is matched with your own user data is deleted within two days. In general, we only process personal data for as long as is absolutely necessary for the provision of our services and products. If required by law, as in the case of accounting, this storage period may be exceeded.

Right to object You also have the right and the opportunity to revoke your consent to the use of cookies or third-party providers like embedded social media elements at any time. This works either through our cookie management tool or through other opt-out functions. For example, you can also prevent data collection through cookies by managing, deactivating, or deleting cookies in your browser. Since cookies may be used with social media tools, we also recommend our general privacy policy on cookies. To find out exactly what data is stored and processed by you, you should read the privacy policies of the respective tools.

Legal basis If you have consented to your data being processed and stored through integrated social media elements, this consent serves as the legal basis for data processing (Art. 6 para. 1 lit. a GDPR). In principle, if you have given consent, your data will also be stored and processed on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR) in fast and good communication with you or other customers and business partners. However, we only use the tools if you have given your consent. Most social media platforms also set cookies in your browser to store data. We therefore recommend that you read our privacy text about cookies carefully and view the privacy policy or cookie policy of the respective service provider. Information about special social media platforms can be found - if available - in the following sections.

8.2. Facebook

Facebook Privacy Policy Summary 👥 Data Subjects: Website visitors 🤝 Purpose: Optimization of our service 📓 Processed data: Data such as customer data, user behavior data, information about your device and your IP address. More details can be found below in the privacy policy. 📅 Storage duration: until the data is no longer useful for Facebook's purposes ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. f GDPR (Legitimate interests)

What are Facebook Tools? We use selected Facebook tools on our website. Facebook is a social media network of Meta Platforms Inc., or for the European region, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. With these tools, we can offer you and people interested in our products and services the best possible experience. When data is collected and forwarded through our embedded Facebook elements or through our Facebook page (fan page), both we and Facebook Ireland Ltd. are responsible for this. Facebook alone bears responsibility for the further processing of this data. Our joint obligations have also been anchored in a publicly accessible agreement at https://www.facebook.com/legal/controller_addendum. This stipulates, for example, that we must clearly inform you about the use of Facebook tools on our site. Furthermore, we are also responsible for ensuring that the tools are integrated into our website in a privacy-compliant manner. Facebook, on the other hand, is responsible for the data security of Facebook products. If you have any questions about data collection and data processing by Facebook, you can contact the company directly. If you direct the question to us, we are obligated to forward it to Facebook. In the following, we provide an overview of the various Facebook tools, what data is sent to Facebook, and how you can delete this data. Among many other products, Facebook also offers the so-called "Facebook Business Tools". This is Facebook's official designation. Since the term is hardly known, we have decided to simply call them Facebook tools. These include, among others: · Facebook Pixel · Social plugins (such as the "Like" or "Share" button) · Facebook Login · Account Kit · APIs (Programming interface) · SDKs (Collection of programming tools) · Platform integrations · Plugins · Codes · Specifications · Documentation · Technologies and services Through these tools, Facebook extends services and has the ability to obtain information about user activities outside of Facebook.

Why do we use Facebook tools on our website? We want to show our services and products only to people who are really interested in them. With the help of advertisements (Facebook Ads), we can reach exactly these people. However, to show users appropriate advertising, Facebook needs information about people's wishes and needs. This way, information about user behavior (and contact data) on our website is made available to the company. This allows Facebook to collect better user data and show interested people appropriate advertising about our products or services. The tools thus enable customized advertising campaigns on Facebook. Facebook calls data about your behavior on our website "Event Data". These are also used for measurement and analytics services. Facebook can thus create "campaign reports" on our behalf about the impact of our advertising campaigns. Furthermore, through analytics, we get a better insight into how you use our services, website, or products. This allows us to optimize your user experience on our website with some of these tools. For example, you can use the social plugins to share content directly on Facebook.

