Data protection declaration for this website of Functional Cosmetics Company AG

We offer the option of processing the payment process via the payment service provider Stripe, ℅ Legal Process, 510, Townsend St., San Francisco, CA 94103 (Stripe). This corresponds to our legitimate interest in offering an efficient and secure payment method (Art. 6 Para. 1 lit. f GDPR). In this context, we pass on the following data to Stripe, insofar as it is necessary for the performance of the contract (Art. 6 Para. 1 lit. b. GDPR).

Name of the cardholder, email address, customer number, order number, bank details, credit card details, validity period of the credit card, credit card verification number (CVC), date and time of the transaction, transaction amount, name of the provider, location.

The processing of the data specified in this section is neither legally nor contractually required. Without the transmission of your personal data, we cannot make a payment via Stripe. [You have the option of choosing a different payment method.]

Stripe plays a dual role as controller and processor in data processing activities. As the controller, Stripe uses your transmitted data to fulfill regulatory obligations. This corresponds to Stripe's legitimate interest (according to Art. 6 Para. 1 lit. f GDPR) and serves the execution of the contract (according to Art. 6 Para. 1 lit. b GDPR). We have no influence on this process.

Stripe acts as a processor in order to be able to complete transactions within the payment networks. As part of the order processing relationship, Stripe acts exclusively according to our instructions and has been contractually obliged to comply with data protection regulations within the meaning of Art. 28 GDPR.

Stripe has implemented compliance measures for international data transfers. These apply to all worldwide activities in which Stripe processes personal data of natural persons in the EU. These measures are based on the EU standard contractual clauses (SCCs).

You can find more information on objection and removal options with Stripe at: https://stripe.com/privacy-center/legal

We will store your data until the payment processing is completed. This also includes the time required to process refunds, debt management and fraud prevention.

Shipping company

When we deliver goods to you, we pass on your personal data (first and last name, address) to the shipping company commissioned to do so, insofar as this is required for delivery. If you have consented to this as part of the order, we will also pass on your email address to the shipping service provider so that they can inform you of the order status.

7. Website analysis, affiliate and marketing programs

Google Analytics

This website uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses so-called "cookies", text files that are stored on your computer and that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, if IP anonymisation is activated on this website, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You can prevent cookies from being saved by setting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all of the functions of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout

We would like to point out that Google Analytics has been extended on this website to include the code "gat. anonymizeIp();" in order to ensure anonymous collection of IP addresses (so-called IP masking).

You can find more information on terms of use and data protection at https://support.google.com/analytics/answer/6004245?hl=de.

Google Maps

We use Google Maps on this website. This enables us to show you interactive maps directly on the website and enables you to use the map function conveniently. When you visit the website, Google receives the information that you have accessed the corresponding subpage of our website. In addition, the address data entered in the form is transmitted. This occurs regardless of whether Google provides a user account through which you are logged in or whether there is no user account. If you are logged in to Google, your data is assigned directly to your account. If you do not want to be assigned to your Google profile, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to provide other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact Google to exercise this right.

You can find more information about the purpose and scope of data collection and processing by the plug-in provider in the provider's privacy policy. There you will also find more information about your rights in this regard and setting options for protecting your privacy:

http://www.google.de/intl/de/policies/privacy.

Bing Ads (Microsoft Corporation)

This website uses the conversion tracking technology "Bing Ads" from Microsoft (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA). Microsoft Bing Ads will place a cookie on your computer if you have accessed our website via a Microsoft Bing ad. Cookies are small text files that are stored on your device. These cookies expire after 180 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Microsoft and we can recognize that the user clicked on the ad and was redirected to this page (conversion page). If personal data is processed in the process, this is done in accordance with Art. 6 Para. 1 lit. f GDPR due to our legitimate interest in effective marketing.

