Privacy Policy

Privacy policy according to Art 13 and 14 DSGVO

The following notes provide an overview of how your personal data is processed when you visit our website www.epone-cosmetics.com.

1. responsible body

Eponé Cosmetics GmbH
Munich Local Court
HRB 104793
Represented by the managing director Peter Grein
Helene-Wessel-Bogen 11,
80939 Munich,
E-mail: info@epone-cosmetics.com
Fax: +49 (0)89 – 31605759
Phone: +49 (0)89 – 3160573

General information on the handling of personal data

Personal data is processed when you use our website, contact us by e-mail, visit our store or when you store offline with us.

2. Cooperation with third parties

In some cases, we use external service providers and partners to process your data. These were carefully selected and commissioned by us. The partners are either bound by our instructions within the framework of commissioned processing or work together with us under joint responsibility. We also cooperate with partners who are professionally bound to secrecy, such as tax advisors, lawyers and other service providers.

As far as we cooperate with service providers in the field of logistics, we have trustworthy and selected service providers who cooperate with us in shipping the goods.

3. Data processing during the purchase of our products and services:

When you purchase our products online or offline, we process personal data insofar as this is necessary for the establishment, content or amendment of a contractual relationship.

The collected customer data are your name, address, contact data, payment data as well as the customer and order number, the ordered products, as well as invoice data and communication data regarding the orders. This data on our customers is deleted after the statutory retention periods have expired.

We transmit personal data to third parties only if this is necessary in the context of the contract, such as to the companies entrusted with the delivery of the goods or the credit institution entrusted with the payment processing.

If you purchase the products through our website, we also store the data mentioned in section 4, in addition to the time and date of purchase. Added username at registration and the password. We also do this in order to be able to prove the conclusion of the contract.

The legal basis is Art. 6 para. 1 lit. b DS-GVO for the initiation and fulfillment of contractual obligations. Insofar as we have a legitimate interest in data processing, the legal basis is Art. 6 para. 1 p. 1 lit.f DS-GVO.

4. Logging of usage, scope of data processing during website usage

We also store the usage processes during simple use (without registration or if you otherwise transmit information to us) on the website temporarily and independently of what you do in a log file. Thereby we store

the date and time of access
the duration of the access
The IP address
the operating system of the computer from which access is made
the web browser used to access the site
Websites from which the user has reached our site
the subpages that are used

The collection of this data is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website – for this purpose, the server log files must be recorded.

5. Contact us by e-mail or via the contact form

If you send us inquiries via the contact form, the information you provide in the inquiry form, including the contact data you enter there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions.

The processing of the data entered in the contact form is thus based on our legitimate interest in responding to your request and your wishes. The data you enter in the contact form will remain with us until you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies (e.g. after we have completed processing your request). Insofar as mandatory legal provisions such as retention periods oblige us to store data, we will not delete the data, but may only restrict the processing of the data.

If you contact us by e-mail, telephone or fax, your inquiry including all resulting personal data (name, inquiry) will be stored and processed by us for the purpose of processing your request. The processing of this data is based on Art. 6 para. 1 lit. b DSGVO, provided that your request is related to the performance of a contract or is necessary for the performance of pre-contractual measures. In all other cases, the processing is based on our legitimate interests Art. 6 para. 1 lit. f) DSGVO in the efficient processing of the requests you send to us.

6. Registration on the website

You can register on our website to use additional features on the site, in particular to learn about and view your orders. We will ask for your e-mail address and password. The mandatory information requested during registration must be provided in full. Otherwise, we will reject the registration.

The data collected during registration will be stored by us as long as you are registered on our website and will subsequently be deleted as soon as you cancel the registration. Insofar as statutory retention periods exist, the data shall be retained.

The legal basis is the contract of use, according to Art 6 para. 1 S. 1 lit b. DS-GVO for the customer account that you conclude as part of the registration.

7. Contract fulfillment and payment processing

Insofar as you complete purchase transactions via our website, we process personal data for the processing of the purchase transaction in addition to the data specified in sections 3 and 4. If, after the conclusion of the contract, there is an obligation to provide us with your payment data (e.g. account number in the case of direct debit authorization), this data will be required for payment processing.

