data protection

Privacy

Privacy Policy

1. Controller

Brooklyn Soap GmbH, Kaiser-Wilhelm-Str. 83, 20355 Hamburg (“Brooklyn Soap”, “we”, “us”) operates the website and is responsible for data protection.

We respect the personal rights of visitors to the website. This Privacy Policy informs you about the nature, scope and purpose of the processing of personal data (hereinafter “data”) in connection with the use of our website www.bklynsoap.com and the associated online shop (hereinafter “Website”).

Personal data means any information relating to an identified or identifiable natural person (e.g. name, address, email address, order data).

If you have any questions or objections regarding Brooklyn Soap’s data processing activities, you may contact the Data Protection Officer at any time:

Merz Consumer Care GmbH
Data Protection
Eckenheimer Landstrasse 100
60318 Frankfurt am Main
Germany
Email: mlc_datenschutz@merz.de

2. Hosting & Technical Infrastructure

2.1 Shopify

Our Website is operated on the e-commerce platform Shopify International Ltd., Ireland. In connection with the use of Shopify, data may also be transferred to Shopify Inc., a Canadian company located at 151 O’Connor Street, Ground floor, Ottawa, ON, K2P 2L8, Canada. The European Commission has issued an adequacy decision for Canada, meaning that an adequate level of data protection is ensured.

When you visit our Website, Shopify automatically collects and stores the following data in so-called server log files:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the accessed file
• Website from which the access originated (referrer URL)
• Browser used and, where applicable, the operating system
• Name of the Internet service provider

Purpose: Ensuring a smooth connection, convenient use of the Website, and evaluation of system security and stability.

Legal basis: Art. 6 para. 1 sentence 1 lit. f) GDPR (legitimate interests)

Data transfer: Shopify may transfer data to countries outside the EU/EEA. EU Standard Contractual Clauses are in place.

Further information: https://www.shopify.com/legal/privacy

2.2 Cloudflare

We use the service Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to optimise loading times and protect our Website (Content Delivery Network & DDoS protection).

Legal basis: Art. 6 para. 1 sentence 1 lit. f) GDPR (legitimate interests: IT security, Website performance)

Further information: https://www.cloudflare.com/privacypolicy/

2.3 Country and Language Selection (Orbe)

To ensure that you are shown the appropriate shop version for your country, including the correct language, currency and product selection, we use the Shopify app “Geolocation Orbe” provided by Orbe.

Your IP address is evaluated in order to determine your country; in addition, the language configured in your browser is read. Your selection or confirmation of the country version is stored in a cookie or comparable storage on your device so that you do not have to make the selection again during future visits. The IP address is used exclusively to determine the country and is not stored permanently.

Legal basis: Art. 6 para. 1 sentence 1 lit. f) GDPR (legitimate interest in correctly delivering country-specific shop content); Section 25 para. 2 no. 2 TDDDG for storing the preference you have selected.

2.4 Accessibility (Avada Accessibility)

To improve the accessibility of our shop, we use the “Avada Accessibility” widget provided by Avada Commerce Pte. Ltd., Singapore. The widget allows you to adjust the display of our Website to your needs (e.g. contrast, font size, read-aloud function, highlighting of links).

When the widget is loaded, your IP address is transmitted to the provider or its Content Delivery Network because this is technically necessary to deliver the content to your browser. The settings you select are stored on your device so that they are retained for your next visit.

Legal basis: Art. 6 para. 1 sentence 1 lit. f) GDPR (legitimate interest in an accessible Website, including compliance with the requirements of the German Accessibility Improvement Act); Section 25 para. 2 no. 2 TDDDG for storing your settings.

Data transfer: A transfer to Singapore and/or Vietnam cannot be ruled out. The European Commission has not issued an adequacy decision for these countries; we have therefore concluded EU Standard Contractual Clauses pursuant to Art. 46 para. 2 lit. c) GDPR.

