Privacy policy

1. Data protection at a glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

The operator of this website takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

When you use this website, various items of personal data are collected. Personal data is any data that can be used to identify you personally. This privacy policy explains what data we collect and how we use it. It also explains how and for what purpose this is done.

Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to guarantee complete protection of data against access by third parties.

Data collection on this website

The data controller for data processing on this website is:

simply hairless GmbH
Salzstraße 53
48143 Münster
Represented by the managing director: Rüdiger Winter

Email: ruediger.winter@hairlesslifemuenster.de

The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).

How do we collect your data?

Your data is collected when you visit this website. The data is automatically recorded by our IT systems when you visit the website. This consists primarily of technical data (e.g. internet browser, operating system or time of page view).

What do we use your data for?

The data is collected to ensure the website functions correctly.

2. Hosting

We host the content of our website with the following provider:

External hosting

This website is hosted externally. The personal data collected on this website is stored on the host’s servers. This may primarily include IP addresses, meta and communication data, website visits and other data generated via our website.

External hosting is carried out for the purpose of fulfilling our contractual obligations towards our potential and existing customers (Article 6(1)(b) of the GDPR) and in the interests of providing our online services securely, quickly and efficiently through a professional provider (Article 6(1)(f) of the GDPR). Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Our hosting provider will only process your data to the extent necessary to fulfil its service obligations and will comply with our instructions regarding this data.

We use the following hosting provider:

profihost GmbH
Hildesheimer Straße 25
30880 Laatzen

Data processing on behalf of the controller

We have entered into a data processing agreement (DPA) for the use of the aforementioned service. This is a contract required under data protection law, which ensures that the hosting provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

3. General information and mandatory details

What rights do you have regarding your data?

You have the right at any time to obtain, free of charge, information about the origin, recipients and purpose of your stored personal data, Article 15 of the GDPR. You also have the right to request the rectification or erasure of this data, Articles 16 and 17 of the GDPR. If you have given your consent to data processing, you may withdraw this consent at any time with future effect, Article 7(3) of the GDPR. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data, Article 18 of the GDPR. You also have a right to data portability, Article 20 of the GDPR. Furthermore, you have the right to lodge a complaint with the relevant supervisory authority, Article 77 of the GDPR.

You may contact us at any time regarding this or any other questions on the subject of data protection.

General information on the legal bases for data processing on this website

Where you have consented to the processing of your data, we process your personal data on the basis of Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, where special categories of data as defined in Article 9(1) of the GDPR are processed. In the event of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Article 49(1)(a) of the GDPR. Where you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), data processing is also carried out on the basis of Section 25(1) of the TDDDG. Consent may be withdrawn at any time. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Article 6(1)(b) of the GDPR. Furthermore, we process your data where this is necessary to comply with a legal obligation on the basis of Article 6(1)(c) of the GDPR. Data processing may also take place on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Information on the relevant legal bases in each individual case is provided in the following paragraphs of this privacy policy.

Retention period

Unless a more specific retention period is stated within this privacy policy, we will retain your personal data until the purpose for which the data is processed no longer applies. If you submit a valid request for erasure or withdraw your consent to data processing, your data will be erased, provided we have no other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be deleted once these grounds no longer apply.

4. Data collection on this website

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, your enquiry, including all personal data contained therein (name, enquiry), will be stored and processed by us for the purpose of dealing with your request. We will not pass on this data without your consent.

The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures.

In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) of the GDPR).

The data you send to us via contact enquiries will remain with us until you request its deletion or the purpose for storing the data no longer applies (e.g. once your enquiry has been fully processed). Mandatory legal provisions – in particular statutory retention periods – remain unaffected.

Where you provide us with personal data for recruitment purposes, such as a CV, cover letter, certificates and other relevant documents, as well as any further information you include in your application, the processing is carried out on the basis of Article 88 of the GDPR in conjunction with Section 26 of the Federal Data Protection Act (BDSG). Your data will be used exclusively for the purpose of reviewing and processing your application. If you are not offered a position, your application data will be deleted within six months of the application process being completed, unless you have consented to it being retained for a longer period for future job vacancies (Article 6(1)(a) of the GDPR).