Payment transactions via the common means of payment (Visa/MasterCard, direct debit) are made exclusively via an encrypted SSL connection. The legal basis is the execution of the contract according to Art 6 para.1 S. 1 lit b. DS-GVO that you conclude with us.

a. Cooperation with the payment service provider PayPal

If you choose to pay via PayPal, data will be processed there. In case of payment via PayPal, credit card via PayPal, direct debit via PayPal – or if offered also “purchase on account” – we pass on your payment data, which are your registration and usage data, your address, the amount, the IP address, technical information, such as time and date of access, as well as the location of the user within the scope of the payment processing to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”).

PayPal then processes this data on its own responsibility to make the payment from you. For more information on data processing by PayPal, please see their privacy policy https://www.paypal.com/webapps/mpp/ua/privacy-full

The order data will be passed on to PayPal via our website, as this is necessary for the payment processing for the products you have purchased from us. Legal basis for the disclosure of your data Art. 6 para. 1 lit. b DSGVO the processing of the contract with you.

PayPal reserves the right to conduct a credit check. PayPal does this to verify creditworthiness and identity, as well as to identify and, if necessary, collect outstanding debts and prevent criminal activity.

Furthermore, the credit rating may be carried out within the framework of an automated decision-making process. For information on this, please refer to PayPal’s privacy policy, especially under sections 11 and 12: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

You can view and manage the data to be processed via PayPal’s Privacy Hub in your PayPal account under Data: https://www.paypal.com/myaccount/privacy/privacyhub

b. Cooperation with the payment service provider Klarna

If you choose to pay via Klarna Bank AB (publ.), a public limited company under Swedish law, Sveavagen 46, 11134 Stockholm, Sweden (Klarna), your data will be processed as part of the payment and contract processing pursuant to Art. 6 para. 1 p. 1 lit. b) DSGVO passed on to Klarna. Klarna processes your data thereafter under its own responsibility and may also pass it on to third parties.

The transmission of this data takes place so that Klarna can create an invoice for the invoice processing you have requested. In addition, Klarna also makes credit checks via third party credit agencies. Klarna can only offer a certain payment method if this is made possible based on the results of the credit check. Furthermore, Klarna also passes on the data to collection agencies in the case of overdue receivables or sells receivables and thus also passes on personal data to third parties.

Furthermore, your data will also be forwarded to third party partners of Klarna, depending on whether you use Klarna’s mobile offers or access via a desktop.

Information on how Klarna processes this data can be found in the Klarna privacy policy https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy.

8. Cookies and storage of data on the terminal device

Cookies are text files that are automatically stored in the browser on your computer with a string of characters specific to your computer, so that your browser is recognized when you return to our site. These cookies are set only with a legal basis. Either your consent according to § 25 Abs.1 TTDSG and Art. 6 para.1 S.1 lit a) DSGVO or if this tool is absolutely necessary for the provision of the service requested by you (Our Website) (§ 25 Abs 2 Nr. 2 TTDSG) and we have a legitimate interest according to Art. 6 Abs.1 S.1 lit. f) GDPR to the further processing or this cookie is necessary to fulfill the contractual claims. Then Art. 6 para. 1 p. 1 lit. b DSGVO is the basis for further processing.

Cookies can be stored only for the session and are deleted at that moment when you leave the page or else close the browser. In addition, there are cookies that are permanently stored to save various settings, which are then immediately applied when you visit the site again. If nothing is specified for the deletion of the cookies, it can be assumed that they may be stored for up to one year. When the validity expires, the cookies are then deleted.

All information about the individual cookies can be found in our cookie settings. This consent management tool is provided to us by Borlabs GmbH, Rübenkamp 32, 22305 Hamburg. We use Borlabs on the basis of a legal obligation pursuant to Art. 6 para.1 Lit c. DSGVO, because we are obliged to make the consents to cookies controllable for you. In this tool you can set your preferences for the cookies to be placed on your computer. The categories of cookies used are as follows:

a. “Essential” or necessary cookies

These are not only the cookies that are mandatory to access the website at all, but also such cookies that enable and ensure basic functions of the website to display the service you have requested. This can be, for example, the cookie that stores your consent, but also a shopping cart function or a function that recognizes users after registration.