3. Data Collection When Using the Online Shop

3.1 Ordering Process / Contract Processing

As part of the ordering process, we collect and process the following data:

• First and last name
• Delivery address and, where applicable, a different billing address
• Email address
• Telephone number (optional)
• Payment information (depending on the selected payment method)
• Order history and transaction data

Purpose: Processing the purchase contract, delivering the goods, processing returns and refunds, and issuing invoices.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract); Art. 6 para. 1 sentence 1 lit. c) GDPR (statutory retention obligations)

Storage period: Data relevant for tax purposes is retained for 10 years in accordance with Section 147 AO.

3.2 Customer Account (Registration)

You have the option of creating a customer account. The following data is stored:

• Name, email address, password (encrypted)
• Delivery addresses
• Order history

Purpose: Simplified ordering process, access to order history, management of addresses.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR; where applicable, Art. 6 para. 1 sentence 1 lit. a) GDPR (consent)

3.3 Enterprise Resource Planning System (Xentral)

For the internal processing of your order, we use the enterprise resource planning system of Xentral ERP Software GmbH, Germany. Xentral processes your data exclusively on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR.

The data processed includes your name, delivery and billing address, email address, where applicable your telephone number, as well as order, invoice and returns data.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract); Art. 6 para. 1 sentence 1 lit. c) GDPR (statutory retention obligations)

3.4 Logistics System (everstox)

For the management and processing of storage and shipping, we use the logistics platform of everstox GmbH, Germany. Through everstox, your order and delivery data is transmitted to the warehouse and shipping service providers we use, and the status of your shipment is tracked. everstox processes your data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR.

The data processed includes your name, delivery address, order data and, where necessary for delivery or shipment notifications, your email address and telephone number.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract)

4. Payment Service Providers

4.1 Klarna

We offer the option “Buy now, pay later” through Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden.

If you select Klarna as your payment method, your payment and order data will be transmitted to Klarna. Klarna may carry out a credit check.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract)

Privacy information: https://www.klarna.com/de/datenschutz/

4.2 Payone

For the processing of credit card payments and other payment methods, we use the services of PAYONE GmbH, Lyoner Straße 9, 60528 Frankfurt am Main, Germany.

During the payment process, your payment and order data is transmitted to PAYONE and processed there for payment processing purposes.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract)

Privacy information: https://www.payone.com/DE-de/datenschutz

4.3 PayPal

If you select PayPal as your payment method, your payment and order data will be transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal may carry out a credit check.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract)

Privacy information: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

4.4 Other Payment Methods

Depending on the payment method selected (e.g. credit card, PayPal, instant bank transfer), your payment data will be forwarded to the respective payment service provider. The processing of data is governed by the respective provider’s privacy policy.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR

5. Contact Form & Customer Support (Zendesk)

For processing customer enquiries, we use the support system Zendesk, Inc., 1019 Market St., San Francisco, CA 94103, USA.

If you contact us via the contact form (https://bklynsoap.zendesk.com), the following data is processed:

• Name
• Email address
• Content of your enquiry
• Order number (if provided)

Purpose: Processing your enquiries and complaints, customer service.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR; Art. 6 para. 1 sentence 1 lit. f) GDPR (legitimate interests)

Data transfer: Zendesk may transfer data to the USA. EU Standard Contractual Clauses are in place.

6. Returns Portal

For the processing of returns and cancellations, we use the returns portal of 8returns UG, Germany (https://www.8returns.com). Your order data and, where applicable, contact data are processed for handling returns.

Purpose: Processing returns and cancellations, handling refunds.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract / processing cancellations)

7. Cookies & Consent Management

Our Website uses cookies and similar technologies. Cookies are small text files stored in your browser.

7.1 Necessary Cookies

Technically necessary cookies enable basic Website functions (e.g. shopping cart, login).

Legal basis: Art. 6 para. 1 sentence 1 lit. f) GDPR; Section 25 para. 2 TDDDG

7.2 Analytics and Marketing Cookies

Additional cookies are used for analytics and marketing purposes where you have provided your consent via our cookie banner.

Legal basis: Art. 6 para. 1 sentence 1 lit. a) GDPR; Section 25 para. 1 TDDDG

You may withdraw your consent at any time under “My Privacy Settings” on our Website.