5. Instagram

In addition to this website, we operate an official Instagram page to connect with interested parties and provide information. We are jointly responsible with Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland; hereinafter: Meta) for the processing of data arising from the use of our Instagram page. This means that we and Meta jointly determine the purposes and means of data processing on our Instagram page. The basis for this is the joint controller agreement in accordance with Instagram’s Terms of Service, as well as Meta’s joint controller agreement.

When you visit our Instagram page, Meta automatically collects data such as your IP address, information about your device, your interactions on Instagram (e.g. likes, comments) and, where applicable, further information that Meta stores via cookies and similar technologies. Meta uses this data to create user profiles and to serve personalised adverts. We ourselves receive anonymised statistics from Meta regarding the use of our Instagram page (known as ‘Insights’), which enable us to analyse the reach and engagement of our content. However, this data cannot be traced back to individual persons.

Meta may also process your data outside the European Union, in particular in the USA. The transfer takes place on the basis of the EU-US Data Privacy Framework (DPF), an adequacy decision by the Commission designed to ensure an adequate level of data protection. Nevertheless, we would like to point out that, in the event of access by US authorities, there is a risk that you will not be informed of this and will not have sufficient legal remedies. Meta’s privacy policy applies to the processing of data by Meta on our Instagram page.

Your data is processed on the basis of our legitimate interest, in accordance with Article 6(1)(f) of the GDPR, in communicating effectively with you and providing up-to-date information.

You have the right to access, rectify, erase and restrict the processing of your personal data, as well as the right to data portability and to object to the processing of your data. Due to the joint controller agreement (see above), it makes sense for data subjects to exercise their rights regarding processing in the context of Instagram by contacting Meta. You can find the relevant form here: https://www.facebook.com/help/contact/612141586937373. Should you require assistance in exercising your rights, you can contact us using the contact details provided above.

6. Cookiebot

We use the “Cookiebot” service provided by Usercentrics A/S (Havnegade 39, 1058 Copenhagen, Denmark; hereinafter “Cookiebot”) to manage your consents regarding the use of cookies and similar technologies in compliance with data protection regulations. When you visit our website, Cookiebot collects information about your consents, your IP address, details of the browser and operating system used, and the date and time of your visit. This data is stored on Usercentrics’ servers within the EU and is automatically deleted after 12 months.

The processing is carried out on the basis of Article 6(1)(c) of the GDPR to fulfil our legal obligations regarding the traceability of your consents, and on the basis of Article 6(1)(f) of the GDPR to provide you with transparent and legally compliant cookie management. Further information on data processing by Cookiebot can be found in Cookiebot’s privacy policy.

7. Communication via WhatsApp

We offer you the option of communicating with us via the ‘WhatsApp’ messaging service provided by WhatsApp Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). In doing so, personal data such as your telephone number, message content and communication metadata (e.g. the time and duration of message transmission) are processed. Processing takes place on the basis of your consent in accordance with Article 6(1)(a) of the GDPR or, insofar as the communication serves to initiate or fulfil a contract, on the basis of Article 6(1)(b) of the GDPR.

Please note that WhatsApp may also process the data transmitted on servers in the USA. The transfer of data to the USA takes place on the basis of the EU-US Data Privacy Framework (DPF). WhatsApp Ireland Limited is certified under the DPF and undertakes to ensure a level of data protection equivalent to that in the EU. Nevertheless, data subjects may have fewer means of exercising control in the USA. To protect your privacy, we recommend that you do not transmit any sensitive or confidential data via WhatsApp, despite the possible end-to-end encryption. Further information on data processing by WhatsApp and on DPF certification can be found in WhatsApp’s Privacy Policy.

8. ProvenExpert

We use the ‘ProvenExpert’ review service provided by Expert Systems AG (Quedlinburger Straße 1, 10589 Berlin; hereinafter ‘ProvenExpert’) to collect, display and analyse customer reviews. When you submit a review via ProvenExpert, personal data such as your name, email address, your review and the time of submission will be processed. This processing is carried out on the basis of your consent in accordance with Article 6(1)(a) of the GDPR, as well as our legitimate interest in a transparent and independent presentation of our services in accordance with Article 6(1)(f) of the GDPR.

ProvenExpert stores and processes the data on servers within the European Union. We ourselves do not have access to your email address or any other data you provide to ProvenExpert, unless this is explicitly published. Further information on data processing by ProvenExpert can be found in their privacy policy.