The information collected using the conversion cookie is used to create conversion statistics, i.e. to record how many users reach a conversion page after clicking on an ad. This tells us the total number of users who clicked on our ad and were redirected to a page with a conversion tracking tag. However, we do not receive any information that can be used to personally identify users. Microsoft Corporation, based in the USA, is certified for the US-European data protection agreement "Privacy Shield", which guarantees compliance with the data protection level applicable in the EU.

If you do not want to participate in tracking, you can object to this by deactivating the Bing Ads conversion tracking cookie in your Internet browser under user settings. You will then not be included in the conversion tracking statistics. Alternatively, you can use the opt-out page for EU consumers http://www.youronlinechoices.com/uk/your-ad-choices to check whether Microsoft advertising cookies are being set in your browser and to deactivate them.

You can find more information about Microsoft Bing Ads' privacy policy at the following Internet address: https://privacy.microsoft.com/de-de/privacystatement.

Bing Ads Remarketing

We use BingAds to advertise this website in Bing, Yahoo and MSN search results as well as on third-party websites. If you have given us your consent in accordance with Art. 6 Paragraph 1 Clause 1 Letter a of GDPR, a cookie will automatically be set when you visit our website, which automatically enables interest-based advertising using a pseudonymous cookie ID and based on the pages you have visited. Once the purpose no longer applies and we no longer use BingAds Remarketing, the data collected in this context will be deleted.

BingAds is an offering from Microsoft Corporation (www.microsoft.com). Microsoft Corporation has its headquarters in the USA and is certified under the EU-US Privacy Shield. A current certificate can be viewed here. Based on this agreement between the USA and the European Commission, the latter has determined an appropriate level of data protection for companies certified under the Privacy Shield. You can revoke your consent at any time with effect for the future by deactivating the remarketing cookie using this link. You can also find out more about the use of cookies and make settings for this at the Digital Advertising Alliance.

Bing Ads (Microsoft Corporation) Universal Event Tracking

This website uses Universal Event Tracking of the conversion tracking technology "Bing Ads" from Microsoft (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA).

For the use of Universal Event Tracking, a tag is stored on each page of our website that interacts with the conversion cookie set by Microsoft Bing Ads. This interaction makes user behavior on our website traceable and sends the information collected in this way to Microsoft Bing Ads. The purpose of this is that certain predefined goals such as purchases or leads can be statistically recorded and evaluated in order to make the orientation and content of our offers more tailored to interests. The tags are never used to personally identify users.

If the transmission of information about user behavior to Microsoft Bing Ads includes personal user data, this is done in accordance with Art. 6 Para. 1 lit. f GDPR on the basis of our legitimate interest in the statistical evaluation of the success of product ads in Microsoft Bing Ads and the purchasing behavior of users and thus serves to optimize our online offering. Microsoft Corporation, based in the USA, is certified for the US-European data protection agreement "Privacy Shield", which guarantees compliance with the data protection level applicable in the EU.

If you do not want to participate in tracking, you can object to this by deactivating the Bing Ads conversion tracking cookie in your Internet browser under user settings. You will then not be included in the conversion tracking statistics. Alternatively, you can use the deactivation page for EU consumers https://www.youronlinechoices.com/de/praferenzmanagement/ to check whether Microsoft advertising cookies are set in your browser and deactivate them.

You can find further information about Microsoft Bing Ads' data protection provisions at the following Internet address: https://privacy.microsoft.com/de-de/privacystatement

Trusted Shops Trustbadge

The Trusted Shops Trustbadge is integrated into this website to display our reviews that may have been collected with Trusted Shops.

This serves to protect our legitimate interests, which predominate in the context of a balancing of interests, in a optimal marketing of our offer. The Trustbadge and the services advertised with it are an offer from Trusted Shops AG, Subbelrather Str. 15C, 50823 Cologne.

When you access the Trustbadge, the web server automatically saves a so-called server log file, which contains, for example, your IP address, date and time of access, amount of data transferred and the requesting provider (access data) and documents the access. This access data is not evaluated and is automatically overwritten no later than seven days after the end of your visit to the site.