7.3 Consent Management (Consentmo)

To manage your cookie consents, we use the Consentmo consent management platform. Consentmo records your consent decisions and enables you to manage or withdraw them at any time. Technically necessary data (e.g. your consent decision, timestamp, anonymised IP address) is stored.

Purpose: Documentation and management of consent in accordance with the GDPR and TDDDG.

Legal basis: Art. 6 para. 1 sentence 1 lit. c) GDPR (legal obligation); Art. 6 para. 1 sentence 1 lit. f) GDPR (legitimate interest in operating the Website in compliance with the law)

You can adjust or withdraw your consent at any time via “My Privacy Settings” on our Website.

.

8. Newsletter & Email Marketing

If you choose to subscribe to our newsletter, you must provide consent to the processing of personal data required for this purpose. To subscribe to the newsletter, you must provide an email address. This email address will be used exclusively to send the newsletter.

You have the right to withdraw your consent at any time, for example via the link provided in the newsletter, without affecting the lawfulness of processing carried out on the basis of your consent before its withdrawal. In this case, you will no longer receive the newsletter.

If you subscribe to the newsletter, the IP address of the accessing system as well as the date and time of registration and email verification are also collected at the time of registration. This data is processed exclusively for the purpose of being able to trace potential misuse of an email address and the consent provided. The legal basis for processing the data described above is Art. 6 para. 1 sentence 1 lit. f) GDPR.

We use Klaviyo and Zendesk to send and analyse newsletters. Their use makes it possible to analyse how recipients use the newsletters. Among other things, it can be analysed how many recipients have opened a newsletter message, in which country, with what type of device (desktop or mobile device) and with which email client the newsletter message was opened, and how often links in the newsletter were clicked.

Legal basis: Art. 6 para. 1 sentence 1 lit. a) GDPR (consent) and Art. 6 para. 1 sentence 1 lit. f) GDPR

Data transfer: The use of Klaviyo and Zendesk also involves the transfer of data to the USA as a third country. Klaviyo and Zendesk are certified under the EU-US Data Privacy Framework, meaning that an adequacy decision by the European Commission applies to this data transfer.

In addition to the above, we send our newsletter on the basis of Art. 6 para. 1 lit. f) GDPR to customers who have previously purchased a product from us (existing customers). The contents of this newsletter include information about our own similar products and services to the goods already ordered (direct advertising for our own similar goods). Our legitimate interest is to inform existing customers about news and new products that may be of interest to them.

You may object to this data processing at any time, in particular by using the unsubscribe link in the footer section of each newsletter. No costs other than the transmission costs according to the basic tariffs are incurred for this.

9. Loyalty Program “Brooklyn Boys Club”

We offer the customer loyalty program Brooklyn Boys Club. Your account and purchase data is processed to manage points balances, rewards and promotions.

The loyalty program is technically operated via the service Yotpo Ltd., 400 Lafayette St., New York, NY 10003, USA. Yotpo processes your account and purchase data on our behalf to manage points balances, rewards and promotions.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR; Art. 6 para. 1 sentence 1 lit. a) GDPR

Data transfer: Where access to the data is also possible by other Yotpo companies from third countries (outside the EEA) for which there are no adequacy decisions by the European Commission, EU Standard Contractual Clauses have been agreed with Yotpo to ensure an adequate level of data protection. Yotpo also confirms that sufficient safeguards to ensure an adequate level of data protection, in particular Standard Contractual Clauses, have also been concluded with subcontractors used by Yotpo. We have contractually obliged Yotpo to comply with European data protection requirements.

10. Product Subscriptions (Seal Subscriptions)

We offer the option of ordering products on a subscription basis. For this purpose, we use the Shopify app Seal Subscriptions provided by Seal Subscriptions d.o.o., Slovenia.

The data processed includes your name, email address, delivery address, payment information and order history.

Purpose: Management and processing of product subscriptions.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR (performance of a contract)

Privacy information: https://sealsubscriptions.com/privacy-policy

11. Social Media

11.1 Our Social Media Profiles

When you visit our social media pages, it may be necessary for data concerning you to be processed. We therefore wish to inform you below about how your data is handled and about the rights arising from this processing.