The legal basis for the use of cookies or tracking tools is for the technically necessary data processing §25 para. Para. 2 No. 2 TTDSG in conjunction with Art. 6 para. 1 S. 1 lit f. DSGVO our legitimate interest.

You can find more information about essential cookies here:

b. Cookies for statistics

Statistics and optimization cookies Cookies collect information anonymously. This information helps us understand how our visitors use our website.

The legal basis for the use of cookies or tracking tools for statistics is §25 para. Para. 1 TTDSG in conjunction with Art. 6 para. 1 S. 1 lit a. DSGVO, your consent.

Google Analytics

We use cookies to analyze your user behavior when visiting our website. Our goal is to evaluate the demand for our offers in this way. In doing so, we want to learn about usage habits at specific times, via specific devices, at specific locations. Our goal is to determine the economic exploitation of our offers and to market them.

The legal basis for the use of cookies or tracking tools is your consent to the setting of cookies in accordance with § 25 para. 1 TTDSG and Art. 6 para.1 S.1 lit. a) GDPR for the further processing of the data.

Google Tag Manager

Google Tag Manager captures interactions made on the website, controls them and sends them to the connected tools such as Google Analytics. The tag manager itself does not store any data, but it may forward personal data, such as the IP address of the computer, to tracking tools or other tools, and these may be stored and analyzed there. “Tags” – similar to keywords in the table of contents of a book – make it easier to find and edit applications in the website, which can then be controlled via a central user interface. This makes our work much easier and helps us keep track of the tools we use. If a deactivation of the tag manager has been made, this remains for all tracking tags that have been implemented with the Google Tag Manager.

Objection to the use by Google:

You can prevent this tracking process by turning off cookies for statistical purposes in our Consent Management Tool. Since Google also processes the data in the U.S., Google invokes the standard data protection clauses adopted by the EU Commission pursuant to Art. 46 para. 2 lit. (c) GDPR have been adopted. Google wants to ensure with this, and additional security measures the level of data protection of the GDPR, even if this is not guaranteed. https://policies.google.com/privacy/frameworks?hl=de We invoke and additional to your consent .

Which cookies Google uses you can find here or in our cookie settings of this information https://policies.google.com/technologies/types?hl=de&gl=de

Further information on data protection can be found here https://privacy.google.com/businesses/compliance/?hl=de#!?modal_active=none

c. External media:

Content from video portals and social media providers is blocked from the site. If cookies from external media are accepted, the setting of these cookies no longer requires further consent.

The legal basis for the use of cookies or tracking tools for external media is §25 para. Para. 1 TTDSG in conjunction with Art. 6 para. 1 p. 1 lit. a. DSGVO your consent.

Vimeo

We integrate videos into our offer with the help of the provider Vimeo, LLC at 555 West 18th Street, New York, New York 10011. Vimeo sets cookies, which you can delete in the cookie settings of our consent management tools.

When you access the Vimeo video, a connection to the Vimeo servers is established and the website visit data is transferred to the USA, that is your IP address and the browser used, furthermore it is transmitted to Vimeo what you have viewed and do on our website. If you are logged in as a Vimeo member, Vimeo assigns this information to your personal user account.

The cooperation with Vimeo is based on a data protection legal agreement on cooperation and the EU standard contractual clauses, according to Art. 46 DSGVO

When clicking the start button of a video, this information can also be assigned to an existing user account. You can prevent this assignment by logging out of your Vimeo user account before using our website.

For information on how Vimeo processes your data, please visit www.vimeo.com/privacy.
If you do not want Vimeo to track you, please delete this data.

