A GENERAL DATA PROTECTION REGULATION (GDPR)

I INFORMATION ABOUT THE COLLECTION OF PERSONAL DATA

1. NAME AND ADDRESS OF THE RESPONSIBLE PERSON

Below we inform you, a Novation cosmetics GmbH, Anni-Eisler-Lehmann-Str. 7, 55122 Mainz, Germany, Fax: +49 (0) 234 91 22 11 20, Email: info@a-novation.de (hereinafter "a | Novation "Responsible in the sense of the General Data Protection Regulation (hereinafter referred to as" GDPR ") and other national data protection laws of the member states as well as other data protection regulations, you about the collection of personal data when using our websites (hereinafter collectively "Website"). Personal data is any data that is available to the data subject, eg Name, address, email addresses, user behavior.

2. NAME AND ADDRESS OF THE DATA PROTECTION OFFICER

Our data protection officer within the meaning of Article 4 (7) of the EU General Data Protection Regulation is Bettina Wengert (Kanzlei Wengert), Feldbergstraße 120, 70569 Stuttgart. You can reach our data protection officer under: datenschutz@a-novation.de or our postal address with the addition “the data protection officer”.

3. GENERAL INFORMATION ABOUT DATA PROCESSING

Below you will find general information about the data processing by us. Detailed information on the functionalities offered by us in detail on the website and on the technologies used for this purpose can be found under II, III, and IV.

3.1 Extent of processing of personal data

In principle, we collect and use personal data only to the extent necessary to provide a functional website and our content and services. The collection and use of personal data takes place regularly only after your consent. An exception applies to cases in which prior consent is not possible for reasons of fact and the processing of the data by law is permitted.

3.2 Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing of personal data, Art. 6 para. 1 lit. a EU General Data Protection Regulation (GDPR) as the legal basis for the processing of personal data. In the processing of personal data necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR as legal basis.

This also applies to processing operations required to carry out pre-contractual actions. Insofar as processing of personal data is required to fulfill a legal obligation that is subject to our company, Art. 6 para. 1 lit. c GDPR as legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR as legal basis. If processing is necessary to safeguard the legitimate interests of our company or a third party, and if the interests, fundamental rights and freedoms of the data subject do not prevail over the first interest, Art. 6 para. 1 lit. f GDPR as legal basis for processing.

3.3 Data erasure and storage duration

The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage is deleted. In addition, such storage may take place if provided for by the European or national legislator in EU regulations, laws or other regulations to which the controller is subject. Blocking or deletion of the data also takes place when a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data for conclusion of a contract or fulfillment of the contract.

3.4 Service providers

If we rely on commissioned service providers for individual functions of our service or would like to use your data for advertising purposes, we will inform you in detail below about the respective transactions and, if necessary, obtain your separate consent at a suitable location. In doing so, we also name the specified criteria for the storage duration.

3.5 Data transfers outside the EEA

Insofar as our service providers or partners are based in a country outside the European Economic Area (EEA), we inform you about the consequences of this circumstance in the description of the offer.

We use the analytics tool Google Analytics. To do this, the data will be sent to Google in the United States. Further details on Google Analytics under VIII. Web Analytics and Online Advertising.

4. YOUR RIGHTS

4.1 Summary

You have the following rights with respect to the personal data concerning you:

• right to information,
• right to rectification or deletion,
• right to restrict processing,
• right to object to the processing,
• right to data portability.

You also have the right to complain to us about the processing of your personal data by a data protection supervisory authority.

4.2 Your rights in detail

If you process personal data, you are in the meaning of GDPR and you have the following rights to us:

4.2.1 Right to information

You may request confirmation from us as to whether personal information concerning you is processed by us. If such processing is available, you can request information from us via the following information:

(1) the purposes for which the personal data are processed;

(2) the categories of personal data being processed;

(3) the recipients or categories of recipients to whom the personal data relating to you have been disclosed or are still being disclosed;

(4) the planned duration of the storage of your personal data or, if specific information is not available, criteria for determining the duration of storage;

(5) the existence of a right to rectification or deletion of your personal data, a right of restriction of our processing or a right to object to such processing;

(6) the existence of a right of appeal to a supervisory authority;

(7) all available information on the source of the data if the personal data is not collected from the data subject;

(8) the existence of automated decision-making including profiling under Article 22 (1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved, and the scope and intended impact of such processing on the data subject.

You have the right to request information about whether your personal information relates to a third country or an international organization. In this connection, you can request the appropriate guarantees in accordance with. Art. 46 GDPR in connection with the transfer.

4.2.2 Right to rectification

You have a right to rectification and / or completion to us if the personal data you process is incorrect or incomplete. We have to correct this immediately.

4.2.3 Right to restrict processing

You may request the restriction of the processing of your personal data under the following conditions:

(1) if you contest the accuracy of your personal information for a period of time that enables us to verify the accuracy of your personal information;

(2) the processing is unlawful and you refuse the deletion of the personal data and instead demand the restriction of the use of the personal data;

(3) we no longer need the personal data for the purposes of processing, but you need it to assert, exercise or defend your rights, or

(4) if you have objected to the processing pursuant to Art. 21 (1) GDPR and it is not yet certain whether our legitimate reasons prevail over your reasons.

If the processing of personal data concerning you has been restricted, this data may only be used with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for reasons of important public interest Union or a Member State. If the limitation of the processing after the above If conditions are restricted, you will be informed by us before the restriction is lifted

4.2.4 Right to restrict processing

4.2.4.1 Deletion obligations

You may require us to delete your personal information without delay and we are required to delete that information immediately, if any of the following is true

(1) Personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.

(2) You revoke your consent, to which the processing acc. Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. GDPR and there is no other legal basis for processing.

(3) According to. Art. 21 para. 1 GDPR objection to the processing and there are no prior justifiable reasons for the processing, or you lay according to Art. 21 para. 2 GDPR Opposition to processing.

(4) Your personal data has been processed unlawfully.

(5) The deletion of personal data concerning you shall be required to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.

(6) The personal data concerning you were collected in relation to information society services offered pursuant to Art. 8 (1) GDPR..

4.2.4.2 Information to third parties

Have we made the personal data concerning you public and we are acc. Article 17 (1) of the GDPR, we shall take appropriate measures, including technical means, to inform data controllers who process the personal data that you have been identified as being affected by the technology and implementation costs Persons requesting deletion of all links to such personal data or of copies or replications of such personal data.

4.2.4.3 Exceptions

The right to erasure does not exist if the processing is necessary

(1) to exercise the right to freedom of expression and information;

(2) to fulfill a legal obligation required by the law of the Union or of the Member States to which the controller is subject, or to carry out a task which is in the public interest or in the exercise of official authority conferring on the controller has been;

(3) for reasons of public interest in the field of public health pursuant to Art. 9 (2) lit. h and i and Art. 9 (3) GDPR;

(4) for archival purposes of public interest, scientific or historical research purposes or for statistical purposes acc. Article 89 (1) GDPR, to the extent that the law referred to in subparagraph (a) is likely to render impossible or seriously affect the achievement of the objectives of that processing, or

(5) to assert, exercise or defend legal claims.

4.2.5 Right to information

If you have the right to rectify, delete or limit the processing to us, we are obliged to notify all recipients to whom your personal data have been disclosed of this correction or deletion of the data or restriction of processing, unless this proves to be impossible or involves a disproportionate effort. You have the right of us to be informed about these recipients.

4.2.6 Right to Data Portability

You have the right to receive personally identifiable information you provide us in a structured, common and machine-readable format. You also have the right to transfer this data to another person without hindrance from us, who has been provided with the personal data, provided that

(1) the processing on a consent acc. Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract acc. Art. 6 para. 1 lit. b GDPR is based and

(2) the processing is done by automated means.

In exercising this right, you also have the right to obtain that your personal data relating to you are transmitted directly by and to another person responsible where technically feasible. Freedoms and rights of other persons may not be affected. The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority delegated to the controller.

4.2.7 Right to object

You have the right at any time, for reasons that arise from your particular situation, against the processing of your personal data, which pursuant to Art. 6 para. 1 lit. e or f GDPR takes an objection; this also applies to profiling based on these provisions.

We no longer process your personal information about you unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the purpose of enforcing, pursuing or defending legal claims.

If the personal data relating to you are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct mail.

If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes. Regardless of Directive 2002/58 / EC, you have the option, in the context of the use of information society services, of exercising your right to object through automated procedures that use technical specifications.

4.2.8 Right to revoke the data protection consent declaration

You have the right to revoke your data protection declaration at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.

4.2.9 Automated decision on a case-by-case basis, including profiling

You have the right not to be subjected to a decision based solely on automated processing - including profiling - that will have legal effect or similarly affect you in a similar manner. This does not apply if the decision

(1) is required for the conclusion or performance of a contract between you and us,

(2) is permitted under Union or Member State legislation to which we are subject, and where such legislation contains appropriate measures to safeguard your rights and freedoms and your legitimate interests; or

(3) with your express consent.

These decisions may not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) lit. a or g and reasonable measures have been taken to protect the rights and freedoms and your legitimate interests .

With regard to the cases referred to in (1) and (3), we shall take reasonable steps to uphold the rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person on our part, to express his or her own position and to challenge the decision is heard.

4.2.10 Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you shall have the right to complain to a supervisory authority, in particular in the Member State of its residence, place of work or place of alleged infringement, if you believe that the processing of the personnel data concerning you is against the GDPR violates.

The supervisory authority to which the complaint has been submitted shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy pursuant to Article 78 of the GDPR.

B COLLECTION OF PERSONAL DATA WHEN VISITING OUR WEBSITE

I. CREATION OF LOG FILES

1. FUNCTIONALITY AND SCOPE

In the merely informative use of our website, our system automatically collects data and information from the computer system of the calling computer. The following data is collected here:

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• content of the request (concrete page)
• Access Status / HTTP status code
• each transferred amount of data
• Website from which the request comes
• Browser
• Operating system and its interface
• Language and version of the browser software.

The data is also stored in the log files of our system. A storage of this data together with other personal data of the user does not take place.

2. LEGAL BASIS FOR DATA PROCESSING

The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GDPR.

3. PURPOSE OF DATA PROCESSING

Storage in log files is done to ensure the functionality of the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

For these purposes, our legitimate interest in the processing of data according to Art. 6 para. 1 lit. f GDPR.

4. DURATION OF STORAGE

The data will be deleted as soon as it is no longer necessary for the purpose of its collection. In the case of collecting the data for providing the website, this is the case when the respective session is completed.

In the case of storing the data in log files, this is the case after no more than seven days. Additional storage is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.

5. OPPOSITION AND REMOVAL POSSIBILITY

The collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. Consequently, they have no possibility of contradiction.

II. USE OF COOKIES

1. FUNCTIONALITY AND SCOPE

So that you can order our products and your order is collected in a shopping cart, we use so-called "session cookies" (or also called session IDs). Session cookies are small pieces of information that a provider stores in the memory of the visitor's computer. In a session cookie, a randomly generated unique identification number is stored, a so-called session ID. In addition, a cookie contains information about its origin and the retention period. These cookies cannot save any other data. With the session ID, your orders will be put together in your shopping cart.

2. LEGAL BASIS FOR DATA PROCESSING

The legal basis for the processing of personal data using cookies is Article 6 (1) lit. f GDPR.

3. PURPOSE OF DATA PROCESSING

The purpose of using technically necessary cookies is to facilitate the use of our website for users. Some features of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after a page break. We require cookies for the following applications:

• shooting cart
• adopt language settings
• remember keywords

The user data collected through technically necessary cookies will not be used to create user profiles.

4. DURATION OF STORAGE, OBJECTION AND DISPOSAL OPTIONS

Cookies are stored on the computer of the user and transmitted by this on our side. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Already saved cookies can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may not be possible to use all the functions of the website to the full.

“CookieConsent” is stored for a period of one year.

The cookie “PHPSESSID” is stored for the duration of the session.

III. MORE FEATURES AND OFFERS OF OUR WEBSITE

In addition to the purely informative use of our website, we offer various services that you can use if you are interested. To do this, you will generally need to provide other personal information that we use to provide the service and for which the aforementioned data processing principles apply.

1. REGISTRATION ON OUR WEBSITE

1.1 Functionality and scope of the data processing

On our website we offer users the possibility of registering, which requires the provision of personal data. The data is entered into an input mask, transmitted to us and stored. The data will not be passed on to third parties. The following data will be collected in the course of the registration process:

REQUIRED INFORMATION:

Email address
Given name and surname
Address

VOLUNTARY INFORMATION:

Company
VAT ID No.
Telephone number

THE FOLLOWING DATA WILL ALSO BE STORED AT THE TIME OF REGISTRATION:

The user's IP address
Date and time of the registration

In the course of the registration process consent will be obtained from the user to the processing of that data.

1.2. Legal basis for the data processing

The legal basis for the processing of the data, where the user's consent has been obtained, is Article 6(1) point (a) GDPR. If the registration serves the purpose of the performance of a contract to which the user is party or carrying out pre-contractual measures, an additional legal basis for the processing of the data is Article 6(1) point (b) GDPR. To enable us to accept and process the order, it is necessary to appropriately record and process the data provided by you.

1.3. Purpose of the data processing

Registration of the user is necessary for the performance of a contract with the user or for carrying out pre-contractual measures. To enable us to accept and process the order, it is necessary to appropriately record your data.

1.4. Storage period

The data will be erased as soon as it is no longer needed to achieve the purpose for which it was collected.This is the case, for data collected during the registration process for the performance of a contract or for carrying out pre-contractual measures, if the data is no longer necessary for the performance of the contract. Also after the conclusion of the contract, it may be necessary to store personal data of the contract partner for the purpose of fulfilling contractual or legal obligations

1.5. Objection and elimination option

As the user you may cancel the registration at any time. You can have the stored data concerning you changed at any time. You can change your data under “My account”. In order to delete the account please contact us at onlineshop@a-novation.de .

If the data is required for the performance of a contract or for carrying out pre-contractual measures, early erasure of the data is only possible insofar as contractual or statutory obligations are not opposed to erasure.

2. USE OF OUR ONLINE SHOP

If you would like to place an order in our online shop, for the purpose of concluding a contract it is necessary that you provide your personal data, which we need in order to process your order. This also concerns, if relevant, the disclosure of the data necessary for the processing of your order to payment service providers, and in the event of a purchase on account to credit agencies for the purposes of creditworthiness enquiries.

In this connection we advise you that if you wish to pay the invoice amount via a payment service provider such as “Paypal” or “Paydirekt” you must either already be registered there or newly register, prove your identify with your access data and confirm the payment order to us. Please take note of any privacy information of the respective payment service provider.

Required information for the handling of the contracts is marked separately; further information is voluntary. We shall process the data provided by you for the purpose of fulfilling your order. We may also pass your payment data on to our bank. The legal basis for this is Article 6(1) sentence 1 (b) GDPR.

You may voluntarily set up a customer account through which we can store your data for later further purchases. If you set up an account under “My account”, the data provided by you will be revocably stored.

You can delete all further data, including your user account, at any time in the customer area. We are required on the basis of commercial and tax law requirements to store your address, payment and order data for a period of ten years. However, we will carry out a restriction of the processing after two years, i. e. your data will only be used for compliance with the statutory obligations. In order to prevent unauthorized access by third parties to your personal data, particularly financial data, the ordering process will be encrypted via TLS technology.

2.1. Data processing by contract processors

To some extent we make use of external service providers to process your data. We select and commission them with the utmost care, and they are bound by our instructions and regularly monitored. To enable is to process your order, we need to disclose the data to the following partners.

 

SHIPPING PARTNERS – DELIVERY

DHL Parcel GmbH 
Sträßchensweg 10 
53113 Bonn
Germany 
Tel: +49 (0)228 18 20 
imprint.paket@dhl.com 
www.dhl.de

VSHIPPING PARTNERS – RETURNS

DHL Parcel GmbH 
Sträßchensweg 10 
53113 Bonn 
Germany 
Tel: +49 (0)228 18 20 
imprint.paket@dhl.com 
www.dhl.de

 

 

 

Use PayPal as a payment method

If you opt during your order process for payment with the online payment service provider PayPal, in the course of the thus triggered order your contact details will be transmitted to PayPal. PayPal is a service of PayPal (Europe) S.à.rl & Cie. SCA, 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal performs the function of an online payment service provider and fiduciary and provides buyer protection services.

,The personal data transmitted to PayPal consists of the most part of your first name, surname, address, telephone number, IP address, e-mail address or other data required to process the order, as well as data related to the order, such as the number of products, the product numbers, the invoice amount and taxes in per cent, invoice information, etc.

Such transmission is necessary for the purpose of processing your order with the payment method selected by you, particularly for the confirmation of your identity, the administration of your payment and customer relations.

However, please note that personal data may also be passed on by PayPal to service providers, subcontractors or other associated companies if this is necessary for the fulfillment of the contractual obligations arising from your order or if the personal data is to be processed by way of contract processing.

Depending on the payment method selected via PayPal, eg invoice or debit note, the personal data transmitted to PayPal will be transmitted by PayPal to credit agencies. Such transmission serves the purpose of verifying your identity and creditworthiness with regard to the order placed by you.

You can find out which credit agencies are involved and what data is generally collected, processed, stored and passed on by PayPal in PayPal's Privacy Policy .

3. WEB ANALYTICS AND ONLINE ADVERTISING

3.1 Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. ("Google"). Google Analytics uses so-called "cookies", text files that are stored on your computer and that allow an analysis of the use of the website by you.

Specifically, the following cookies are employed:

The information generated by the cookie about your use of this website is usually transmitted to and stored by Google on servers in the United States. However, in the event of activation of IP anonymization on this website, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the US and shortened there.

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website usage and internet usage to the website operator.

The IP address provided by Google Analytics as part of Google Analytics will not be merged with other Google data. You can prevent the storage of cookies by a corresponding setting of your browser software; however, please note that if you do this, you may not be able to use all the features of this website to the fullest extent possible.

You may also prevent the collection by Google of the data generated by the cookie and related to your use of the website (including your IP address) as well as the processing of this data by Google by using the browser plug-in

This website uses Google Analytics with the extension "_anonymizeIp ()". As a result, IP addresses are processed shortened, a person-relatedness can be excluded. Insofar as the data collected about you is assigned a personal reference, it will be immediately excluded and the personal data will be deleted immediately.

We use Google Analytics to analyze and regularly improve the use of our website. With the statistics we can improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the US, Google has submitted to the EU-US Privacy Shield

The legal basis for the use of Google Analytics is Art. 6 para. 1 sentence 1 lit. f GDPR. Third Party Information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.

User conditions
Overview of privacy
General Data Protection Regulation

We have a contract data processing agreement with Google.

3.2 Use of DoubleClick by Google

This website also uses the online marketing tool DoubleClick by Google. DoubleClick uses cookies in order to display advertisements which are relevant for the user, to improve the reports on campaign performance and to prevent the same advertisements being displayed to a user multiple times. Via a cookie ID Google records which advertisements are displayed in which browser and can thus prevent multiple ad displays.

Specifically, the following cookies are employed:

Furthermore, with the aid of cookie IDs DoubleClick is able to record so-called “conversions”, which relate to ad requests. This is the case, for example, if a user sees a DoubleClick advertisement and later with the same browser accesses the advertiser's website and makes a purchase there. According to Google, DoubleClick cookies do not contain any personal information.

Based on the marketing tools used, your browser automatically creates a direct connection with Google's server. We have no influence on the scope or further use of the data which is collected by Google through the use of that tool and thus advise you as follows according to the best of our knowledge.

Through the integration of DoubleClick, Google is notified that you have accessed the relevant part of our website or have clicked on one of our advertisements. If you are registered with a Google service, Google can ascribe the visit to your account. Even if you are not registered with Google or have not logged on, the possibility exists that the provider will learn your IP address and store it.

You can prevent your participation in this tracking procedure in various ways:

a) by setting your browser software accordingly; in particular, the suppression of third-party cookies prevents you from receiving advertisements from third-party providers;

b) by deactivating the cookies for conversion tracking by setting your browser so that cookies are blocked from the domain “googleadservices.com”, www.google.de/settings/ads ; this setting will be deleted if you delete your cookies;

c) by deactivating the interest-related advertisements of the providers being a part of the self-regulation campaign “About Ads”, via the link www.aboutads.info/choices ; this setting will be deleted if you delete your cookies;

d) through permanent deactivation in your Firefox, Internet Explorer or Google Chrome browser via the link: www.google.com/settings/ads/plugin .Please note that if you do so, you may not be able to use all the functions of this service to their full extent.

The legal basis for the processing of your data is Article 6(1) sentence 1 (f) GDPR. You can obtain further information on DoubleClick by Google via the following links: www.google.de/doubleclick and support.google.com/adsense/answer , and on data protection at Google in general . Alternatively you can visit the website of the Network Advertising Initiative (NAI) .

Google has subjected itself to the EU-US Privacy Shield .

3.3 Use of ajax.googleapis.com/jQuery

On our website we use the Javascript library jQuery. To increase the loading speed of our website and to give you a better user experience, we use Google's content delivery network (CDN) to load this library.

There is a high probability that you have already used jQuery on another page of the Google CDN. If so, your browser can use the cached copy and it does not need to be downloaded again.

If your browser does not cache a copy or for any other reason downloads the file from the Google CDN, then data will be transferred from your browser to Google. For the exceptional cases in which personal data is transferred to the US, Google has submitted to the EU-US Privacy Shield .

The legal basis for the use of Google Analytics is Art. 6 para. 1 sentence 1 lit. f GDPR. Third Party Information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.

User conditions
Overview of privacy
General Data Protection Regulation

We have a contract data processing agreement with Google.