Responsibility

In addition to us, the respective operator of the social media platform is also responsible for the processing of your personal data. To the extent that we can influence and configure data processing, we use the options available to us to encourage the operator of the social media platform to handle data in compliance with data protection requirements. Please also refer to the privacy policies of the respective social media platforms in this context.

Data Processing by Us

The data you enter on our social media pages, such as usernames, comments, videos, images, likes, public messages, etc., is published by the social media platform and is not processed by us at any time for purposes other than publication and communication. We merely reserve the right to delete content where this should be necessary. Where applicable, we share your content on our page if this is a function of the social media platform, and we communicate with you via the social media platform. The legal basis for processing your data is Art. 6 para. 1 sentence 1 lit. f) GDPR. The data processing takes place in our legitimate interest in carrying out public relations activities for our company and communicating with you. The operator of the social media platform can view your data; otherwise, we do not transfer your data to other parties unless this is permitted under statutory provisions or with your consent. The use of our social media profiles is voluntary (provision of personal data through voluntary interaction).

If you submit an enquiry to us via the social media platform, depending on its content, we may also refer you to other secure communication channels that guarantee confidentiality. For example, you may contact us at any time using the postal address or email address stated in the legal notice. The choice of the appropriate communication channel is your own responsibility.

We delete your personal data when it is no longer required, unless statutory retention obligations apply. After any statutory retention periods have expired, the data will be deleted.

Some social media platforms generate statistics based on usage data containing information about your interaction with our social media page. We cannot influence or prevent the preparation and provision of these statistics. We process this information pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR in our legitimate interest in evaluating the use of our social media pages and improving our content in a target-group-oriented manner.

We use Facebook Ads (including in relation to Instagram) to provide and personalise advertising. This is based on:

• Demographic data
• User behaviour (based on behaviour and interests relating to consumed content, communications and other information provided by the user)
• Networks and connections
• Device information (operating system, device type)
• Location-specific targeting

For this purpose, we use audience definitions provided to us by the social media provider. We only use anonymous audience definitions, meaning that we define characteristics based, for example, on general demographic information, behaviour, interests and connections. The operator of the social media platform uses these definitions to display corresponding advertisements to its users. The legal basis for this is consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR, which the operator of the social media platform has obtained from its users. If you wish to withdraw this consent, please use the withdrawal options provided by the social media platform provider, as the operator of the social media platform is responsible for this processing.

We do not use audience definitions based on location data. We do not transfer personal data to the operator of the social media platform as part of the audience definition process.

Occasionally, we also use information relating to visits to or interaction with other pages for audience definition purposes (so-called remarketing). For this purpose, we also use cookies, among other technologies. In these cases, however, we obtain the user’s consent in advance on the respective other pages via a consent banner and provide information about the data processing there. You may withdraw this consent at any time by reopening the consent banner on the relevant Website. Until consent is withdrawn, the data processing carried out on the basis of that consent is lawful.

You consent to personalised advertising in the terms of use of the social networks (consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR). This data processing can be prevented in the settings of the social networks (withdrawal of consent; withdrawal is possible at any time. Data processing carried out on the basis of consent remains lawful until consent is withdrawn). If you have specified in the settings that no personalised advertising should take place, your data will not be used for personalised advertising. We ourselves cannot associate this data with an individual person or profile at any time.

Data Processing by the Operator of the Social Media Platform

The operator of the social media platform uses web tracking methods. Web tracking may also take place regardless of whether you are logged into or registered with the social media platform. We therefore wish to point out that it cannot be ruled out that the provider of the social media platform uses your profile and behavioural data to evaluate, for example, your habits, personal relationships, preferences, etc. In this respect, we have no influence over the processing of your data by the provider of the social media platform, meaning that use of the social media platform is at your own responsibility.