Other personal data is only transferred to Trusted Shops if you decide to use Trusted Shops products after completing an order or have already registered to use them. In this case, the contractual agreement made between you and Trusted Shops applies.

Review reminder from Trusted Shops

If you have given us your express consent to do so during or after your order, we will send your email address to Trusted Shops AG, Subbelrather Str. 15c, 50823 Ko¨ln (www.trustedshops.de) so that they can send you a review reminder by email. This consent can be revoked at any time by sending a message to the contact option described below or directly to Trusted Shops.

8. Use of social media: social media plugins

Social buttons from social networks are used on our website.

In order to increase the protection of your data when you visit our website, these buttons are not fully integrated into the page as plugins, but only using an HTML link. This integration ensures that when you access a page on our website that contains such buttons, no connection is established with the servers of the provider of the respective social network.

If you click on one of the buttons, a new window in your browser opens and calls up the page of the respective service provider, where you can (if necessary after entering your login data) press the Like or Share button, for example.

Our online presence on Facebook, Twitter, Instagram, Xing, LinkedIn Our presence on social networks and platforms serves to improve, active communication with our customers and interested parties. We provide information there about our products and current special offers. When you visit our online presence in social media, your data may be automatically collected and stored for market research and advertising purposes. So-called user profiles are created from this data using pseudonyms. These can be used, for example, to display advertisements within and outside of the platforms that presumably correspond to your interests. For this purpose, cookies are usually used on your device. Visitor behavior and the interests of users are stored in these cookies. In accordance with Art. 6 Paragraph 1 Letter f. GDPR, this serves to safeguard our legitimate interests, which predominate in the context of a balancing of interests, in an optimized presentation of our offer and effective communication with customers and interested parties. If you are asked by the respective social media platform operators for consent (agreement) to data processing, e.g. using a checkbox, the legal basis for data processing is Art. 6 Paragraph 1 Letter a. GDPR.

If the aforementioned social media platforms have their headquarters in the USA, the following applies: The European Commission has made an adequacy decision for the USA. This goes back to the EU-US Privacy Shield. A current certificate for the respective company can be viewed here.

For detailed information on the processing and use of data by the providers on their websites as well as a contact option and your related rights and setting options to protect your privacy, in particular objection options (opt-out), please refer to the data protection information of the providers linked below. If you still need help in this regard, you can contact us.

• Facebook: https://en-gb.facebook.com/privacy/center/. The data processing is carried out on the basis of an agreement between joint controllers in accordance with Art. 26 GDPR, which you can view here: https://www.facebook.com/legal/terms/page_controller_addendum.
• Instagram: https://privacycenter.instagram.com/
• XING: https://www.xing.com/privacy

Opt-out option:

• Facebook: https://www.facebook.com/settings?tab=ads
• Google/ YouTube: https://adssettings.google.com/authenticated
• Instagram: https://privacycenter.instagram.com/
• LinkedIn: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
• Xing: https://privacy.xing.com/de/datenschutzerklaerung/welche-rechte-koennen-sie-geltend-machen/widerspruchsrecht

Facebook plugins

So-called social plugins are used on our website. ("Plugins") of the social network Facebook, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA ("Facebook"). To increase the protection of your data when you visit our website, these buttons are not fully integrated into the page as plugins, but rather simply using an HTML link. This type of integration ensures that when you access a page on our website that contains such buttons, no connection is established with the Facebook servers. If you click on the button, a new browser window will open and call up the Facebook page, where you can interact with the plug-ins there (if necessary after entering your login data).

Facebook Inc., based in the USA, is certified for the US-European data protection agreement "Privacy Shield", which guarantees compliance with the data protection level applicable in the EU.

The purpose and scope of data collection and the further processing and use of the data by Facebook as well as your rights and setting options for protecting your privacy can be found in Facebook's data protection information: https://www.facebook.com/privacy/policy/

Instagram plug-in

Our website uses so-called social plug-ins from the online service Instagram, which is operated by Instagram LLC., 1601 Willow Rd, Menlo Park, CA 94025, USA. In order to increase the protection of your data when you visit our website, these buttons are not fully integrated as plugins, but only using an HTML link in the page. This type of integration ensures that when you access a page on our website that contains such buttons, no connection is established with the Instagram servers. If you click on the button, a new browser window will open and call up the Instagram page, where you can interact with the plugins there (possibly after entering your login data).

Instagram LLC., based in the USA, is certified for the US-European data protection agreement "Privacy Shield", which guarantees compliance with the data protection level applicable in the EU. For the purpose and scope of data collection and the further processing and use of the data by Instagram as well as your related rights and setting options to protect your privacy, please refer to Instagram's privacy policy: https://privacycenter.instagram.com//

Use of videos: Youtube video plugins

This website uses the Youtube embedding function to display and play videos from the provider "Youtube", which belongs to Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

This uses the extended data protection mode, which, according to the provider, only starts storing user information when the video(s) is played. If the playback of embedded Youtube videos is started, the provider "Youtube" uses cookies to collect information about user behavior. According to information from "Youtube", these are used, among other things, to collect video statistics, improve user-friendliness and prevent abusive behavior. If you are logged in to Google, your data will be assigned directly to your account when you click on a video. If you do not want to be assigned to your YouTube profile, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and evaluates them. Such an evaluation is carried out in particular in accordance with Art. 6 Para. 1 lit. f GDPR on the basis of Google's legitimate interests in displaying personalized advertising, market research and/or designing its website to meet needs. You have the right to object to the creation of these user profiles, and you must contact YouTube to exercise this right. When using YouTube, personal data may also be transferred to Google LLC's servers in the USA. Regardless of whether the embedded videos are played, a connection to the Google network is established each time this website is accessed, which can trigger further data processing operations without our influence.

In the event that personal data is transmitted to Google LLC., based in the USA, Google LLC. has certified itself for the US-European data protection agreement "Privacy Shield", which guarantees compliance with the data protection level applicable in the EU. A current certificate can be viewed here: https://www.privacyshield.gov/list.

For more information on data protection at "YouTube", please see the provider's data protection declaration at: https://www.google.de/intl/de/policies/privacy.

9. Advertising, newsletter

If you agree, we will inform you at regular intervals about our product and service offers, voucher and coupon campaigns (hereinafter "information").

You can register for our newsletter via our website. You also have the option of giving your consent as part of competitions and voucher/coupon campaigns. If you would like to receive information, we need at least a valid email address from you. Providing your last name and first name is voluntary. Your email address will not be passed on.

Registration for our newsletter takes place using a so-called double opt-in process. This means that after registration you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register with someone else's email address. Registrations for the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation, as well as the IP address.

You can revoke your consent to the storage of the data, the email address and their use to send information at any time. The revocation can be made via a link in the newsletters or the advertising emails sent to you or by notifying us using the contact details provided in the imprint of our website.

The newsletter is sent on the basis of consent in accordance with Art. 6 Para. 1 Sentence 1 a GDPR. The logging of the registration process ens is based on our legitimate interests in accordance with Art. 6 Paragraph 1 Sentence 1 f GDPR. Our interest is in the use of a user-friendly and secure newsletter system that serves our business interests as well as meets the expectations of users and also allows us to provide evidence of consent.

You may give us the following consent, which we are repeating here for your information only:

«I confirm that I am at least 16 years old and I agree that Functional Cosmetics Company AG, St. Jakob-Str. 84, CH-4132 Muttenz may use my specified e-mail address to inform me regularly about product and service offers, voucher and coupon campaigns and competitions. I can revoke my consent at any time to Functional Cosmetics Company AG, St. Jakob-Str. 84, CH-4132 Muttenz via the unsubscribe link in the newsletter, email to contact@functional-cosmetics.com or by post. The revocation does not change the legality of the processing carried out up to the time of revocation.»