What data is stored by Facebook tools? Through the use of individual Facebook tools, personal data (customer data) can be sent to Facebook. Depending on the tools used, customer data such as name, address, phone number, and IP address may be sent. Facebook uses this information to match the data with data it already has from you (if you are a Facebook member). Before customer data is transmitted to Facebook, a so-called "hashing" takes place. This means that any size dataset is transformed into a string of characters. This also serves to encrypt data. In addition to contact data, "Event Data" is also transmitted. "Event Data" refers to the information we receive about you on our website. For example, which subpages you visit or which products you buy from us. Facebook does not share the information received with third parties (such as advertisers) unless the company has explicit permission or is legally obligated to do so. "Event Data" can also be linked to contact data. This allows Facebook to offer better personalized advertising. After the already mentioned matching process, Facebook deletes the contact data again. To deliver advertisements optimally, Facebook only uses Event Data when it has been aggregated with other data (collected by Facebook in other ways). Facebook also uses this Event Data for security, protection, development, and research purposes. Much of this data is transferred to Facebook via cookies. Cookies are small text files used to store data or information in browsers. Depending on the tools used and whether you are a Facebook member, different numbers of cookies are created in your browser. In the descriptions of the individual Facebook tools, we go into more detail about individual Facebook cookies. You can also find general information about the use of Facebook cookies at https://www.facebook.com/policies/cookies.

How long and where is the data stored? In general, Facebook stores data until it is no longer needed for its own services and Facebook products. Facebook has servers distributed worldwide where its data is stored. However, customer data is deleted within 48 hours after it has been matched with their own user data.

How can I delete my data or prevent data storage? According to the General Data Protection Regulation, you have the right to information, rectification, portability, and deletion of your data. A complete deletion of the data only occurs if you completely delete your Facebook account. And this is how deleting your Facebook account works:

  1. Click on Settings on the right side of Facebook.

  2. Then click on "Your Facebook Information" in the left column.

  3. Now click on "Deactivation and Deletion".

  4. Choose "Delete Account" and then click on "Continue to Account Deletion"

  5. Now enter your password, click on "Continue" and then on "Delete Account" The storage of data that Facebook receives through our site occurs, among other things, via cookies (e.g., with social plugins). In your browser, you can deactivate, delete, or manage individual or all cookies. Depending on which browser you use, this works in different ways. Under the "Cookies" section, you will find the relevant links to the respective instructions for the most popular browsers. If you generally don't want cookies, you can set up your browser to notify you whenever a cookie is about to be set. This way you can decide for each individual cookie whether to allow it or not.

Legal basis If you have consented that data from you can be processed and stored by integrated Facebook tools, this consent serves as the legal basis for data processing (Art. 6 para. 1 lit. a GDPR). In principle, your data is also stored and processed on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR) in fast and good communication with you or other customers and business partners. Nevertheless, we only use the tools if you have given your consent. Most social media platforms also set cookies in your browser to store data. That's why we recommend you read our privacy text about cookies carefully and view Facebook's privacy policy or cookie guidelines. Facebook also processes data from you in the USA, among other places. We point out that according to the European Court of Justice, there is currently no adequate level of protection for data transfer to the USA. This may be associated with various risks to the lawfulness and security of data processing. As a basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, thus particularly in the USA) or data transfer there, Facebook uses so-called standard contractual clauses (= Art. 46. Para. 2 and 3 GDPR). Standard contractual clauses (Standard Contractual Clauses – SCC) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when transferred to third countries (such as the USA) and stored there. Through these clauses, Facebook commits to comply with European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among others: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de The Facebook Data Processing Terms, which correspond to the standard contractual clauses, can be found at https://www.facebook.com/legal/terms/dataprocessing. We hope we have brought you the most important information about the use and data processing by the Facebook tools. If you want to learn more about how Facebook uses your data, we recommend you read the data policies at https://www.facebook.com/about/privacy/update.