It is possible that the operator of the social media platform processes your personal data outside the EU or EEA, as the parent companies are located in the USA and a transfer of data from European companies to US companies cannot be ruled out. There is therefore a risk that authorities may access the data for security and surveillance purposes without you being informed or being able to seek legal remedies. The legal basis for setting a cookie on your device is your consent pursuant to Section 25 para. 1 TDDDG, which you may provide on the social media platform. When using the social media platform via our profiles, personal data is transferred through the use of the social media platform on the basis of your consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR and, for data transfers to a third country under data protection law, pursuant to Art. 49 para. 1 sentence 1 lit. a) GDPR. If you no longer access our page, no further data transfer will take place. This consent may be withdrawn at any time. Data processing carried out on the basis of consent remains lawful until consent is withdrawn.

Further information on data processing by the provider of the social media platform, configuration options for protecting your privacy, additional options for objection and, where available and concluded, the agreement pursuant to Art. 26 GDPR can be found in the provider’s privacy policy and other pages as well as in your profile settings:

• Facebook: https://www.facebook.com/privacy/explanation
• Instagram: https://help.instagram.com/519522125107875
• YouTube: https://policies.google.com/privacy?hl=de&gl=de
• TikTok: https://www.tiktok.com/legal/page/eea/new-privacy-policy/de-DE
• Pinterest: https://policy.pinterest.com/de/privacy-policy

11.2 Social Media Management (Swat.io)

We use Swat.io GmbH to manage our social media presence. Swat.io is contractually obliged, as a processor, to comply with data protection requirements.

Legal basis: Art. 6 para. 1 sentence 1 lit. f) GDPR

11.3 Social Media Advertising (Custom Audiences / Remarketing)

We use the advertising functions and tracking technologies of the platforms listed below in order to define target groups, display personalised advertisements and measure the success of our campaigns. This only takes place where you have provided your consent via our cookie banner.

Meta (Facebook & Instagram)

We use the Facebook Pixel and the Meta Conversions API provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. Your behaviour on our Website and, where applicable, technical device data are transmitted to Meta in order to measure conversions and optimise advertising campaigns. A transfer to the USA (Meta Platforms, Inc.) cannot be ruled out.

TikTok

We use the TikTok Pixel provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland. Usage data and conversion information are transmitted to TikTok. A transfer to the USA or other third countries cannot be ruled out.

Pinterest

We use the Pinterest Tag provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Conversion and behavioural data are transmitted to Pinterest.

Reddit

We use the Reddit Pixel provided by Reddit, Inc., 548 Market St., San Francisco, CA 94104, USA. Usage data is transmitted to Reddit for campaign measurement purposes.

Bing Ads / Microsoft Advertising

We use Microsoft Advertising (Bing Ads) provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Conversion and click data are transmitted to Microsoft. A transfer to the USA cannot be ruled out.

Legal basis (all tools listed above): Art. 6 para. 1 sentence 1 lit. a) GDPR; Section 25 para. 1 TDDDG (consent)

Further information:

Facebook: https://www.facebook.com/privacy/explanation

Instagram: https://help.instagram.com/519522125107875

TikTok: https://www.tiktok.com/legal/page/eea/new-privacy-policy/de-DE

Pinterest: https://policy.pinterest.com/de/privacy-policy

Reddit: https://www.reddit.com/policies/privacy-policy

Microsoft/Bing: https://privacy.microsoft.com/de-de/privacystatement

12. Web Analytics & Tracking

12.1 Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a tag management system through which other analytics and marketing scripts (tags) are integrated and managed. Google Tag Manager itself does not set cookies or collect personal data; however, it triggers the tags described below, which may themselves collect data.

Legal basis: Art. 6 para. 1 sentence 1 lit. f) GDPR (legitimate interest in the efficient management of Website tags)

12.2 Google Analytics & Google Signals

We use Google Analytics provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse user behaviour on our Website. Google Analytics collects, among other things, information about pages accessed, duration of visits, visitors’ origin and technical device data. The IP address is processed in anonymised form.

In addition, we use Google Signals, an extension of Google Analytics that enables cross-device usage data to be collected where users are logged into their Google account and have enabled personalised advertising.

Purpose: Analysis and improvement of our Website, creation of anonymised usage statistics, cross-device reach measurement.