Youtube

We incorporate videos into our site from Youtube because Youtube’s offerings are ideal for complementing our products and have the necessary reach for our content. The provider of Youtube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

By visiting the website, YouTube receives the information that you have accessed the corresponding subpage of our website. In addition, the data mentioned under point 2 of this declaration will be transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data is directly assigned to your account. If you do not want the assignment with your profile at YouTube, you must log out before activating the button. YouTube stores your data as a usage profile and uses it for the purposes of advertising, market research and/or designing its website to meet user needs. Such an evaluation is carried out in particular (even for users who are not logged in) for the provision of tailored advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact YouTube to exercise this right.

Google also processes the data in the USA. You can find out how Google and Youtube process your data at https://policies.google.com/privacy. Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de

As far as you have a Google account you can log in there and set the settings for advertising: https://adssettings.google.com/authenticated

9. Commercial e-mails without consent according to § 7 para. 3 UWG

If you purchase goods or services from us and provide us with your e-mail address, we may use it to send you promotional e-mails. For this purpose, we use the service provider Mailchimp for support and process the e-mail address according to the principles mentioned in section 6, but without the double opt-in procedure.

In such a case, only direct advertising for our own similar goods or services will be sent via the newsletter and you will be informed with each dispatch that you can revoke this newsletter at any time if you no longer wish to receive advertising without incurring any costs other than the pure transmission costs according to the basic rates.

The legal basis for sending the advertising emails is § 7 para. 3 UWG and Art. 6 para. 1 p. 1 lit. f) DS-GVO our legitimate interest in being able to address you in an advertising manner. In this case, our interest in being able to offer you, the purchaser, suitable additional products to those you have already purchased, within the framework of direct marketing, prevails.

Objection: You can object to the sending of advertising newsletters at any time. You can do this via the link at the end of the corresponding e-mail. There are no further costs for the cancellation than according to the basic rates. Or you can send us an email at newsletter@epone-cosmetics.com.

10. Newsletter

Through newsletters about our products, we inform users about our products, such as cosmetics and accessories, as well as special promotions and discounts (advertising), regularly by e-mail. We send this e-mail with your consent in accordance with Art. 6 para.1 S. 1 lit. a. DS-GVO as well as Art. 7 DS-GVO .

a. Service provider for the newsletter

For the technical implementation of the newsletter we use the company “Mailchimp ” www.mailchimp.com, a service of the American company “The Rocket Science Group, LLC” 675 Ponce de Leon Ave NE Suite 5000 Atlanta, GA 30308 USA. The e-mail addresses of the users of the newsletter are stored in the USA in order to send the newsletter for us.

We use the service provider Mailchimp with a legitimate interest according to Art. 6 para. 1 p.1 lit. f.) DS-GVO to ensure a good quality of email delivery and to be able to increase the efficiency of sending the newsletter. We believe that Mailchimp currently provides the best and most secure technology for sending newsletters.

Mailchimp also processes data in the USA and relies on the EU standard contractual clauses according to Art. 46 DS-GVO for data processing. Mailchimp has also taken measures to ensure that data processing continues to be secure and informs users about access to the data by US authorities, unless this is prohibited under US law. You can find out more about this in Mailchimp’s European Data Traffic Notice. https://mailchimp.com/help/mailchimp-european-data-transfers/

b. Newsletter registration

For the registration to the newsletter we use the so-called double opt-in procedure. After you subscribe to the newsletter, you will receive a confirmation email. In it, you will be asked to confirm the newsletter order again within 24 hours. If the confirmation is not received, your registration will expire.

Mandatory information for sending the newsletter is always your e-mail address. For promotional newsletters, we offer to voluntarily provide the surname and first name in order to personalize the newsletter.

When registering for our newsletter, the information on the e-mail address, your name, your IP address, as well as the time of ordering the newsletter and the confirmation of the newsletter by you are stored permanently. Our aim here is to log and store the newsletter order for evidence purposes.

Via the double opt-in procedure we can exclude that third parties use your e-mail address for the registration. We address you personally in the newsletter because we believe that personalized newsletters are more efficient than general newsletters and the orderer is more likely to read them.

This logging of the registration, and the double opt-in procedure is carried out with a legitimate interest according to Art. 6 para.1 S.1 lit. f GDPR to be able to lead evidence in disputes.

c. Performance measurement

With your consent according to § 25 Abs.1 TTDSG in connection with Art.7 DS-GVO we put a pixel in every mail. Furthermore, we want to analyze the usage behavior of our offered content with your consent according to Art. 6 Abs.1 S. 1 lit. a.) DS-GVO. The consent can be revoked at any time via the link in the newsletter or via newsletter@epone-cosmetics.com.

With Mailchimp, we measure the usage behavior of the prospects by measuring the open rates (was the email actually opened) and the click rates on the products (which links were clicked how often) in the newsletter. These open and click rates are stored in the software for the respective addressees of the newsletter and assigned to the recipient.

We want to determine the use of the newsletter by users via Mailchimp and thus measure whether the newsletter is read. Our goal is to determine the success of a newsletter. This gives the author of the newsletter the opportunity to pick up new topics that may be of interest based on the topics that have appeared. We do not evaluate the use of the newsletter by individual users and will not track who has clicked on which information.

In order to measure success technically, the opening rates and link clicks of the websites linked via the newsletter are evaluated. This is done via a tracking pixel in the newsletter. In doing so, Mailchimp stores the following information: Information about the device and applications you use to access emails sent through our services, your IP address, operating system, browsers, email client type, and other information about your system and connection. However, we do not evaluate these, but it remains with the above-mentioned evaluation.

Usage data, is collected whenever you interact with emails sent through Mailchimp. This is the date and time of accessing emails and which pages are accessed from the email. We also collect information about the performance of the Services, including measurement data related to email deliverability.

Not only we, but also Mailchimp processes this data. We have concluded a corresponding data processing agreement with Mailchimp. For more information on the processing of information by Mailchimp, our service provider, please visit https://mailchimp.com/legal/privacy/ and https://mailchimp.com/legal/privacy/#3._Privacy_for_Contacts.

If newsletters are not used for a longer period of time, we will deactivate them if necessary. On the one hand, this saves costs and on the other hand, it helps you to avoid unnecessary information.

d. Revocation, objection and deletion of data

You have the option to unsubscribe from the newsletter at any time. You can object to consent. If we process your data with a legitimate interest, you can revoke the processing in accordance with the requirements of Art. 21 DSGVO. In both cases, the processing of your personal data for the above purposes will become unlawful in the future. However, this does not affect the processing of these data in the past.

If you only do not want the performance measurement, you only have the option to revoke the consent to send the newsletter, as we do not want to send the newsletter without performance measurement.

You can unsubscribe from the newsletter at any time via a link that is included in every single mail or via the following e-mail address: newsletter@epone-cosmetics.com

Basically, we delete your data when you unsubscribe from the newsletter. In the event of an advertising objection, we reserve the right to add your e-mail address to a blacklist to ensure that you no longer receive advertising on this e-mail. Also, if you provide us with additional email addresses that you want us to block from advertising, we will add them to the block list. We maintain this blocking list with a legitimate interest according to Art. 6 para.1 lit. f. DS-GVO and thus ensure that you do not receive unsolicited advertising from us.

Insofar as we log your subscription to the newsletter, we store this data for a period of 3 years with the end of the year in which you unsubscribed from the newsletter. We make these on the basis of our legitimate interest according to Art. 6 para. 1 lit. f DS-GVO, in order to be able to provide proof of the newsletter order also in legal disputes or vis-à-vis authorities.

11. Deletion of personal data

Unless otherwise specified in this statement and in the Consent Management Tool, we generally delete personal data as soon as the purpose for processing ceases to apply or the statutory retention periods have expired. The legal basis for the storage of data in the case of statutory retention periods is Art. 6 para.1 S.1 lit. c) DS-GVO as well as, if applicable, also a legitimate interest according to Art. 6 para. 1 S. 1. lit. f) DS-GVO, if we need the data to protect our rights. If necessary, we will also inform you about the deletion directly there with regard to individual processing operations.

Personal data is still required for storage if contractual or legal claims may still exist against us or if we need the data to check the legitimacy of the assertion of claims or if we, for our part, want to provide evidence of facts related to the processing. In this respect, the statutory periods of limitation shall be decisive above all. If we are required by law to retain data, we will delete it at the earliest after expiry of the statutory periods, which may be commercial and tax periods. Legal basis can, the contract performance Art. 6 para.1 lit. b) DS-GVO, the retention periods Art. 6 para.1 S.1 lit. c) DS-GVO as well as, if applicable, a legitimate interest according to Art. 6 para. 1 S. 1. lit. f) GDPR.

Cookies are deleted depending on the storage period in our Consent Management Tool. Cookies that are permanently placed on your computer are deleted after one year at the latest.

12. Operation of our Instagram account

We run the channel https://www.instagram.com/epone-cosmetics/ on Instagram and publish images and texts as well as movies there. This is a service of META Inc, 1 Hacker Way, Menlo Park, CA 94025, USA, which is operated in the EU by META Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Instagram is a product of the Facebook group and the data is processed by Facebook.

If you are logged in to your Instagram account, you can link the content of our pages to your Instagram profile by clicking on the Instagram button. This allows Instagram to associate the visit to our pages with your user account. You can find out what data is collected in the Instagram privacy policy https://help.instagram.com/519522125107875

When you click on Instagram images, personal data such as the IP address of your computer and your visitor behavior (see section 3 above) are transmitted to Instagram’s servers in the USA. This data transfer to the USA takes place on the basis of the standard contractual clauses according to Art. 46 DSGVO

We process the data under joint responsibility with Instagram. Which data is collected by Facebook with Personzug is explained here: https://www.facebook.com/legal/terms/information_about_page_insights_data

Furthermore, the addendum for responsible parties applies, which defines further obligations of the contracting parties and Facebook and about which we also inform you. https://www.facebook.com/legal/controller_addendum

Facebook, for its part, also keeps privacy information available: https://www.facebook.com/about/privacy about which we also inform you.

If you do not want Instagram to store data about your visit to our website, you must log out of it and delete the cookies in the browser you are using. Here you can object to the use of your data by Instagram. https://www.facebook.com/help/contact/1994830130782319

13. Your rights as a data subject of a data processing operation

If we process personal data from you, you can assert various rights against us in relation to data and information about you – within the framework of the legal requirements:

You can request information (Art. 15 DS-GVO) about the data we have stored about you at any time
In addition, you can request that incorrect data be corrected (Art. 16 DS-GVO)
Or that personal data are restricted for further processing (Art. 18 DS-GVO)
It may also be requested that data be deleted (Art. 17 DS-GVO)
You also have the right to have your data transferred to a third party or you (Art. 20 DS-GVO)
If we use your data on the basis of consent, you have the right to revoke this consent at any time with effect for the future. Please address the revocation informally to the responsible body named in item 1 above

We reserve the right to clarify whether you are also the person entitled to the assertion of these rights, in particular to the assertion of information rights. We are obliged to clarify the identity of the person claiming rights.

The text of the law on the above standards can be found at https://dejure.org/gesetze/DSGVO in Chapter III.

Your right to object, according to Art 21 DS-GVO

Insofar as we use your data with a legitimate interest, you can object to the use at any time. Insofar as the objection is justified in individual cases due to your particular situation, we will delete your data. We will not delete the data if we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if the processing is for the purpose of asserting, exercising or defending legal claims. Please address your objection to the responsible body named in section 1.

14. Right of appeal to a supervisory authority

If you wish to complain about the handling of your personal data, you have the right to complain to a data protection supervisory authority about the processing of personal data by us. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision https://www.lda.bayern.de/de/index.html#

15. Modification of the privacy policy

Insofar as legal or technical changes make it necessary to adapt the data protection declaration, we will amend it and adapt individual clauses or the entire declaration to the given circumstances. The current data protection declaration will be published online here and the old declarations will be archived. If required, we will provide you with the old data protection declarations.

March 2023

Privacy Policy

Privacy policy

Imprint