Newsletter - Measuring success

The newsletters contain a so-called "web beacon", i.e. a pixel-sized file that is retrieved from our server when the newsletter is opened, or if we use a shipping service provider, from its server. As part of this retrieval, technical information such as information about the browser and your system, as well as your IP address and the time of retrieval, is initially collected.

This information is used to technically improve the services based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or the access times. The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is neither our aim nor that of the shipping service provider, if used, to observe individual users. The evaluations serve us much more to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users. The legal basis for measuring success is Art. 6 Paragraph 1 Sentence 1 f GDPR.

10. Voluntary provision of data

The provision of personal data when visiting our website is neither legally or contractually required nor necessary for the conclusion of a contract. You are also not obliged to provide personal data when visiting our website, but access data is collected automatically when you visit our website. If you order goods, register with us as a customer or fill out the contact form, the data marked in bold is mandatory for sending the respective forms.

11. Duration of processing

Access data, cookies

For security reasons (e.g. to investigate misuse or fraud), the access data is stored for a maximum of 7 days and then deleted. Data that needs to be stored for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.

If third parties process IP addresses and movement data using cookies, we have no influence on the duration of processing. Under section 8 you will find links to the third-party providers' data protection declarations. There you can find out about the duration of processing.

Contract data (input data, purchase data)

We store personal data that we process for contractual purposes within the framework of the tax and commercial law or other statutory retention periods (the retention periods are between 2-10 years). If we transmit your personal data to third parties for the purpose of contract processing and payment (Section 6), we have no influence on the duration of processing by these companies. Please contact these companies directly in this regard; we will be happy to provide you with the contact details.

Newsletter

If you unsubscribe from our newsletter, we will no longer send you newsletters; you will be entered into a so-called block list. However, we will continue to process your first and last name and your email address in order to be able to prove that you have registered for our newsletter once.

Competitions

The data collected as part of a competition will be deleted as soon as the competition has been fully processed, unless enn that there are statutory retention obligations that justify continued storage of the data. These can be, for example, tax regulations in connection with the winnings. The data will be deleted at the latest after any retention periods have expired, unless you have given your consent, e.g. to use your email address to send the newsletter.

Other input data

You will save the other data entered via the web forms for as long as we need them to process your request, provided that this data is not subject to tax and commercial law or other statutory retention periods (the retention periods are between 2-10 years).

12. Rights of the data subject

Revocation

If you have given your consent, you have the right to revoke it. We would like to point out that a revocation does not change the legality of the processing carried out up to the time of revocation (no retroactive effect of the revocation).

Objection

You have the right to object at any time to the personal data processed on the basis of Art. 6 Para. 1 Sentence 1 f GDPR, provided that there are reasons for the objection that arise from your particular situation and provided that there are no compelling legitimate reasons to continue to collect the data. If we process your personal data in order to conduct direct advertising, you have the right to object to the processing of personal data for the purpose of such advertising at any time without giving reasons (Art. 21 GDPR).

Other rights of data subjects

You have the right to receive information about the personal data we hold about you free of charge upon request within the framework of the GDPR (Art. 15 GDPR).

Furthermore, in accordance with the GDPR, you have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction (Art. 18 GDPR) and transfer (Art. 20 GDPR) of your personal data.

You also have the right to complain to the data protection supervisory authority responsible for us in justified cases (Art. 77 GDPR).

With regard to the automated individual decision (credit check), you also have the right to object to the processing of your personal data in accordance with Art. 22 Paragraph 3 GDPR, you have the right to have a person intervene on the part of the controller, to express your point of view and to contest the decision.

You can assert your rights under the GDPR by email or in writing. The contact details of the provider and the person responsible in the EU can be found below.

13. Contact details

Provider as responsible body: