Privacy Information
Data protection is a matter of trust, and your trust is important to us. The data processing of Schnell Cosmetics Vertriebs GmbH, represented by the managing director Andreas Schnell (hereinafter also “we” or “us”) as the controller within the meaning of Art. 4 No. 7 GDPR, is of course based on the statutory provisions.
Since 25 May 2018, the uniform requirements of the EU General Data Protection Regulation (GDPR) have applied throughout Europe in the area of data protection. In the following privacy information, we inform you about the processing of personal data carried out by Schnell Cosmetics Vertriebs GmbH – Schlossstraße 16/2 – 71711 Steinheim an der Murr, in accordance with the GDPR and the Federal Data Protection Act (BDSG 2018)
Your information:
These data use notices inform visitors and customers who conclude contracts on our website about the collection, processing and use of data when visiting, registering and concluding contracts as well as about objection, withdrawal and other rights to which you are entitled as a person affected by the collection and use of data.
1. What do we do with your personal data?
1.1. What are personal data
Personal data are all information relating to an identified or identifiable natural person (hereinafter “data subject”). For identifiability, the indication of a name is not necessarily required. Indirect identifiability is also sufficient, e.g. by means of assignment to an identification number, to location data, to an online identifier or to one or more special characteristics. It is therefore about your identity. This includes, for example, your name, but also your telephone number, your address, as well as other data that you provide to us.
Many legal bases for our data processing are found in the European General Data Protection Regulation (GDPR), the text and the related recitals of which you can find, for example, here. In the following notes, we refer to corresponding provisions as the respective legal basis of our processing.
2. Data use for contract processing and internal organization
2.1. Initiation and performance of the contract
If you make an enquiry to us or conclude a contract with us, we require and process certain data, such as the information on the intended or made order, your address, e-mail address and payment processing data for the pre-contractual review, contract processing as well as any later warranty or guarantee processing (see as basis Art. 6 (1) sentence 1 lit. b GDPR). Within the framework of order and payment processing, the service providers used by us for this purpose (e.g. logistics companies, payment intermediaries) receive the data necessary in each case about your person or about the order. We also carry out creditworthiness checks (see point 18 below). Without corresponding correct information, we cannot accept orders or cannot offer you certain payment options.
In addition, commercial and tax law obliges us to archive data from the concluded transactions for the duration of the statutory retention periods.
(legal basis for the corresponding data uses is Art. 6 (1) lit. c GDPR)
2.2. Processing in the corporate organization
Within the framework of our corporate organization, we process your data in our IT systems and transmit, insofar as necessary, data of customers, interested parties, suppliers and personnel in accordance with statutory duties to authorities, such as tax authorities, and to advisers (tax advisers, lawyers, auditors) in accordance with our interests in legally compliant and economical corporate management.
(legal basis Art. 6 (1) lit. c and f GDPR)
In this context, for corporate management and market research purposes, we analyse data on all corporate and business transactions. Insofar as no necessity arises from the specific purpose, the data are largely anonymised or at least evaluated pseudonymously and at most made accessible to third parties in aggregated form detached from persons.
(legal basis Art. 6 (1) lit. c and f GDPR)
2.3. Outsourced IT and hosting
We make use of IT, software and hosting services from service providers within the framework of the provision of services and the fulfillment of your concerns and our contractual obligations on the basis of our interests in efficient and secure corporate and contract performance. In doing so, your data regarding your interests, concerns, orders and visits or perceptions of our service offers are also processed with the help of the services of these service providers.
Insofar as required by law and not already secured by rules on professional secrecy, in cases of processing on behalf we have contractually secured our access and the secure and confidential handling of your data.
(legal basis Art. 6 (1) lit. f GDPR, if applicable in conjunction with Art. 28 GDPR, conclusion of a data processing agreement)
3. Data storage, customer account
In order to enable you the greatest possible comfort, we offer you the permanent storage of your personal data in a password-protected customer account/user account. The creation of the customer account is voluntary. If you create a customer account, the processing of the data collected here is based on Article 6 (1) letter b) GDPR. After setting up a customer account, no renewed data entry is required. In addition, you can view and change the data stored about you in your customer account at any time.
Only if you wish to place orders via our website/application is the opening of a customer account mandatory for the processing of the contract.
In addition to the data requested when placing an order, you must specify a self-selected password for the creation of a customer account. This, together with your e-mail address, serves for access to your customer account. Please treat your personal access data confidentially and, in particular, do not make them accessible to any unauthorized third party. Please note that you will remain automatically logged in even after leaving our website, unless you actively log out.
You have the possibility to delete your customer account at any time. Please note, however, that this does not at the same time result in deletion of the data visible in the customer account if you have ever ordered from us. The deletion of your data takes place automatically after expiry of the commercial and tax retention obligations applicable to us.
(legal basis for this further data processing is Art. 6 (1) letter c) GDPR as well as Art. 6 (1) letter f) GDPR)
4. Contact
If you contact us via our contact options (e.g. via e-mail), we store your name and your contact data as well as your concern. The data are used to process your concern and to communicate with you. We use your e-mail in order to be able to answer you by e-mail
(legal basis Art. 6 (1) sentence 1 lit a and b GDPR)
In the case of questions about specific orders or if we are to do something personally for you, we require your correct name. In the case of other questions, you can also provide a pseudonym. If your concern has been finally dealt with and there are no other retention obligations, the data will be deleted again.
5. Data use for advertising
We are interested in maintaining the customer relationship with you, acquiring new customers, reactivating old customers and providing our customers with information and offers. For the exercise of these legitimate interests, we process, on the basis of Art. 6 (1) lit. f GDPR (also with the help of service providers), your data in order to communicate information and personalized offers from us to you and to improve our information and offers. In our advertising measures, we pursue the interest of protecting you as far as possible from unwanted or non-interest-appropriate advertising. In order to be able to take your interests into account, we include such data in the selection of information of which you know that we know it. This includes, for example, orders, information already received or your reactions to corresponding advertising information on postal advertising or our newsletters and e-mail information. Where this is technically and economically sensible for the pursuit of the purposes, we, in order to safeguard your interests, separate corresponding data from your person, pseudonymise them and, before an evaluation, form groups (clusters) in which the individual information is absorbed. We carry out the following data uses on the basis of the aforementioned statutory basis without asking you separately for your consent.
5.1. Postal advertising
We use your first and last name, your postal address and—if we have received these additional details from you—your title, academic degree, your date of birth and your profession, industry or business designation for the sending of offers and information about our company and our services and products by letter post, if, after an evaluation of the data stated at the beginning of this section, we expect that this information is in your interest.
5.2. E-mail advertising for our own similar offers
If we receive your e-mail address in connection with the sale of goods, we use the e-mail address to advertise our own similar products. You can also object to any advertising use at any time without any costs other than the transmission costs according to the basic tariffs arising.
We carry out the following uses only after we have asked you for your consent outside this declaration. Art. 6 I lit. a GDPR serves our company as legal basis for processing operations in which we obtain consent for a specific processing purpose. (Acceptance of these notes does not yet constitute your consent to the corresponding use of your data for advertising purposes!)
5.3. E-mail advertising with separate consent
If you have separately registered for our newsletter, your e-mail address and, where applicable, further personal data that you have voluntarily provided to us during registration (e.g. your name for addressing) are used for our own advertising purposes and, where applicable, for advertising partner offers contained in the newsletter.
We evaluate statistically when such an e-mail is accessed and, where applicable, which information offers and with what intensity these meet with interest (for example when a link is accessed). The evaluation is carried out to improve the delivery times and to optimize the content of our offers and advertising information.
6. Use of your data when visiting our pages
Insofar as we collect or have data collected with the help of web analysis tools and use web advertising tools, we inform you in detail about this under (point 10. Data collection when visiting our pages). There you will also find out how you can exercise your right to object and which technical options are available to you to counter data collection.
7. Right of withdrawal and objection in relation to advertising
Of course, you can object to a use of your data for advertising purposes (see point 1, point 3 and point 5) at any time, also insofar as this use is permitted by law without your consent, by informal notification to us, or withdraw consent that has been given. Objection and withdrawal each result in a stop of future use. Uses prior in time to the assertion of your right remain unaffected. We do not charge any separate costs for an objection or withdrawal. (In particular, if you notify us by e-mail, you will not incur any further costs except the transmission costs according to the basic tariffs of your provider). Simply address your objection or withdrawal to one of the contact options listed at the end of these notes.
In our advertising e-mails and in the newsletter, you will in each case receive a note with an address or
a link for easy unsubscribing from this information.
Please consider that in individual cases you may still receive advertising despite objection or withdrawal. In not all cases can commissioned advertising still be stopped with reasonable effort before the next dispatch or a comparable other measure. Your possibilities of objection also extend to profiling and the use of the data that are collected within the framework of data collection when visiting our websites for purposes of direct advertising. We explain to you the technical possibilities to exercise the right to object and to prevent data collection in detail in the information about the web tools used under point 12. “Details on web analysis and advertising”. Insofar as you exercise the right to object, we no longer process the collected data for these purposes.
8. Data use in the event of your application
If you apply to us, we use and transmit the data you provide for the purposes of assessing your application documents and, if applicable, for carrying out the further application procedure (legal basis § 32 (1) BDSG or from 25.05.2018 Art. 88 GDPR in conjunction with § 26 (1) sentence 1 BDSG). An automated supplementation of your data from other sources (e.g. from social networks, creditworthiness information) does not take place.
We store your data for the duration of the application procedure and beyond that for a maximum of three months from notification of a binding decision on your application, unless an employment contract is concluded. In addition, longer storage takes place only with your express consent (legal basis Art. 4 (1) BDSG, or from 25.05.2018 Art. 6 I lit. a GDPR), insofar as we must comply with a statutory requirement (legal basis Art. 7 lit. c DSRL in conjunction with § 4 (1) BDSG, or from 25.05.2018 Art. 6 I lit. c GDPR) or where there are legitimate reasons, e.g. if claims are asserted against the non-consideration of your application (legal basis also here § 28 (1) BDSG, or from 25.05.2018 Art. 6 (1) sentence 1 lit b GDPR). After expiry of the time, your data will be deleted or only stored further in archive systems without direct access possibilities to the extent legally required for commercial and tax archiving purposes.
9. Deletion and blocking
Your personal data are stored until the stated purposes have been achieved or as long as we have a legitimate interest in the storage. Thereafter, deletion takes place insofar as no other agreements have been made with you or statutory archiving obligations (e.g. due to commercial or tax law) exist. In the case of statutorily required archiving, the data are blocked for other access. These documents are deleted and destroyed in a data protection-compliant manner after expiry of the statutory retention periods within the framework of regular actions.
If you have consented to a collection, processing and use of your data, we store and use your data for an indefinite period until a withdrawal or the purpose for which you gave the consent ceases to apply. Thereafter, an archiving of the consent and processing data takes place until the statute of limitations (regularly three years) for purposes of legal defence.
(legal basis Art. 17 (3) lit. e GDPR)
If you no longer wish to receive advertising from us, we use your name, the address and, where applicable, the e-mail address for purposes of blocking in corresponding lists with which we compare our advertising measures so that you no longer receive further advertising. Deletion in this sense therefore initially means that your data are in particular blocked in our systems for advertising and marketing activities (legal basis Art. 6 (1) lit. f GDPR). The data will—where necessary—continue to be processed for other purposes than advertising, for example within the framework of contract processing and, where applicable, warranty as well as commercial and tax documentation (legal basis Art. 6 (1) lit b and c GDPR). If, despite the possible consequence in the individual case that you may continue to receive advertising, you wish deletion instead of blocking, please inform us.
At your request, we can block personal data in whole or only in part. For this purpose, you inform us to what extent and, where applicable, for what duration the locking is to take place. Insofar as technically possible, you can in this way exclude the processing and use of your data for certain areas entirely or temporarily.
10. Data collection when visiting our pages
10.1. Technical information and cookies
You can visit our site without making entries relating to your person. When you visit our websites, even if this takes place, for example, via a link in a newsletter or an advertisement, certain data are nevertheless recorded and stored in so-called log files. Recorded—also if the visit takes place, where applicable, via advertising links on the internet—are only access data without direct personal reference such as, for example:
• the website from which we are visited
• the page that is accessed or the name of a requested file
• type and version of your browser,
• time and date of access
• the operating system used on which the browser runs
• the name of your internet service provider
• the internet address of the accessing party (IP address)
• products and content in which the visitor is interested and the degree of interest, such as
duration, frequency, interaction with forms, navigation elements and links.
A conclusion about your person is not possible for us on the basis of these data and is also not made without your separate consent to be given. Where we learn a datum which theoretically permits conclusions about your person, such as, for example, the IP address, we have, by corresponding truncations, ensured that a reference back to your person is made more difficult thereby.
If we integrate third-party content on our pages (e.g. embedded films or other information), they receive your IP address solely for this purpose, as otherwise the content cannot be delivered to your browser.
10.2 Cookies
On our website we use so-called cookies. Cookies are small files that are stored on your end device and that store certain settings and data for exchange with our system or the systems of service providers via your browser. This storage helps us to design the website appropriately for you and facilitates use for you by, for example, certain entries by you being stored so that you do not have to repeat them constantly. Cookies usually contain identification characteristics. This enables users and/or browsers (software for displaying internet content) to be identified and distinguished from other users and browsers and to be recognized again when visiting.
Many cookies are automatically deleted again from your hard drive at the end of the browser session (end of the session) (therefore also session cookies). However, there are also cookies that remain stored with you permanently. The expiry time is set to a point in the future for your convenience. On a further visit, it is then automatically recognized that you have already been with us and which entries and settings you prefer (so-called long-term cookies). Some of these cookies serve to display information specifically tailored to your interests on our website or the website of our partners.
(Cookies not requiring consent)
Cookies that ensure functions without which you could not use this website as intended are used only by us and their contents are not made accessible to third parties. Such cookies not requiring consent are used by us on the basis of Art. 6 (1) lit. b GDPR.
(Other cookies)
With regard to other cookies, a notice is already given when you visit our site, also referring to these data protection notices. In doing so, you may consent to the use of these cookies by accepting the declaration by pressing the button “Close and accept”. The consent text reads:
“Data protection + cookies: On our website we use cookies from us and selected partners.
We use offers from third parties. These third parties can also set cookies. Cookies from third parties, so-called third party cookies, are set by the partners who in turn are interested in informing you about offers that are in your presumed interest. You can inform yourself on the websites of the third-party providers about the use of cookies. If you block the cookies, not all content and functionalities can be made available to you. For unrestricted use, you must grant your consent again and remove corresponding blocks.”
10.3. Your technical objection options
Irrespective of the set duration, you can manually delete cookies in your browser. In some browser settings, acceptance of cookies is preset without restrictions. You can allow or prohibit temporary and stored cookies independently of each other in the security settings of your browser. Apart from browser settings that generally deactivate the automatic setting of cookies, you can also deactivate cookies by setting your browser so that cookies from a specific domain,
e.g. „googleadservices.com”, are blocked. This setting then prevents the execution of corresponding services that set cookies from this domain.
Some web services work with opt-out cookies. The cookie to be set by you (hereinafter “blocking cookie”) is then recognized, for example, by a web analysis service that you do not wish any collection. Google allows, for example, options to make advertising settings for numerous other networks. If you use the option in your browser to delete all cookies, remember that then, where applicable, corresponding settings or the setting of blocking cookies must be carried out again!
Accepting cookies is not a prerequisite for visiting our online offer. If you do not accept cookies or deactivate them, however, certain options (e.g. services, purchasing options, storage of a shopping cart and information) on our site may not be available to you and some websites may not be displayed
correctly.
If you wish to conclude contracts with us, you must accept certain cookies. If you do not wish this, then no conclusion of contract can take place. Further information about the use of cookies can be found on the pages of the German Association for the Digital Economy (BVDW) e.V.
If you do not wish the use of cookies requiring consent, you can exercise your rights thereto by technical means that we have explained to you under 10.3. or 12.2. “Your technical objection options”.
11. Profiling of user profiles
The law knows the creation of automated data collections about a person under the term profiling. Profiling is, pursuant to Art. 4 No. 4 GDPR, any type of automated processing of personal data that consists of these personal data being used to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behavior, whereabouts or change of location of that natural person.
We create pseudonymised, i.e. separated from identifiers to your person, user profiles of a statistical nature in order to be able to draw conclusions about interests in our content and offers by means of an evaluation and to tailor corresponding information and offers to users of corresponding interests.
Furthermore, we use the information to improve data security, to counter attacks on our systems and, where applicable, to support law enforcement authorities in the event of attacks on our systems or other criminal acts.
For the analysis of user behavior, we use corresponding web analysis tools. You can find out more below under “Details on web analysis and advertising”.
You can also object to profiling with personal data as well as to the further use of the profile data for advertising purposes and withdraw consents granted by you for this (see I. item 6). The exercise of the possibility of objection against profiling by web analysis and advertising measures— insofar as these work with personal data—takes place by technical measures which we explain to you below under II. item 3 in each case.
12. Details on web analysis and advertising
On the basis of our legitimate interests in the analysis, improvement and economic operation of our offers within the meaning of Art. 6 (1) lit. f GDPR, we use the following services:
This website uses Google Analytics for web analysis. This is a service of Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (“Google”). Google Analytics uses “cookies”. The information generated by the cookies about your use of our internet oer (including your IP address) is transmitted to computers of Google and stored there. It cannot be excluded that the data processing takes place outside the scope of application of EU law. Google has joined the Privacy
Shield, so that Google guarantees compliance with EU data protection standards.
By means of an identification, for example in the case of a login with Google services, the abovementioned data can also be recorded and used across devices. This makes it possible, for example, to record that you start your visit with us on a PC and continue it on a mobile device and the data of both devices can be linked.
Google will use this information to evaluate your use of the website on our behalf, to compile reports about website activities for us, to form interest-related target groups and to provide us with further services associated with website use and internet use. Google will also, where applicable, transmit this information to third parties insofar as this is required by law or insofar as third parties process these data on behalf of Google. Google will not associate your IP address with other data of Google. Deletion of the analytics data is set to 14 months. The time is based on our interest in being able to make temporal comparisons with statistical data.
You can prevent the installation of the cookies by a corresponding setting of your browser software; however, we point out that in this case you may not be able to use all functions of this website and the services desired by us to their full extent.
12.1. Use of demographic characteristics with Google Analytics
Google offers the function “demographic characteristics”. With this, compilations about the site visitors can be created with statements about age, gender and interests. Google obtains these data from interest-related advertising and from visitor data of third-party providers. The data are not assigned to a specific person and are anonymised.
12.2. Your technical objection options
If you do not wish information about your website visit to be transmitted to Google Analytics, you have the possibility to install a “deactivation add-on” for your browser.
If you do not wish to receive interest-based advertising, you can deactivate the use of cookies by Google for these purposes. You can also deactivate the use of cookies by Google. As an alternative thereto or within browsers on mobile devices, you can object to the use of Google Analytics by using the following link. By activating the link, an opt-out cookie is set in order to prevent collection by Google Analytics within this website in the future. Please note that this opt-out cookie
works only in this browser and only for this domain. As soon as you delete your cookies in this browser, you must click the link again: Disable Google Analytics.
13. Right of objection and withdrawal in the case of user profiles and cookies
Inter alia pursuant to Art. 21 (4) GDPR, you have a right to object to the creation of user profiles, in particular if these are created for advertising purposes. You can withdraw consent to the setting and use of cookies at any time with effect for the future. Previous uses remain unaffected. Any personal data will then no longer be evaluated by us. How you can technically effect your objection, we have described to you in each case in the information about data collection under the heading “Your technical objection options”. If you have questions about the above-mentioned technical objection options or our other protective measures, you are welcome to contact us (contact data see below).
14. How do we protect your personal data?
14.1. General protective measures
The law requires companies to create an appropriate level of data protection. In doing so, inter alia the respective risk for the data, the probability of occurrence, the state of the art and the costs are to be brought into line. We have provided corresponding technical and organisational measures in order to realise the security of your data and their processing in accordance with the statutory requirements. If you have security concerns when entering data or other questions or suggestions, simply contact our customer service. The further contact data are listed again at the end of these notes. Your personal data are transmitted securely by encryption when placing an order as well as when registering for your personal access. For this, we use the SSL (Secure Socket Layer) coding system. We secure our website and other systems by technical and organisational measures against loss, destruction, access, alteration and dissemination of your data by unauthorized persons. You should always treat your access information confidentially and close the browser window when you have ended communication with us, in particular if you use the computer together with others.
15. Protection of your payment data
If you provide us with your bank details, then we store these data only encrypted on our servers. Your account number or IBAN is also generally not displayed completely but only in a shortened form that is intended to allow you to identify the bank connection.
In the case of payment with PayPal, we do not receive any account or credit card data. You have stored these with PayPal. We receive only the PayPal e-mail address. Otherwise, data entry at PayPal takes place according to their security rules. In the case of payment via PayPal, your payment data are forwarded within the framework of payment processing to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”). PayPal reserves the right, for the payment methods credit card via PayPal, direct debit via PayPal or—if offered—“purchase on account” via PayPal, to carry out a creditworthiness enquiry. PayPal uses the result of the creditworthiness check in relation to the statistical probability of payment default for the purpose of deciding on the provision of the respective payment method. The creditworthiness enquiry can contain probability values (socalled score values). Insofar as score values flow into the result of the creditworthiness enquiry, these have their basis in a scientifically recognised mathematical-statistical procedure. In the calculation of the score values, inter alia address data flow in. Further data protection law information, inter alia about the credit agencies used, please take from the PayPal privacy policy.
16. Logistics
If you wish to have goods delivered to a DHL packing station, we forward your DHL customer number, your name and your billing address to DHL Paket GmbH, Charles-de-Gaulle-Str. 20, 53113 Bonn for the purpose of identity verification, in order to ensure that the stated data were entered correctly and to prevent misuse.
If you do not wish the forwarding of your data, you can also have your order delivered to one of our branches at any time. Excluded from this is freight forwarding goods.
If your order includes freight forwarding goods that are delivered directly by the manufacturers, we forward, in addition to your name and the delivery address, also your telephone number and e-mail address to the manufacturers for the purpose of notification of the freight forwarding delivery. If this is the case, you will be informed of this separately in the ordering process. Legal basis for the data forwarding is Art. 6 (1) lit. b) as well as Art. 6 (1) lit. a) EU GDPR.
17. Identity and creditworthiness check and scoring
17.1. Internal check
If we provide advance performance (purchase on invoice), we check, supported by our interest in protecting ourselves against payment defaults and customers against identity misuse, on the basis of our data your current and previous payment behaviour and, where applicable, atypical ordering behaviour (e.g. orders placed within a short time under different customer accounts to the same address). The creditworthiness data that are taken into account include outstanding payments,
dunning procedures, deferral agreements due to payment defaults. Together with data from the areas of address, age, ordered product range, ordering channel and chosen payment options, within the framework of processing on behalf by our partner SCHUFA Holding AG, Komoranweg 5, 65201 Wiesbaden, the calculation of a statistical probability of default takes place on the basis of recognised mathematical-statistical procedures, the result of which is included in the external
creditworthiness enquiries listed below.
17.2. Identity and creditworthiness information of external credit agencies
We carry out, likewise supported by the interests described above, stating your address data and your date of birth, a person and address validation and receive creditworthiness information that is calculated on the basis of recognised mathematical-statistical procedures.
We use the received statistical probability values of a possible payment default, into which your address data and the results of our internal check flow and are included, for the automated decision on the desired payment and delivery options, which we may restrict. In the event of payment problems, we reserve the right, within the framework of the statutory requirements and possibilities, to transmit data on behaviour not in accordance with the contract (e.g. missing payments) to the credit agency and to commission it or other companies, where applicable, with debt collection. The credit agencies use the data for creditworthiness information in justified cases.
18. Legal basis
Legal basis for our above-mentioned checks are Art. 6 (1) lit b and lit. f GDPR. Please take the rights to which you are entitled from the following notes under
18.1.
18.1. What rights do I have?
As a person affected by data processing, you can assert certain rights provided by law.
18.1.1. Right to confirmation and information
Pursuant to Art. 15 GDPR, you have the right to request from us a confirmation as to whether personal data concerning you are processed. In the event that we process such data, you have a right to free information about your stored data. The information includes details about
• the purposes of processing
• the categories of personal data that are processed
• the recipients or categories of recipients to whom the personal data have been disclosed or are still being disclosed, in particular in the case of recipients in third countries or in the case of international organisations;
• if possible the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining this duration;
• the existence of a right to rectification or erasure of the personal data concerning you or to restriction of processing by the controller or of a right to object to this processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• if the personal data are not collected from the data subject: all available information about the origin of the data;
• the existence of automated decision-making including profiling pursuant to Article 22 (1) and (4) GDPR and—at least in these cases—meaningful information about the logic involved as well as the scope and the intended effects of such processing for the data subject.
Furthermore, the data subject has a right to information about whether personal data have been transferred to a third country or to an international organisation. If this is the case, the data subject also has the right to receive information about the appropriate safeguards in connection with the
transfer.
For questions about the collection, processing or use of personal data, for information, or for the other assertion of your rights, simply contact us via the contact data listed at the end of these notes.
18.1.2. Right to rectification
You have a right to rectification and/or completion vis-à-vis the controller insofar as the processed personal data concerning you are incorrect or incomplete. The controller must carry out the rectification without delay.
18.1.3. Right to object
You have the right to object at any time to the processing of personal data concerning you that takes place on the basis of Art. 6 (1) lit. e or lit. f GDPR; this also applies to profiling based on these provisions (cf. term II. item 2).
In the event of an objection to data processing for direct advertising (Art. 21 (2) GDPR), this processing is ended as soon as possible after receipt of the objection (see also point 7 for further details).
An objection to other processing (pursuant to Art. 21 (1) GDPR) on the basis of Art. 6 (1) lit. e or lit. f GDPR (e.g. identity and creditworthiness check) can only be made for reasons arising from your particular situation, whereby, in turn, compelling overriding reasons worthy of protection can justify our further processing.
Consents granted can be withdrawn (contact data see below). No special costs arise for you (except transmission costs according to the basic tariffs of your provider). Objection and withdrawal of consent take effect for the future. The lawfulness of data processing in the past remains unaffected.
Your objection to the identity and creditworthiness check can have the consequence that we can generally oer you only limited payment options or refuse the conclusion of a contract.
18.1.4. Right to erasure (right to be forgotten)
a) Requirements for erasure
You have the right to request the erasure of personal data concerning you. Please note that a right to immediate erasure (Art. 17 GDPR) (“right to be forgotten”) exists only if one of the following reasons applies:
• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• You withdraw your consent on which the processing pursuant to Art. 6 (1) lit. a GDPR or Art. 9 (2) lit. a GDPR was based, and there is no other legal basis for the processing.
• You lodge an objection pursuant to Art. 21 (1) GDPR to the processing, and there are no overriding legitimate grounds for the processing, or you lodge an objection pursuant to Art. 21 (2) GDPR to the processing for purposes of direct advertising.
• The personal data concerning your person have been processed unlawfully.
• The erasure of the personal data is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.
• The personal data concerning you have been collected in relation to offered services of the information society pursuant to Art. 8 (1) GDPR.
b) Further right to be forgotten
If we have made the personal data concerning you public and are obliged pursuant to Art. 17 (1) GDPR to erase them, then we take, taking into account the available technology and the implementation costs, reasonable measures, including of a technical nature, to inform controllers who process the personal data that you as a data subject have requested from them the erasure of all links to these personal data or of copies or replications of these personal data.
c) Exceptions to erasure
Please note, in addition to the above requirements, that the following exceptions can justify a refusal of your request for erasure: The right to erasure does not exist insofar as the processing is necessary
• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation that requires processing under Union law or the law of the Member States to which the controller is subject, or for the performance of a task carried out in
the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health pursuant to Art. 9 (2) lit. h and i as well as Art. 9 (3) GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right to erasure is likely to render the achievement of the objectives of this processing impossible or seriously impair it, or for the assertion,
exercise or defence of legal claims.
18.1.5. Right to restriction of processing
You are entitled to your right to restriction of processing if you contest the accuracy of the personal data for a period enabling us to verify the accuracy of the personal data or if, in the case of unlawful processing, you reject deletion and instead request the restriction of the use of personal data. You are also entitled to the right if we no longer need the data, you need these personal data for the assertion, exercise or defence of legal claims. You can finally assert this right if you have lodged an objection to the processing pursuant to Art. 21 (1) GDPR and it has not yet been determined whether the legitimate grounds of the controller outweigh your grounds. If processing has been restricted, these data may only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the Union or of a Member State. The possibility of continued storage remains unaffected. If the restriction of processing has been restricted pursuant to the above prerequisites, you will be informed by us before the restriction is lifted.
18.1.6. Right to data portability
You are also entitled to a right to data portability of the data stated by you to us, which we have processed on the basis of effective consent or whose processing was necessary for entering into or performing an effective contract, in a “structured, commonly used and machine-readable format” to you. You also have the right to request the direct transfer to another controller insofar as this is technically feasible. The right exists only insofar as the rights and freedoms of other persons are not
impaired.
18.1.7. Assertion of your rights
Please contact our customer service in the case of questions or to assert your rights (contact data see below).
You can also contact us directly by e-mail in the case of complaints; you can reach us via the following e-mail: info@flamingo-wellness.de. You also have, if we do not, in your view, handle your concern appropriately, inter alia (without prejudice to any other administrative or judicial remedy) a right to lodge a complaint with the supervisory authority responsible for data protection, in particular in the Member State of your place of residence, your place of work or the place of the alleged infringement.
Schnell Cosmetics Vertriebs GmbH
Schlossstraße 16/2
71711 Steinheim an der Murr
Germany
Telephone number: +49 (0) 7148 163 12 17
E-mail: info@schnell-cosmetics.de
www.schnell-cosmetics.de
