Privacy policy of Yours Truly GmbH

Valid from 01.12.2020

We take your privacy very seriously and process your personal data in accordance with the applicable statutory data protection requirements. Personal data in the sense of this information is all information that can be related to your person, e.g. name, address, e-mail and IP address, user behaviour.

The following data protection information informs you about the processing in your personal data by us. In addition, we will give you an overview of your rights in connection with data protection law. Which data is processed in detail and how it is used depends largely on the services used, applied for or agreed upon.

1. Controller and data protection officer

(1) The controller for data processing in accordance with Article 4 No. 7 of the General Data Protection Regulation (DS-GVO) or the service provider in accordance with Section 13 of the German Telemedia Act (TMG) is:

Yours Truly GmbH
Breslauer Str. 20
64342 Seeheim-Jugenheim

(2) You can reach the data protection officer at

Wild Beauty GmbH
Der Datenschutzbeauftragte
Breslauer Str. 20
64342 Seeheim-Jugenheim
e-Mail: datenschutz@wild-beauty.de

2. Source of personal data

We process personal data that we receive from you in the course of your visit to our website or when you contact us.

3. Categories of personal data processed

(1) If you visit or use or website for purely informational purposes, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser sends to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website and to ensure the stability and security of our services:

- Your IP-address,
- Date, time and duration of your visit,
- Content of the request (concrete page),
- Access status/http status code,
- Amount of data transmitted in each case,
- Website from which the request comes,
- Your browser,
- Your operation system.

This data is used exclusively for internal statistical purpose.

(2) In addition to the data mentioned above, transient and persistent cookies are stored on your computer or mobile device when you use our website. Cookies are small text files which are stored on your hard disk in relation to the browser you are using and through which certain information is sent to the site that set the cookie. Cookies cannot execute programs or transfer viruses to your computer. They are used to make the website more user-friendly and effective overall.

(3) Most browsers are set to accept cookies. However, you can deactivate the storage of cookies in your browser at any time or set your browser to notify you as soon as cookies are sent. However, we would like to point out that you may not be able to use all the functions of this website.

(4) We will link this stored information with other data provided by you for the purpose of making our website more user-friendly, effective and thus more attractive for you.

4. Hosting

(1) Within the scope of processing on our behalf, Profihost provides us with the service for hosting and displaying the website.

5. Further functions and offers on our website

(1) Apart from the purely informative use of our website, we offer various services which you can use if you are interested. To do so, you will usually have to provide additional personal data which we use to provide the respective service.

(2) When you contact us by e-mail, the data you provide (your e-mail address, name and telephone number, etc.) will be stored by us in order to answer your enquiry. We delete the data arising in this connection after storage is no longer necessary or restrict processing if there are legal storage obligations.

6. Google Universal Analytics with IP-anonymisation

(1) This website uses Google Universal Analytics with IP anonymisation, a web analysis service of Google Inc. ("Google"). Google Universal Analytics uses "cookies". The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. However, by activating IP anonymisation on this website, your IP address will be shortened by Google within member states of the European Union or in other states which are party to the Agreement on the European Economic Area. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage.

(2) The IP address transmitted by your browser within the framework of Google Universal Analytics is not combined with other data from Google.

(3) In addition to the cookie settings of your browser, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

(4) We would like to point out that on this website Google Universal Analytics has been extended by the code "ga('set', 'anonymizeIp', true);" to ensure anonymous recording of IP addresses (so-called IP masking). This means that IP addresses are processed in a shortened form, thus excluding the possibility of direct personal references.

(5) We use Google Analytics to analyse and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user.

(6) Third Party Information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of Use: http://google.com/analytics/terms/de.html; Privacy Information: https://www.google.com/analytics/learn/privacy.html?hl=de and the Privacy Policy: http://www.google.de/intl/de/policies/privacy.

(7) Furthermore, this website uses Google Signals. This is an extension function of Google Analytics, which enables so-called "cross-device tracking". This means that if your internet- capable devices are linked to your Google account, Google can generate reports on usage behaviour (in particular the number of users across devices), even if you change your end device. Google uses data for this purpose, provided that you have activated the setting "personalised advertising" in your Google account. We do not process personal data in this respect, we only receive statistics based on Google Signals. You can deactivate the setting "personalised advertising" in your Google account at any time and thus object to the collection of data by Google Signals.

7. DoubleClick-Cookie

(1) Within the scope of the application of Google Analytics (see above), this website also uses the so-called DoubleClick cookie for advertising purposes, which enables your browser to be recognised when you visit other websites. The information automatically generated by the cookie about your visit to this website is usually transferred to a Google server in the USA and stored there. The IP address is shortened by activating IP anonymisation on this website before transmission within the member states of the European Union or in other states which are party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. The anonymised IP address transmitted by your browser within the framework of Google Analytics is not combined with other data from Google. Google will use this information to compile reports on website activity and to provide other services associated with website use. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. The data collected in this context will be deleted after the end of the purpose and use of Google DoubleClick by us.

(2) Third Party Information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Privacy Policy: http://www.google.de/intl/de/policies/privacy.

8. Google Adwords (Remarketing)

(1) This website uses Google Adwords Remarketing, a web analysis service of Google Inc. (“Google”). Google uses “cookies” for this purpose (for more details, please refer to section 3). For this cookie, the unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions) and opt-out information (marking that the user no longer wishes to be addressed) are usually stored as analysis values. It is used to uniquely identify a web browser on a specific computer and not to identify a person. Personal data is not stored. The information generated by the cookie is usually transferred to a Google server in the USA and stored there. However, by activating IP anonymization on this website, your IP address will be previously shortened by Google within member states of the European Union or in other states which are party of the Agreement on the European Economic Area, in order to exclude the possibility of a direct personal link. On behalf of the operator of this website, Google will use this information to record and evaluate your use of certain Google services or websites in the Google display network.

(2) In addition to the cookie settings of your browser, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plug-in available under the following link: https://www.google.com/settings/ads/plugin. In addition, you can deactivate interest-based ads on Google and interest-based ads on the web (within the Google display network) in your browser by activating the "Off" button at http://www.google.de/settings/ads or by deactivating them at http://www.aboutads.info/choices/. However, we would like to point out that in this case you may not be able to use all the functions of this website to their full extent. You can view the Google data protection declaration at: http://www.google.com/privacy/ads/.

(3) We would like to point out that on this website Google Adwords (Remarketing / Conversion Tracking) has been extended by the code "ga('set', 'anonymizeIp', true);" in order to guarantee anonymous recording of IP addresses (so-called IP-Masking). This means that IP addresses are processed in a shortened form, thus excluding the possibility of direct personal references.

(4) We use the remarketing function to present users of our website on other websites within the Google display network (on Google itself, so-called "Google ads" or on other websites) ads based on their interests. For this purpose, the interaction of users on our website is analysed, e.g. which offers users are interested in, in order to be able to show them targeted advertising on other pages after they have visited our website.

(5) Third Party Information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of Use: http://google.com/analytics/terms/de.html; Privacy Information: https://www.google.com/analytics/learn/privacy.html?hl=de and the Privacy Policy: http://www.google.de/intl/de/policies/privacy.

9. Hotjar

(1) This website uses Hotjar, a web analytics service provided by Hotjar Ltd. This tool allows us to track movement on our website (so-called heat maps). For example, you can see how far users scroll and which buttons users click on how often. The tool also allows us to obtain feedback directly from the users of the website. Hotjar uses "cookies" for this purpose (for more details see section 3).

(2) In addition to the cookie settings of your browser, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Hotjar and the processing of this data by Hotjar by using a "Do Not Track" header to prevent the use of the Hotjar tool, so that no data about the visit of the respective website is recorded. If you use our website with different browsers/computers, you must set up the "Do Not Track Header" separately for each of these browsers/computers. You can find detailed instructions with information about your browsers at: https://www.hotjar.com/opt-out.

(3) We would like to point out that by using Hotjar we can only understand which buttons you click and how far you scroll. Areas of the web pages in which personal data of you or third parties are displayed are automatically hidden by Hotjar and can therefore not be traced at any time.

(4) By using Hotjar, we obtain valuable information to make our website even faster and more customer friendly.

(5) Third Party Information: Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe Tel.: +1 (855) 464-6788). Further Information about Hotjar Ltd. and the Hotjar tool can be found at: https://www.hotjar.com; the privacy policy of Hotjar Ltd. can be found at: https://www.hotjar.com/legal/policies/privacy.

10. Zenloop

(1) For the purposes of customer and product evaluations by our customers and for our own quality management, we use the personal data provided by you in the course of the purchase, such as e-mail address, to request an evaluation of your order via the evaluation system used by us. By agreeing to this privacy policy at the end of the ordering process, you consent to us sending you an email to the email address you provided after your order has been processed with a request to submit a review. You may revoke this consent at any time by sending an informal message by email to datenschutz@wild-beauty.de.

(2) We work with zenloop GmbH, Habersaathstraße 58, 10115 Berlin. zenloop is a business-to-business software-as-a-service platform that allows us to collect and analyse feedback from our customers through various channels. This allows us to align and improve our offering to the needs of our customers. In addition, zenloop collects your survey responses. The legal basis for the processing of data by zenloop is Art. 6 para. 1 lit. f GDPR. We have entered into a data processing agreement with zenloop pursuant to Article 28 (3) of the GDPR and ascertained that zenloop has implemented appropriate technical and organisational measures in such a way that the processing complies with the requirements of the GDPR and ensures the protection of your rights. You can find more detailed information in zenloop’s Privacy Policy at https://www.zenloop.com/en/legal/privacy.

(3) You can be redirected to a review platform after submitting your review, where you can post your review publicly.

11. Conversion Tracking & Retargeting Adform

(1) In order to improve the comfort and quality of our service we use conversion tracking and retargeting technology, both web services of Adform ApS.

(2) Conversion-Tracking:

This website uses conversion tracking from Adform. The temporary cookie for conversion tracking is set when a user contacts an ad placed by Adform.

(3) Users who do not wish to participate in tracking can deactivate the cookie from Adform or Google via their Internet browser or object to the collection and storage of data here at any time in the future. Cookies already stored on your computer can be deleted in the browser you are using or by deleting temporary websites.

(4) Retargeting: This website uses retargeting technology from Adform. This enables us to target those Internet users who have already shown an interest in our website and our products with advertisements on our partners' websites. During retargeting, the display of advertising material is based on a cookie-based analysis of previous user behaviour. This is a temporary cookie that loses its validity after 60 days. If you do not want Adform to display interest-based advertising to you, you can object to the future collection and storage of data at any time here: https://site.adform.com/de/privacy-center/platform/widerrufsrecht/.

(5) Third Party Information: Adform ApS, Wildersgade 10B, 1, 1408 Copenhagen K, Denmark. Further information about Adform can be found at https://site.adform.com/. The privacy policy of Adform can be found at: https://site.adform.com/de/privacy-center/platform/datenschutzrichtlinie-fuer-produkte-und-services/

12. MediaMath Analytics & Insights

(1) This website uses MediaMath Analytics & Insights, a web analytics service provided by Media-Math, Inc.

(2) MediaMath processes the data connected to your terminal device into a pseudonym, a so- called "MediaMath ID". This unique MediaMath ID may then be stored in a cookie on your terminal device and helps to provide more relevant advertisements for you. The MediaMath ID and other information collected through the platform can also help us measure your activity on our website and thus determine the effectiveness of the ads delivered through the platform. This will help us better serve your needs. It also allows us to provide you with ads for the types of products you might be interested in.

(3) MediaMath may transfer this information to third parties if required by law or if third parties process this data on behalf of MediaMath.

(4) Third Party Information: MediaMath, Inc. 4 World Trade Center, 150 Greenwich Street, 45th Floor, New York, NY 10007, For further information from MediaMath, please visit https://www.mediamath.com/. The privacy policy of MediaMeth can be found at http://www.mediamath.com/de/datenschutzrichtlinie/.

13. Live chat tool UserLike

(1) On this website we use the live chat tool UserLike / userlike.com, a live chat of the company Userlike UG (haftungsbeschränkt), Probsteigasse 44-46, 50670 Köln; Germany. You can use the live chat like a contact form to chat with our employees in almost real time. At the start of the chat, personal data is generated, which we process for the purpose of answering the request in the context of the contract processing by us. In addition, the use of this tool serves to safeguard our legitimate interests in effective and improved customer communication, which are predominant in a balancing of interests.

- Date and time of the request,
- Browser type/version,
- IP address,
- operating system used,
- URL of the previously visited website,
- Amount of data sent,
- First name, surname,
- e-mail address.

(2) Depending on the course of the conversation with our employees, further personal data may be entered by you in the chat. The type of this data depends on your request or the problem you describe to us.

(3) When you visit our website, the chat widget is loaded from AWS Cloudfront in the form of a JavaScript file. The chat widget is practically the source code that runs on your computer and enables the chat.

(4) In addition, we store the course of the live chats at the latest until the statutory deletion periods are reached. This serves the purpose of saving you from possibly having to provide extensive explanations about the history of your inquiry as well as for the constant quality control of our live chat offer. The processing is therefore permitted in accordance with Art. 6 para. 1 letter f DSGVO. If you do not wish to have your data stored, you are welcome to inform us of this by using the contact details listed here. Saved chats will then be deleted immediately. The storage of chat data also serves the purpose of ensuring the security of our information technology systems. This is also our legitimate interest, which is why the processing is permitted under Art. 6 para. 1 letter f DSGVO.

(5) Further information can be found in Userlike UG's privacy policy at http://www.userlike.com/terms#privacy-policy.

14. Integration of Google Maps

(1) On this website we use the services of Google Maps. This enables us to display interactive maps directly on the website and makes it easy for you to use the map function.

(2) By visiting the website, Google receives the information that you have called up the corresponding subpage of our website. In addition, the data mentioned in section 3 of this data protection notice is transmitted. This happens regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in at Google, your data will be assigned directly to your account. If you do not want your data to be assigned to your Google profile, you must log out before activating the button. Google stores your data as user profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have a right of objection to the creation of these user profiles, whereby you must contact Google to exercise this right.

(3) Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the provider's privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA.

15. Newsletter

(1) With your consent you can subscribe to our newsletter, with which we inform you about our current interesting offers. The advertised goods and services are named in the declaration of consent.

(2) We use the so-called double-opt-in procedure to register for our newsletter. This means that after your registration, we will send you an e-mail to the e-mail address you have provided, in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month. In addition, we save your IP address and the time of registration and confirmation. The purpose of this procedure is to provide evidence of your registration and, if necessary, to clarify any possible misuse of your personal data.

(3) Your e-mail address is the only mandatory information for sending the newsletter. The provision of further, separately marked data is voluntary and is used to address you personally. After your confirmation we will save your e-mail address for the purpose of sending the newsletter.

(4) You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can revoke your consent by clicking on the link provided in every newsletter e-mail or by sending a message by post, telephone or fax to the contact details given in the imprint.

(5) The newsletter is sent by the third-party provider MailChimp within the scope of a processing on our behalf MailChimp.

(6) Third Party Information: MailChimp, The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA, for more information about MailChimp, please visit https://mailchimp.com/. For the privacy policy of MailChimp, please visit: https://mailchimp.com/legal/privacy/.

15.a. Contest

In addition to the above mentioned personal data, we receive further personal data from you in the course of your participation in the contest or the use of a user-generated advertising link of a family member, friend or acquaintance: Your first and last name, your e-mail address, and, if applicable, the fact that you were recruited by one of our customers (your family member, friend or acquaintance). These personal data are collected for the purpose of the contest. The legal basis for this is Art. 6 (1) b) and f) DS-GVO. The processing, storage and use of this data is solely for the purpose of conducting the contest, in particular to determine the persons recruited and their advertisers, to notify the winners and to distribute the rewards. After the end of the contest or after the expiry of the limitation periods of any claims and legal storage and documentation obligations, the collected data will not be used further, but deleted.

16. Facebook-Fanpage (Insights)

(1) To advertise our products and services, we operate a fan page on Facebook. Jointly responsible for the operation of this Facebook fan page are in the sense of the DS-GVO and other data protection regulations:

Facebook Ireland Ltd. („Facebook“)
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland

and

Yours Truly GmbH
Breslauer Str. 20
64342 Seeheim-Jugenheim
Deutschland

As part of the joint responsibility, a corresponding supplementary agreement ("PageInsightsController Addendum") was concluded with Facebook. This addendum defines the respective responsibilities of Facebook and us as fan page operators with regard to the processing of Insights data. Further information can be found here.

(2) Our fan page is available for Facebook users as well as for visitors who do not have a Facebook account. Regardless of whether Facebook users or not, Facebook places cookies when our fan page is called up. These collect information on user behaviour, even beyond the visit to our fan page. Furthermore, the cookies provide us as the operator of the fan page with anonymous statistical information about the visitors to our fan page (so-called Facebook Insights data). During these processes your data is transferred to Facebook servers in the USA and stored there.

(3) Facebook collects and provides us with the following information in anonymous form: total number of page views, "Like" information, page activity, post interactions, reach, video views, post reach, comments, shared content, responses, gender, country and city of origin, age, language, shop views and clicks, clicks on route planners, clicks on phone numbers. Furthermore, data on the Facebook groups linked to our fan page is provided in this way.

(4) We use this anonymous data to make contributions and activities on our fan page more attractive. For example, we use the distribution according to age and gender for an adapted approach and the preferred visiting times for a time-optimised planning of our contributions. Information about the type of terminal equipment used by visitors serves to visually and creatively adapt contributions.

(5) According to the Facebook Terms of Use, which each user agreed to when creating their Facebook profile, we can identify subscribers and fans of the Fan Page and view their profiles and other shared information from them.

(6) The prevention of the storage of cookies is possible through the settings in your browser or, if you have a Facebook account, by using the opt-out option of Facebook at: https://www.facebook.com/settings?tab=ads. You can find more detailed information on this at https://www.facebook.com/policies/cookies/. If you do not have a Facebook account, you can use the Digital Advertising Alliance in the USA, the Digital Advertising Alliance of Canada or the European Interactive Digital Advertising Alliance in Europe to stop seeing interest-based online advertisements from Facebook and other participating companies. For more information, please see the Facebook Privacy Policy at: https://www.facebook.com/about/privacy/.

17. Categories of recipients of personal data

(1) We have some of the aforementioned processes and services carried out by carefully selected service providers commissioned in accordance with data protection regulations. These external service providers are bound by our instructions and are regularly checked. They will not pass on your data to third parties.

(2) With regard to the passing on of data to other recipients, we will only pass on information about you if required by law, if you have given your consent or if we are authorised to do so. If these conditions are met, recipients of personal data may be, among others

- Public bodies and institutions (e.g. tax authorities, criminal prosecution authorities) if there is a legal or official obligation
- Other companies or comparable institutions to which we transfer personal data for the purpose of conducting business with you.
- Other companies within the Group (e.g. to process payment transactions or for risk management due to legal obligations).

18. Purposes for which personal data are to be processed and the legal basis of the processing

We process your personal data in compliance with the applicable statutory data protection regulations. Processing is lawful if one of the following conditions is fulfilled:

- Consent (Article 6 (1) (a) DS-GVO):
The lawfulness of the processing of personal data is given when you give your consent to the processing for specified purposes (e.g. processing of your request, use of the data for marketing purposes). Consent that has been granted can be revoked at any time with effect for the future.
- Based on contractual obligations (Article 6 (1) (b) DS-GVO):
We process personal data in order to fulfil our contractual obligations or to carry out pre-contractual measures, which are carried out on request. The purposes of data processing are primarily derived from your enquiry.
- Due to legal requirements (Article 6 (1) (c) DS-GVO):
Yours Truly GmbH is subject to various legal obligations. These include among others
- Commercial and tax law storage regulations according to the German Commercial Code and Tax Code,
- Fulfilment of control and reporting obligations under tax law.
- As part of the balancing of interests (Article 6 (1) (f) DS-GVO):
As far as necessary, we process your data beyond the actual fulfilment of the contract to protect legitimate interests of us or third parties. Examples:
- Assertion of legal claims and defence in legal disputes,
- Ensuring IT security and IT operation,
- To analyse and improve the use of our website,
- To use social media plug-ins.