Legal basis: Art. 6 para. 1 sentence 1 lit. a) GDPR; Section 25 para. 1 TDDDG (consent)

Data transfer: Google may transfer data to the USA. EU Standard Contractual Clauses are in place.

Privacy information: https://policies.google.com/privacy

12.3 Google Ads & Enhanced Conversions

We use Google Ads provided by Google Ireland Limited to display search engine advertising and measure the effectiveness of our advertisements (conversion tracking). A cookie is set when you access our Website via a Google advertisement.

In addition, we use the Enhanced Conversions function. Data entered by you on our Website (e.g. email address) is hashed (encrypted) before being transferred to Google and is used to enable more precise conversion measurement.

Purpose: Measuring the success of advertising campaigns and optimising advertisements.

Legal basis: Art. 6 para. 1 sentence 1 lit. a) GDPR; Section 25 para. 1 TDDDG (consent)

Data transfer: Google may transfer data to the USA. EU Standard Contractual Clauses are in place.

12.4 Hotjar

We use Hotjar provided by Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141, Malta, to analyse user behaviour on our Website. Hotjar enables the recording of mouse movements, scrolling behaviour and clicks (so-called heatmaps) as well as the creation of anonymised session recordings. Personal data (e.g. entries in form fields) is automatically masked.

Purpose: Improving user-friendliness and Website design.

Legal basis: Art. 6 para. 1 sentence 1 lit. a) GDPR; Section 25 para. 1 TDDDG (consent)

Privacy information: https://www.hotjar.com/legal/policies/privacy/

12.5 Get Klar

We use Get Klar provided by Klar.so to analyse user behaviour on our Website. Get Klar collects anonymised usage data (e.g. pages accessed, click paths) without the use of tracking cookies and without transferring personal data to third parties.

12.6 Varify.io (A/B Testing)

We use Varify.io provided by Varify GmbH, Germany, to carry out A/B tests on our Website. Website elements are varied for different groups of users in order to improve user-friendliness. Varify.io collects anonymised usage data.

Purpose: Optimisation and further development of our Website through A/B testing.

Legal basis: Art. 6 para. 1 sentence 1 lit. a) GDPR; Section 25 para. 1 TDDDG (consent)

Privacy information: https://varify.io/datenschutz/

13. Product Reviews and Trusted Shops

Users have the option of reviewing our products on the Website. For reasons of attribution, users are required to provide a name or nickname. We process this data exclusively for the purpose of displaying the review on the Website.

Legal basis: Art. 6 para. 1 sentence 1 lit. a) GDPR (consent through voluntarily submitting the review). You may withdraw your consent at any time. Data processing carried out on the basis of consent remains lawful until consent is withdrawn.

Services and products of Trusted Shops SE (“Trusted Shops”), including the so-called Trustbadge, are integrated into our Website in order to display product reviews and offer buyer protection. For this purpose, processing your IP address is technically necessary.

Legal basis: Art. 6 para. 1 lit. f) GDPR; the legitimate interest is our ability to use reviews for advertising purposes on our Website.

As a result of the integration, Trusted Shops receives access to your IP address. The Trustbadge is also provided via a US-based CDN provider commissioned by Trusted Shops. Further information on data protection at Trusted Shops can be found in their Privacy Policy.

For the data processing, we are jointly responsible with Trusted Shops pursuant to Art. 26 GDPR. If you have questions concerning Trusted Shops or wish to exercise your data protection rights, please primarily contact Trusted Shops. You may, however, also contact us, and where necessary to answer your request, we will forward your request to Trusted Shops.

Review Requests via Trusted Shops

After completion of your order, we transmit your email address as well as the order number and information about the products ordered to Trusted Shops SE so that an invitation to submit a shop and/or product review can be sent to you. The review request is sent by Trusted Shops on our behalf.

Legal basis: Art. 6 para. 1 sentence 1 lit. a) GDPR (consent, which you provide during the ordering process or via the Trustbadge). You may withdraw your consent at any time with effect for the future, for example via the unsubscribe link in the review request or by sending us a message. Data processing carried out on the basis of consent remains lawful until consent is withdrawn.

14. Customer Surveys

We conduct voluntary customer surveys, to which we generally invite you by email (via our email marketing system Klaviyo). For the creation and analysis of these surveys, we use the service provided by Typeform SL, Spain.

The data processed includes your answers to survey questions, voluntarily provided information (e.g. name or email address, for example for participation in a prize draw) as well as technical data generated when using the survey form (e.g. IP address, time and progress of completion).

Legal basis: Art. 6 para. 1 sentence 1 lit. a) GDPR (consent through voluntary participation in the survey). You may withdraw your consent at any time; data processing carried out on the basis of consent remains lawful until consent is withdrawn.

15. Transfer of Data to Shipping Service Providers

To deliver your order, we transfer your delivery data and, where applicable, contact data to our logistics partner:

Nexxcargo GmbH
c/o Brooklyn Soap GmbH
Milchstraße 10, 30916 Isernhagen

As well as to the respective parcel service providers (e.g. DHL, DPD, UPS).

Purpose: Shipping and delivery of your order.

Legal basis: Art. 6 para. 1 sentence 1 lit. b) GDPR

16. Affiliate Marketing (Goaffpro)

We operate an affiliate program via GoAffPro, a service of Ayshoracle Technologies, in order to recruit partners to promote our products. A tracking pixel and Shopify app are used to record whether visitors accessed our Website through a partner link and completed a purchase.

Data processed: Click data, source URL, order value (for commission calculation).

Purpose: Administration and settlement of the affiliate program.

Legal basis: Art. 6 para. 1 sentence 1 lit. f) GDPR (legitimate interest in operating a partner program); Art. 6 para. 1 sentence 1 lit. a) GDPR; Section 25 para. 1 TDDDG (consent for the tracking cookie)

Privacy information: https://goaffpro.com/privacy

17. Data Transfers to Third Countries

Some of the service providers we use (in particular Shopify, Zendesk, Cloudflare, Google, etc.) transfer data to countries outside the EU/EEA (in particular the USA), where a lower level of data protection may apply.

By concluding EU Standard Contractual Clauses pursuant to Art. 46 para. 2 lit. c) GDPR, we ensure that your data is subject to an adequate level of protection by these providers. The Standard Contractual Clauses can be viewed at the following link: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

18. Storage Period and Deletion

Personal data is deleted as soon as the purpose of the processing no longer applies and there are no statutory retention obligations.

Contract data: 10 years (Section 147 AO, Section 257 HGB)

Log files: Generally 7–30 days

Proof of consent: 3 years after withdrawal (Art. 5 para. 2, Art. 83 para. 8 GDPR in conjunction with Section 41 sentence 2 BDSG)

Newsletter data: Until withdrawal of consent / unsubscribing

Cookies: According to the respective cookie duration

19. No Automated Decision-Making / Profiling

We do not carry out fully automated decision-making or comprehensive profiling within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

20. Your Rights as a Data Subject

If you have questions or comments regarding data protection settings, please contact us using the contact details provided above or in the legal notice. When processing your personal data, the GDPR grants you certain rights as a data subject:

Right of Access (Art. 15 GDPR): You have the right to obtain information about which personal data we process about you.

Right to Rectification (Art. 16 GDPR): You may request the correction of inaccurate or incomplete data.

Right to Erasure (Art. 17 GDPR, “Right to be Forgotten”): You may request the deletion of your data, provided that no statutory retention obligations prevent deletion.

Right to Restriction of Processing (Art. 18 GDPR): You may request restriction of processing under certain conditions.

Right to Data Portability (Art. 20 GDPR): You may request that your data be provided in a machine-readable format.

Right to Object (Art. 21 GDPR): You have the right to object at any time to the processing of your data on grounds relating to your particular situation. The objection may be submitted in any form with the subject line “Objection” to our contact address.

Right to Withdraw Consent (Art. 7 para. 3 GDPR): Where processing is based on consent, you may withdraw this consent at any time with effect for the future.

Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you violates data protection provisions. In particular, you may lodge the complaint with a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement.