The party responsible for the processing of personal data in connection with the website and online shop www.skinfit.eu is:

Skinfit International GmbH
Hinterfeld 1
6842 Koblach
Austria

Phone: +43 5523 52425
E-Mail: skinfit@skinfit.eu

Company registration number: FN 233028p
Commercial register court: Feldkirch Regional Court
VAT ID number: ATU56928677

This privacy policy provides information about which personal data we collect, for what purposes we process it, to whom we transfer it, and what rights data subjects have.

If you have any questions regarding the processing of your personal data, please contact our Data Protection Officer:

Martin Tschofen
Skinfit International GmbH
Hinterfeld 1
6842 Koblach
Austria

E-mail: skinfit@skinfit.eu
Phone: +43 5523 52425

Personal data is any information relating to an identified or identifiable natural person. This includes, in particular, name, address, e-mail address, telephone number, date of birth, order data, payment information, customer account data, IP address, and information about the use of our website.

Processing means any operation related to personal data. This includes, in particular, the collection, storage, use, transmission, alteration, and deletion of data.

We process personal data in particular on the following legal bases:

• for the performance of a contract or to take steps prior to entering into a contract pursuant to Art. 6 (1) (b) GDPR,
• for compliance with legal obligations pursuant to Art. 6 (1) (c) GDPR,
• based on your consent pursuant to Art. 6 (1) (a) GDPR,
• for the purposes of our legitimate interests pursuant to Art. 6 (1) (f) GDPR.

Our legitimate interests consist in particular in the secure and economic operation of our online shop, the processing of customer inquiries, the prevention of fraud, the improvement of our services, and direct marketing to existing customers to the extent permitted by law.

When accessing our website, certain information is automatically transmitted to our systems by the browser being used.

In particular, the following data may be processed:

• IP address,
• date and time of access,
• page or file accessed,
• volume of data transmitted,
• previously visited website,
• browser type and version,
• operating system,
• end device,
• language settings,
• access status and error messages.

Processing is carried out in order to provide the website technically, ensure its security and stability, detect errors, and prevent unauthorized access.

The legal basis is our legitimate interest in accordance with Art. 6 (1) (f) GDPR.

In principle, server log data is only stored for as long as is necessary for the stated purposes. Longer storage may occur if this is necessary to investigate a security incident or to fulfill legal obligations.

Our online shop is powered by the e-commerce platform Shopify. For customers in the European Economic Area and Switzerland, the provider is generally:

Shopify International Limited
Ireland

Shopify processes personal data necessary for operating the online shop, displaying the website, managing customer accounts, processing orders, fraud prevention, and the technical provision of Shopify services.

In doing so, the following data in particular may be processed:

• Master and contact data,
• Billing and shipping addresses,
• Customer account data,
• Order and transaction data,
• Shopping cart contents,
• IP address and device information,
• Information on the use of the online shop,
• Support and communication data.

Insofar as Shopify processes personal data on our behalf, this is carried out on the basis of a data processing agreement.

As part of the provision of Shopify services, personal data may also be processed by Shopify's affiliated companies and sub-processors outside the European Economic Area. According to their own statements, Shopify uses appropriate transfer mechanisms and contractual safeguards for this purpose.

Further information can be found in Shopify's privacy policy:

www.shopify.com/legal/privacy/consumers

The legal basis for processing in connection with orders is Art. 6 (1) (b) GDPR. The technical provision and security of the online shop are based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR.

You can create a customer account in our online shop.

In doing so, we process in particular:

• First and last name,
• Email address,
• Password in encrypted form,
• Telephone number, if provided,
• Billing and delivery addresses,
• Order history,
• Returns and refunds,
• Saved preferences and settings.

Processing is carried out for the purpose of setting up and managing the customer account, facilitating future orders, and providing associated functions.

The legal basis is Art. 6 (1) (b) GDPR.

In principle, your data will be stored for as long as your customer account exists. You may request the deletion of your customer account. Statutory retention obligations for order and billing data remain unaffected.