19. Intention to transfer the personal data to a third country or international organisation

An active transfer of personal data to a third country will only take place if this has been expressly indicated in the context of the aforementioned services.

20. Criteria for determining the length of time for which personal data are stored

(1) The data will be stored in accordance with the statutory provisions on data processing and in compliance with statutory retention periods. We process and use your data exclusively for the purposes to which we are entitled and for as long as the data is required for these purposes.

(2) When the data are no longer necessary for the purpose or in order to comply with legal obligations, they shall normally be erased unless their further processing – limited in time and, where appropriate, to a limited extent – is necessary for the following purposes:

- Fulfilment of commercial and tax law retention obligations: These include the German Commercial Code (HGB) and the German Fiscal Code (AO). According to these, the storage and documentation periods are specified for up to 10 years.
- Preservation of evidence within the framework of the statutory limitation regulations: According to §§ 195 ff. of the German Civil Code (BGB), the regular limitation period is three years, but under special circumstances up to 30 years.

21. Your privacy rights

(1) Every data subject has the right of access under Article 15 DS-GVO, the right of rectification under Article 16 DS-GVO, the right to erasure under Article 17 DS-GVO, the right to restriction of processing under Article 18 DS-GVO, the right to object under Article 21 DS-GVO and the right of data portability under Article 20 DS-GVO. With regard to the right of information and the right of deletion, the restrictions under Sections 34 and 35 BDSG apply. In addition, there is a right of appeal to a competent data protection supervisory authority (Article 77 DS- GVO in conjunction with Article 19 BDSG).

(2) You can withdraw your consent to the processing of personal data at any time with effect for the future. This also applies to the withdrawal of declarations of consent that were given to us before the basic data protection regulation came into force, i.e. before 25 May 2018.

(3) You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data relating to you on the basis of Article 6 paragraph 1 e) DS- GVO (data processing in the public interest) and Article 6 paragraph 1 f) DS-GVO (data processing based on a balancing of interests); this also applies to profiling within the meaning of Article 4 No. 4 DS-GVO based on this provision.

In individual cases, we process your personal data in order to carry out direct advertising. You have the right to object, at any time, to the processing of personal data concerning you for the purpose of such direct marketing, including profiling, to the extent it is connected with such direct marketing.

If you object to the processing for direct marketing purposes, we will no longer process your personal data for these purposes, unless we can demonstrate compelling reasons for processing which are worthy of protection and which outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.

The objection can be made without form and should be addressed, if possible, to

Wild Beauty GmbH
Der Datenschutzbeauftragte
Breslauer Str. 20
64342 Seeheim-Jugenheim
e-mail: datenschutz@wild-beauty.de

22. Obligation to provide and possible consequences of not providing personal data

When using our offers, you must provide us with the personal data required to fulfil the purpose or which we are legally obliged to collect. Without this data we will generally not be able to provide the requested service.

23. Existence of automated decision-making, including profiling

As a matter of principle, we do not use a fully automated individual decision-making process in accordance with Article 22 of the DS-GVO to establish and implement the business relationship. Should we use this procedure in individual cases, we will inform you of this separately as far as this is required by law.

24. Check creditworthiness from Creditreform Boniversum GmbH

Our company regularly checks customers for creditworthiness whenever contracts are concluded; if there is a legitimate interest, we also check existing customers. We therefore collaborate with Creditreform Boniversum GmbH – address: Hellersbergstrasse 11, 41460 Neuss, Germany – which provides us with the relevant data. Acting on behalf of Creditreform Boniversum, we hereby wish to provide you with the following information under the EU GDPR article 14, by way of anticipation: Creditreform Boniversum GmbH is a consumer credit agency. It runs a database storing credit information about private individuals. On this basis, Creditreform Boniversum provides its clients with information on the creditworthiness of their customers. Clients include, for instance, banks, leasing companies, insurance companies,telecommunications companies, receivables management companies, as well as shipping, wholesale and retail companies and other companies supplying goods and services. Acting within the parameters of the law, some of the data in the creditworthiness database are also supplied to other corporate databases, including databases for address trading purposes.

The database of Creditreform Boniversum stores primarily names, addresses, dates of birth, email addresses (if applicable), payment histories and ownership structures. The purpose of processing data stored in this way is to provide information about individuals on whom creditworthiness information is requested. The legal basis for such processing is EU GDPR article 6 (1f). Under this provision, information about such data may only be provided if a client can prove convincingly that he or she has a legitimate interest in obtaining the information. If data are sent to non-EU countries, this is done on the basis of so-called “standard contractual clauses”, which you can view under the following link:

https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32001D0497&from=en

You can also request this information to be sent to you.

Data are stored for as long as knowledge of those data is required to realise the purpose of storage. Such knowledge is usually required for an initial storage period of three years. After the expiry of this period, a review is conducted whether storage continues to be necessary; otherwise the data are deleted on the precise expiry date. If the facts of a matter cease to be relevant, the data are erased on the precise date three years after cessation. Entries in the debtors’ list are deleted on the precise date three years after an official order for entry was presented, in compliance with the German Code of Civil Procedure (ZPO), section 882e.

The following are examples of legitimate interests within the meaning of the EU GDPR article 6 (1f): loan decisions, initiation of business, ownership structures, receivables, creditworthiness checks, insurance agreements, enforcement information.

You have a right to obtain information about the data stored by Creditreform Boniversum GmbH about yourself as a person. If those data are incorrect, you are entitled to rectification or erasure. If it is not possible to determine immediately whether the data are correct or incorrect, you are entitled to the blocking of the relevant data until your entitlement has been clarified. If your data are incomplete, youcan demand their completion. Page 2 of 2 | Last updated: 12/2019 | © 2019 Boniversum

If you have given your consent for the processing of data stored by Creditreform Boniversum, you may revoke this consent at any time. Your revocation will not impact the legitimacy of any processing of your data that may have taken place on the basis of your consent prior to revocation.

If you have any objections, requests or complaints concerning data protection, you may contact the Data Protection Officer of Creditreform Boniversum at any time. He or she will assist speedily and confidentially on all issues of data protection. Alternatively, you can lodge a complaint about Boniversum’s data processing with the State Data Protection Officer (Landesbeauftragte für Datenschutz) of the German federal state that is relevant to you. Data stored about you by Creditreform Boniversum come from publicly accessible sources as well as from debt collection companies and their clients.

To determine your creditworthiness, Creditreform Boniversum assigns a score to your data. The data underlying this score include your age, gender, address details and some of your payment experience data. The various data form part of the score calculations with different weights. Creditreform Boniversum clients use such scores to help them reach decisions about granting loans.

Right to object:

The processing of data stored by Creditreform Boniversum takes place on compelling legitimate grounds for the protection of creditors and loans, where processing regularly overrides their interests, rights and freedoms or where it serves the establishment, exercise or defence of legal claims. You can only object to Creditreform Boniversum about the processing of your data if you have grounds relating to your particular situation and if you can substantiate those reasons. If such special reasons are verifiably available, your data will cease to be processed there. If you object to the processing of your data for advertising and marketing purposes, then your data will no longer be processed for those purposes.

The entity with responsibility under the EU GDPR article 4 (7) is Creditreform Boniversum GmbH, Hellersbergstrasse 11, 41460 Neuss, Germany. Your contact point within our company is the Consumer Service, phone: +49 (0) 2131 36845560, fax: +49 (0) 2131 36845570, email: selbstauskunft@boniversum.de

The competent Data Protection Officer has the following contact details: Creditreform Boniversum GmbH, Data Protection Officer, Hellersbergstrasse 11, 41460 Neuss, Germany. Email:datenschutz@boniversum.de

25. Changes to the data protection information

We continuously develop and optimise our services. It may therefore be that we add new functionalities. Should this have an influence on the way your personal data is processed, we will inform you in good time in our data protection information.