8.3. Instagram

Instagram Privacy Policy Summary 👥 Affected parties: Website visitors 🤝 Purpose: Optimization of our service 📓 Processed data: Data such as user behavior data, information about your device and your IP address. More details can be found below in the privacy policy. 📅 Storage duration: until Instagram no longer needs the data for their purposes ⚖️ Legal basis: Art. 6 Para. 1 lit. a GDPR (Consent), Art. 6 Para. 1 lit. f GDPR (Legitimate Interests)

What is Instagram? We have integrated Instagram features on our website. Instagram is a social media platform owned by Instagram LLC, 1601 Willow Rd, Menlo Park CA 94025, USA. Instagram has been a subsidiary of Meta Platforms Inc. since 2012 and belongs to the Facebook products. The integration of Instagram content on our website is called embedding. This allows us to show you content such as buttons, photos, or videos from Instagram directly on our website. When you visit pages of our website that have an Instagram feature integrated, data is transmitted to Instagram, stored, and processed. Instagram uses the same systems and technologies as Facebook. Your data is thus processed across all Facebook companies. In the following, we want to give you a more detailed insight into why Instagram collects data, what data it is, and how you can largely control the data processing. Since Instagram belongs to Meta Platforms Inc., we obtain our information both from the Instagram policies and from the Meta privacy policies themselves. Instagram is one of the most well-known social media networks worldwide. Instagram combines the advantages of a blog with the advantages of audiovisual platforms like YouTube or Vimeo. You can upload photos and short videos on "Insta" (as many users casually call the platform), edit them with various filters, and also share them on other social networks. And if you don't want to be active yourself, you can also just follow other interesting users.

Why do we use Instagram on our website? Instagram is the social media platform that has really taken off in recent years. And of course, we have also responded to this boom. We want you to feel as comfortable as possible on our website. Therefore, a diverse preparation of our content is a matter of course for us. Through the embedded Instagram features, we can enrich our content with helpful, funny, or exciting content from the Instagram world. Since Instagram is a subsidiary of Facebook, the collected data can also be useful for personalized advertising on Facebook. This way, our advertisements only reach people who are really interested in our products or services. Instagram uses the collected data also for measurement and analysis purposes. We receive aggregated statistics and thus more insight into your wishes and interests. It is important to mention that these reports do not personally identify you.

What data does Instagram store? When you encounter one of our pages that has Instagram features (such as Instagram images or plugins) built in, your browser automatically connects with Instagram's servers. Data is sent to Instagram, stored, and processed. This happens regardless of whether you have an Instagram account or not. This includes information about our website, about your computer, about purchases made, about advertisements you see, and how you use our offer. Furthermore, the date and time of your interaction with Instagram are stored. If you have an Instagram account or are logged in, Instagram stores significantly more data about you. Facebook distinguishes between customer data and event data. We assume this is the same case with Instagram. Customer data includes things like name, address, phone number, and IP address. This customer data will only be transmitted to Instagram after it has been "hashed." Hashing means a data set is converted into a string of characters. This allows contact data to be encrypted. Additionally, the aforementioned "event data" is transmitted. Under "event data," Facebook – and consequently Instagram – understands data about your user behavior. It may also happen that contact data is combined with event data. The collected contact data is matched with data that Instagram already has from you. Via small text files (cookies) that are usually set in your browser, the collected data is transmitted to Facebook. Depending on the Instagram features used and whether you have an Instagram account yourself, different amounts of data are stored. We assume that data processing on Instagram works the same way as on Facebook. This means: if you have an Instagram account or have visited www.instagram.com, Instagram has set at least one cookie. If this is the case, your browser sends information to Instagram via the cookie as soon as you come into contact with an Instagram feature. At the latest after 90 days (after matching), this data is deleted or anonymized. Although we have dealt intensively with Instagram's data processing, we cannot say exactly what data Instagram collects and stores.

How long and where is the data stored? Instagram shares the information received between Facebook companies with external partners and with people you connect with globally. The data processing takes place in compliance with their own data policy. Your data is distributed on Facebook servers around the world, among other things for security reasons. Most of these servers are located in the USA.

How can I delete my data or prevent data storage? Thanks to the General Data Protection Regulation, you have the right to information, portability, rectification, and deletion of your data. You can manage your data in the Instagram settings. If you want to completely delete your data on Instagram, you must permanently delete your Instagram account. And this is how deleting your Instagram account works: First, open the Instagram app. On your profile page, scroll down and click on "Help Center." Now you'll get to the company's website. Click on "Managing Your Account" on the website and then on "Delete Your Account." If you delete your account completely, Instagram deletes posts such as your photos and status updates. Information that other people have shared about you does not belong to your account and consequently will not be deleted. As mentioned above, Instagram primarily stores your data via cookies. You can manage, deactivate, or delete these cookies in your browser. Depending on your browser, management always works slightly differently. Under the "Cookies" section, you will find the corresponding links to the respective instructions for the most popular browsers. You can also generally set up your browser to always inform you when a cookie is about to be set. Then you can always individually decide whether you want to allow the cookie or not.

Legal basis If you have consented that data from you can be processed and stored by integrated social media elements, this consent serves as the legal basis for data processing (Art. 6 Para. 1 lit. a GDPR). In principle, your data is also stored and processed on the basis of our legitimate interest (Art. 6 Para. 1 lit. f GDPR) in fast and good communication with you or other customers and business partners. We only use the integrated social media elements if you have given consent. Most social media platforms also set cookies in your browser to store data. Therefore, we recommend that you read our privacy text about cookies carefully and view the privacy policy or cookie policy of the respective service provider. Instagram or Facebook processes data from you in the USA, among other places. We point out that according to the European Court of Justice, there is currently no adequate level of protection for data transfer to the USA. This can be associated with various risks to the lawfulness and security of data processing. As a basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, thus particularly in the USA) or a data transfer there, Facebook uses standard contractual clauses approved by the EU Commission (= Art. 46. Para. 2 and 3 GDPR). These clauses oblige Facebook to comply with the EU level of data protection when processing relevant data outside the EU. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the clauses here, among others: https://germany.representation.ec.europa.eu/index_de. We have tried to provide you with the most important information about data processing by Instagram. On https://help.instagram.com/519522125107875 you can learn more about Instagram's data policies.

8.4. TikTok

We also use TikTok, a social media and video channel. The service provider is the Chinese company Beijing Bytedance Technology Ltd. For the European region, the Irish company TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, is responsible. TikTok processes data from you in the USA, among other places. We point out that according to the European Court of Justice, there is currently no adequate level of protection for data transfer to the USA. This can be associated with various risks to the lawfulness and security of data processing. As a basis for data processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, thus particularly in the USA) or a data transfer there, TikTok uses so-called standard contractual clauses (= Art. 46. Para. 2 and 3 GDPR). Standard contractual clauses (Standard Contractual Clauses – SCC) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when transferred to third countries (such as the USA) and stored there. Through these clauses, TikTok commits to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among others: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de You can learn more about the standard contractual clauses and the data processed through the use of TikTok Pixel in the Privacy Policy at https://www.tiktok.com/legal/privacy-policy-eea?lang=de or https://ads.tiktok.com/i18n/official/policy/controller-to-controller.

8.5. LinkedIn

We also use LinkedIn, a social media network platform for business contacts owned by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. On our website, you will find a link to our profiles. LinkedIn Ireland Unlimited Company Wilton Place in Dublin is responsible for European data processing. The company processes data from you in the USA, among other places. We point out that according to the European Court of Justice, there is currently no adequate level of protection for data transfer to the USA. You can find out how LinkedIn uses and stores your data here: https://de.linkedin.com/legal/privacy-policy.

9. Questionnaire: Typeform

👥 Affected persons: All those who complete a personalized skin or hair recommendation consultation on the website. 🤝 Purpose: Recommendations and materials e.g. e-book are tailored to your health data. 📓 Processed data: Health data - data about skin, hair and product preferences. More details can be found below in the privacy policy. 📅 Storage duration: until deletion request. ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. b GDPR (contract execution), Art. 6 para. 1 lit. f GDPR (legitimate interests)

We use Typeform, a survey software, for our website. The service provider is the Spanish company Typeform, 163 Carrer de Bac de Roda, Barcelona, Spain. You can learn more about the data processed through Typeform in the privacy policy at https://admin.typeform.com/to/dwk6gt. The processing of your medical data via the questionnaire is optional. However, if you do not provide this information through your consent and answering the questions, you cannot perform checks and receive recommendations. We use your data to provide you with skincare consultation information, improve our app, and contribute to research in cosmetic sciences. Your data is stored in a pseudonymized form, which means that your name is not stored together with your health data. Only your assigned skin expert has access to your name and data. We only provide third parties with anonymized data analyses. Both Typeform and we can delete your data upon request.

10. Workshops: Eventbrite

👥 Affected persons: Visitors to the Eventbrite page via our website or app 🤝 Purpose: Workshop booking and payment processing 📓 Processed data: Data such as names and email addresses payment data More details can be found below in the privacy policy. 📅 Storage duration: until cooperation with Eventbrite is terminated. ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. b GDPR (contract execution), Art. 6 para. 1 lit. f GDPR (legitimate interests)

We use Eventbrite for registration and conducting our workshops. The EU headquarters is located at Unit 3100, Lake Drive, Citywest Business Campus Dublin 24, Citywest, Dublin. By providing your email address, you agree that we may send you information about the workshop. You can learn more about the data processed by Eventbrite and how to delete it in the privacy policy at https://www.eventbrite.de/help/de/articles/460838/datenschutzrichtlinien-von-eventbrite/ and https://www.eventbrite.de/help/de/articles/363929/f-a-fragen-und-antworten-zum-eu-datenschutz-von-eventbrite/.

11. Stripe Payment System

👥 Affected persons: Website visitors who purchase vouchers or e-books from our webshop. 🤝 Purpose: Payment transactions 📓 Processed data: Data such as names, address, bank details, IP data and contract data. More details can be found below in the privacy policy. 📅 Storage duration: until cooperation with Stripe is terminated ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. b GDPR (contract execution)

For payment processing on our webshop, we use Stripe Payments Europe, based at Europe Ltd, 1 Grand Canal Street, Dublin Ireland. Data necessary for payment such as name, email address, billing address, and payment method are forwarded to Stripe and stored there. You can learn more about the data processed by Stripe and how to delete it in the privacy policy at https://stripe.com/de/privacy.

12. App

12.1. Registration/Login via Google

👥 Affected persons: All who use the app and Google login. 🤝 Purpose: Processing of customer communication 📅 Storage duration: Duration of business case and legal requirements ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. b GDPR (Contract processing), Art. 6 para. 1 lit. f GDPR (Legitimate interests)

We use the "Sign in with Google" function as a login and communication system for the Foolproof Skin App.

Google only shares the following data linked to your Google account with us:

  • Your name

  • Your email address

The European headquarters of the service provider is Google Building Gordon House, Barrow St, Dublin 4, Ireland.

More information about Google third-party login can be found here: https://support.google.com/accounts/answer/12921417?sjid=14791533738146793547-EU

12.2. Data we collect through the app

👥 Affected persons: All who use the app and agree to these privacy terms at login. 🤝 Purpose: Processing of core app functions 📅 Storage duration: Duration of business case and legal requirements ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (Consent), Art. 6 para. 1 lit. b GDPR (Contract), Art. 6 para. 1 lit. f GDPR (Legitimate interests)

When you use our app, we automatically collect the following information after your consent to our terms of use.

  • Device information to provide you with the operating system in the appropriate format for your device model.

  • Location and usage information such as IP address for approximate location determination and time zone, to display the correct language and store climate and time information for your personalized information. You can change these settings later, however, this will limit the functionality of the app.

  • Health data that we collect both through the questionnaire in our app and through the diary or tracking of your symptoms, to provide you with personalized skin and hair information (core function). These are always at least pseudonymized.

  • Data from third-party providers such as Apple Health Kit and Google Health Connect, if you give us your consent. Using your health data such as fitness activities, body temperature, and sleep duration, we can provide you with personalized information. You can learn how to manage your data here: Apple Health KitandGoogle Health Connect

12.3. How we use personal data

👥 Affected persons: All who use the app and agree to these privacy terms at login. 🤝 Purpose: App improvement and research purposes 📅 Storage duration: Duration of business case and legal requirements ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (Consent)

In addition to our core service of personalized skin and hair care consultation, which we provide as part of our contractual obligations, we use your anonymized data for the following purposes:

  • FOOLPROOF SKIN App improvement: We conduct technical analyses and optimize performance, algorithms, and functions to better adapt the app to your needs. Your data is anonymized for these analyses.

  • Advancing skin and hair research: We share relevant anonymized data with scientific institutions such as the Medical University of Vienna to contribute to improving healthcare.

  • Improving cosmetic products: We sell relevant anonymized data to selected local companies so they can develop their products further.

You can contact us at any time if you do not want us to use your data for these additional purposes. Please write to us at hello@foolproofskin.org.

13. Explanation of Terms Used

We always strive to make our privacy policy as clear and understandable as possible. However, this is not always easy, especially when it comes to technical and legal topics. It often makes sense to use legal terms (such as personal data) or certain technical expressions (such as cookies, IP address). However, we do not want to use these without explanation. Below you will find a list of important terms used that we may not have sufficiently covered in the privacy policy so far. If these terms are taken from the GDPR and are definitions, we will also cite the GDPR texts here and add our own explanations where appropriate.

13.1. Consent

Definition according to Article 4 of the GDPR For the purposes of this Regulation, the term: "consent" of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; Explanation: On websites, such consent is usually obtained through a cookie consent tool. You're probably familiar with this. Whenever you visit a website for the first time, you're usually asked via a banner whether you consent to data processing. You can usually also make individual settings and decide for yourself which data processing you allow and which you don't. If you don't consent, no personal data about you may be processed. In principle, consent can of course also be given in writing, i.e., not via a tool.

13.2. Personal Data

Definition according to Article 4 of the GDPR For the purposes of this Regulation, the term: "personal data" means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Explanation: Personal data therefore includes all data that can identify you as a person. This typically includes data such as: · Name · Address · Email address · Postal address · Phone number · Date of birth · Identification numbers such as social security number, tax identification number, ID card number, or student ID number · Banking data such as account number, credit information, account balances, etc. According to the European Court of Justice (ECJ), your IP address also counts as personal data. IT experts can use your IP address to determine at least the approximate location of your device and subsequently you as the connection owner. Therefore, storing an IP address also requires a legal basis under the GDPR. There are also so-called "special categories" of personal data that are particularly worthy of protection. These include: · racial and ethnic origin · political opinions · religious or philosophical beliefs · trade union membership · genetic data such as data obtained from blood or saliva samples · biometric data (this is information about psychological, physical, or behavioral characteristics that can identify a person) Health data · Data concerning sexual orientation or sex life

13.3. Health Data

Definition according to Article 4 of the GDPR For the purposes of this Regulation, the term: "health data" means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; Explanation: Health data therefore includes all stored information concerning your own health. Often these are data that are also recorded in a patient file. This includes, for example, which medications you use, X-rays, your complete medical history, or typically also your vaccination status.

13.4. Profiling

Definition according to Article 4 of the GDPR For the purposes of this Regulation, the term: "profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements; Explanation: In profiling, various pieces of information about a person are collected to learn more about that person. In the web sector, profiling is frequently used for advertising purposes or for credit checks. Web or advertising analysis programs, for example, collect data about your behavior and interests on a website. This results in a special user profile that can be used to target advertising to a specific audience.

14. Conclusion

All texts are protected by copyright. Source: Partially created with the Privacy Policy Generator by AdSimple and Squarespace https://support.squarespace.com/hc/de/articles/360002123427-Beispieltexte-für-Ihre-Datenschutzerklärung.