When you place an order, we process the data required to execute the sales contract.

This includes in particular:

• Name,
• billing and shipping address,
• email address,
• phone number, if provided,
• ordered products,
• order value,
• payment method,
• shipping method,
• returns and refunds,
• communication regarding the order.

Processing is carried out for order management, payment processing, delivery, return processing, customer communication, and to fulfill legal documentation and retention obligations.

The legal bases are Art. 6 (1) lit. b and lit. c GDPR.

To process payments, we transmit the required data to the payment service provider you have selected.

We generally do not receive full credit card or account details. These are processed directly by the respective payment service provider. We only receive the information necessary for the allocation and confirmation of a payment.

9.1 Shopify Payments

If you select a payment method offered via Shopify Payments, the data required for payment processing is processed by Shopify and the respective participating financial and payment service providers.

This may include, in particular, the following data:

• Name and contact details,
• Billing address,
• Order and transaction data,
• Payment information,
• IP address,
• Device and browser information,
• Information for fraud prevention and authentication.

Processing is carried out for the purpose of executing the payment, preventing fraud, fulfilling regulatory obligations, and handling potential refunds or chargebacks.

The legal bases are Art. 6(1) points (b), (c), and (f) GDPR.

9.2 PayPal

If you select PayPal as your payment method, the data required for payment processing is transmitted to PayPal.

The provider is:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

PayPal processes the data, in particular, for payment processing, identity verification, fraud prevention, risk assessment, and the fulfillment of legal obligations.

Further information can be found in PayPal's privacy policy:

www.paypal.com/at/legalhub/paypal/privacy-full

The legal bases are Art. 6(1) points (b), (c), and (f) GDPR.

To deliver orders and process returns, we transmit the necessary data to the shipping and logistics service providers we use in each case.

In doing so, the following data in particular may be processed:

• Name,
• Delivery address,
• E-mail address,
• Telephone number,
• Order and parcel information,
• Tracking number,
• Return information.

The transmission takes place exclusively to the extent necessary for delivery, shipment tracking, notification, and the processing of a return.

The legal basis is Art. 6 (1) (b) GDPR.

If you use our returns portal, the data you enter will be processed for the purpose of checking and handling the return, exchange, refund, or any other service request.

If you contact us via email, telephone, contact form, live chat, or any other communication channel, we process the data you provide.

This may include, in particular:

• Name,
• email address,
• telephone number,
• customer and order number,
• content of the inquiry,
• submitted documents or images,
• time and history of the communication.

Processing is carried out for the purpose of handling and responding to your inquiry.

If the inquiry relates to an existing or potential contract, the legal basis is Art. 6(1)(b) GDPR. In other cases, processing is based on our legitimate interest in efficient customer communication in accordance with Art. 6(1)(f) GDPR.

When you subscribe to our newsletter, we process your email address in particular, as well as the interests and preferences you have voluntarily provided.

Registration generally takes place via a double opt-in procedure. You will receive an email in which you must confirm your registration.

The following data may be stored as proof of your consent:

• Email address,
• Date and time of registration,
• Date and time of confirmation,
• IP address,
• Selected interests and sports.

We use Brevo to send and evaluate our newsletters. The provider is the Brevo or Sendinblue corporate group.

Brevo processes the data on our behalf for managing recipient lists, sending messages, and statistical evaluation.

If you have given your consent, we can track whether a message was opened, a link was clicked, or a specific action was performed after clicking. We use this information to better tailor content to the interests of our recipients.

The legal basis for sending the newsletter and the associated evaluation is your consent in accordance with Art. 6 (1) (a) GDPR.

You can revoke your consent at any time with future effect. To do so, you can use the unsubscribe link at the end of each newsletter or contact us at skinfit@skinfit.eu.

To the extent permitted by law, we may use your email address to inform you about our own similar products, services, or offers.

You may object to this use at any time, incurring no costs other than the transmission costs according to the basic rates. You will find an unsubscribe link in every such email.

The legal basis is our legitimate interest in informing existing customers about similar offers in accordance with Art. 6(1)(f) GDPR in conjunction with the applicable regulations for electronic advertising.

If you participate in a competition, promotion, or event, we process the data necessary for its execution.

This may include, in particular:

• Name,
• Email address,
• Telephone number,
• Address,
• Date of birth,
• Participation and result data,
• If applicable, images or video recordings.

The data is used to conduct the respective promotion, to contact winners, and, if applicable, for the handover or delivery of a prize.

The legal basis is Art. 6 para. 1 lit. b GDPR. For any additional advertising measures or the publication of images and video recordings, separate consent pursuant to Art. 6 para. 1 lit. a GDPR is obtained, if required.

We may ask customers for a review after a purchase and use a review service such as REVIEWS.io for this purpose.

For this purpose, the data necessary for sending a review request, in particular name, email address, order number, and information on the purchased product, may be transmitted to the review service.

A review request is only sent if there is corresponding consent or another sufficient legal basis for doing so.

If you submit a review, the content you provide may be published in accordance with your information. Please do not include any confidential or sensitive personal data in a publicly visible review.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR or, to the extent permitted by law, our legitimate interest in quality assurance and the presentation of authentic customer experiences pursuant to Art. 6(1)(f) GDPR.

We use cookies and similar technologies to provide our website technically, save settings, evaluate the use of our services, and – subject to your consent – display personalized advertising.

In doing so, we distinguish in particular between the following categories:

• technically necessary cookies,
• functional cookies,
• statistics and analysis cookies,
• marketing and personalization cookies.

Technically necessary cookies are required for the online shop, the shopping cart, the checkout, the customer account, security features, and your privacy settings to function. These cookies are used on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR or for the performance of a contract pursuant to Art. 6 (1) (b) GDPR.

Non-essential cookies and similar technologies are only activated after you have given your consent pursuant to Art. 6 (1) (a) GDPR.

You can change your selection at any time via the "Cookie Settings" link or revoke your consent.

Further information on the specific cookies used, their providers, purposes, and storage periods can be found in the cookie settings on our website.

Provided you have given your consent, we use Google Analytics to analyze the use of our website.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

In particular, Google Analytics can process the following data:

• pages visited,
• clicks and interactions,
• orders and shopping cart activities,
• approximate location information,
• browser and device information,
• shortened or otherwise protected IP address,
• origin of the website visit.

We use this information to understand how our website is used and to improve our services.

Google may also process data in countries outside the European Economic Area. The legally required protection mechanisms are used for such transfers.

The legal basis is your consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time via the cookie settings.

Provided you have given your consent, we use Google Ads and its associated conversion and remarketing functions.

The provider is Google Ireland Limited.

This allows us to determine whether users perform certain actions on our website after clicking on an ad. In addition, target groups can be created for interest-based advertisements.

In this process, cookie identifiers, device information, IP addresses, pages visited, shopping cart activities, and order information, in particular, may be processed.

The legal basis is your consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time via the cookie settings.

Provided that you have given your consent, we use advertising and analysis technologies from Meta, in particular the Meta Pixel and, where applicable, the Meta Conversions API.

The provider is:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4
Ireland

This allows us to track whether users have reached our website via an ad on platforms such as Facebook or Instagram and have performed certain actions there. In addition, target groups for interest-based advertising can be created.

In this context, the following data in particular may be processed:

• IP address,
• browser and device information,
• pages visited,
• shopping cart actions,
• order and transaction data,
• cookie and advertising identifiers,
• hashed contact information, where applicable.

As far as we transmit data via the Conversions API, contact information is encrypted or hashed before transmission whenever possible.

Meta may also process data outside the European Economic Area.

The legal basis is your consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time via the cookie settings.

Our website may incorporate maps and location features from Google Maps, particularly for displaying Skinfit shops and sales partners.

The provider is Google Ireland Limited.

When a map is accessed, your IP address, device information, location data, and information regarding your use of the map may be transmitted to Google.

Google Maps is only activated upon your consent, insofar as such consent is required by law.

The legal basis is Art. 6 (1) (a) GDPR.

We only transmit personal data if this is necessary for the fulfillment of a contract, to comply with legal obligations, on the basis of consent, or to safeguard legitimate interests.

Possible recipients include, in particular:

• Shopify and its subprocessors,
• payment service providers and banks,
• shipping and logistics companies,
• returns and fulfillment service providers,
• IT, hosting, and software providers,
• newsletter and communication service providers,
• analytics and marketing service providers,
• review platforms,
• tax advisors, auditors, and legal advisors,
• authorities and courts,
• collection agencies, if necessary.

Commissioned service providers receive only the data necessary for the respective service.

Some of our service providers or their sub-processors are located outside the European Economic Area or process personal data there.

A transfer only takes place if the requirements under data protection law are met. This can be done in particular on the basis of an adequacy decision by the European Commission, appropriate safeguards, or the European Commission's standard contractual clauses.

Where necessary, additional protective measures are taken.

Shopify points out that data from customers in the European Economic Area and Switzerland may initially be processed by Shopify International Limited in Ireland, but that international onward transfers are possible as part of the service provision.

We store personal data only as long as is necessary for the respective purpose or as required by statutory retention obligations.

The following principles apply in particular:

• Contract, order, invoice, and payment data are stored in accordance with statutory commercial and tax law retention periods.
• Customer account data is generally stored until the customer account is deleted. Order data that must be retained by law remains unaffected by this.
• Data from customer inquiries are stored until the inquiry is concluded and, beyond that, only as long as is necessary for documentation or the defense of claims.
• Newsletter data is stored until consent is withdrawn or until the user unsubscribes. Proof of consent may also be retained within the scope of statutory limitation periods.
• Data from analysis and marketing services are processed according to the retention periods specified in the cookie settings.
• Data relating to competitions are deleted after the campaign has ended, provided there are no statutory retention obligations to the contrary.
• Security and log data are stored only as long as necessary for system security and the investigation of potential incidents.

In accordance with applicable data protection laws, you have the following rights in particular:

• Right to access your stored personal data,
• Right to rectification of incorrect or incomplete data,
• Right to erasure of your data,
• Right to restriction of processing,
• Right to data portability,
• Right to object to certain types of processing,
• Right to withdraw consent previously given,
• Right to lodge a complaint with a data protection supervisory authority.

The withdrawal of consent applies only to the future. The legality of processing carried out prior to the withdrawal remains unaffected.

If processing is based on our legitimate interest, you may object to the processing for reasons arising from your particular situation.

You may object to the use of your personal data for direct marketing purposes at any time without providing reasons.

You have the right to lodge a complaint with a competent data protection supervisory authority.

In Austria, this is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria

www.dsb.gv.at

We take appropriate technical and organizational measures to protect personal data against loss, manipulation, unauthorized access, and other forms of misuse.

Data transmission between your browser and our website is generally encrypted. However, complete security for data transmission over the Internet cannot be guaranteed.

The provision of certain personal data is required for the conclusion and execution of an order.

Without this data, we are unable to process orders, payments, deliveries, or returns in particular.

The provision of data for newsletters, analysis, personalized advertising, or other voluntary offers is not mandatory.

As part of payment processing, Shopify, Shopify Payments, PayPal, and participating financial service providers may use automated fraud and risk assessment systems.

These assessments may result in a payment method not being offered, a payment being declined, or an order being subject to additional verification.

For further information on automated processing, please contact the respective payment service provider.

We may update this privacy policy if legal requirements, our website, the service providers used, or the nature of the data processing change.

The current version published on our website shall apply.

If you have any questions regarding the processing of your personal data or wish to exercise your rights, you can reach us at the following contact details:

Skinfit International GmbH
Hinterfeld 1
6842 Koblach
Austria

E-Mail: skinfit@skinfit.eu
Phone: +43 5523 52425

Data Protection Officer: Martin Tschofen