9. Google services

Our website uses various services provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; hereinafter: Google) to improve website functionality, provide services, analyse user behaviour and optimise our advertising activities.

When you visit our website, Google receives the information described below. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the customisation of its website to meet user needs. Such analysis is carried out in particular (even for users who are not logged in) to provide personalised advertising. You have the right to object to the creation of these user profiles; to exercise this right, you must contact Google.

Specifically, we use the following Google services:

• Google Tag Manager: Google Tag Manager is used to manage tracking codes (tags) on our website. This service allows tracking tags to be integrated and managed centrally without any personal data being processed directly. Google Tag Manager itself does not access the data collected by the tags.
• Google Analytics: Google Analytics analyses visitor behaviour on our website, for example by recording page views, time spent on the site, clicks and demographic data. Your IP address is anonymised (IP masking) before it is stored. The data collected helps us to evaluate the use of our website and optimise our offering.
• Google Ads and Google Ads Remarketing: Google Ads enables us to place targeted adverts in Google search results and on the Google Display Network. With Google Ads Remarketing, we can display targeted adverts to users who have already visited our website. In doing so, Google processes data such as your IP address, pages visited, search terms and your interests in order to display personalised adverts.
• Google AdSense: Google AdSense is a service for displaying adverts on our website. Google analyses your browser and usage data to provide you with relevant adverts. This processing is carried out automatically using cookies or similar technologies.
• Google Conversion Tracking: Google’s conversion tracking enables us to measure the success of our advertising campaigns. When you click on one of our adverts, a cookie is set which allows us to track whether certain actions (e.g. a purchase or a registration) have been carried out.
• Google Maps: We use Google Maps to provide you with interactive maps directly on our website. In doing so, data such as your IP address, device information and location data (provided you have enabled this in your browser) is transmitted to Google. This data is processed to display the map.
• YouTube: Videos from the YouTube service are embedded on our website. When you play a video, data such as your IP address, device information and details of your interactions with the video are transmitted to Google. This processing takes place regardless of whether you are logged in to YouTube or not.
• Google Conversion Tracking: Google’s conversion tracking enables us to measure the success of our advertising campaigns. When you click on one of our adverts, a cookie is set which allows us to track whether certain actions (e.g. a purchase or a registration) have been carried out. We also use the ‘Enhanced Conversions’ feature. In this process, selected data that you provide to us in connection with a conversion on our website (e.g. your email address in the order or contact form) is pseudonymised using a standard hashing method before being transmitted to Google. Google uses these hash values to attribute conversions more accurately and to improve our campaign analysis; we receive only aggregated reports and no information relating to individual persons.

The processing of the aforementioned data for the use of the respective services is based on your consent in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR, which you can grant individually via our cookie banner.

Please note that, in connection with the use of the above-mentioned services, your personal data may be transferred by Google to the USA. The data transfer to the USA takes place on the basis of the EU-US Data Privacy Framework (DPF). Google is certified under the DPF and undertakes to ensure a level of data protection equivalent to that in the EU. Nevertheless, we would like to point out that, due to national security laws, the level of data protection in the USA may be lower and that US authorities may gain access to your data. Further information on data processing by Google and on DPF certification can be found in Google’s privacy policy.

10. Microsoft Advertising

We use the ‘Microsoft Advertising’ service (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; hereinafter: Microsoft) to display personalised advertisements. Microsoft Advertising enables us to display targeted adverts in the search results of Bing, Yahoo and on Microsoft’s partner websites. In doing so, personal data such as your IP address, browser information, search queries and usage behaviour are processed in order to display personalised adverts that may be relevant to you. For this purpose, Microsoft Advertising uses cookies and similar technologies to analyse your interactions with the advertisements and to measure the success of the campaigns, for example by tracking clicks and conversions. Microsoft may also use this data for its own purposes, such as improving its services and personalising advertising.

The processing of this data is based on your consent in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR, which you can provide via our cookie banner.

As Microsoft is based in the USA, personal data may be transferred to the USA. This data transfer takes place on the basis of the EU-US Data Privacy Framework (DPF). Microsoft is certified under the DPF and undertakes to ensure a level of data protection equivalent to that of the EU. Nevertheless, we would like to point out that, due to national security laws, the level of data protection in the USA may be lower and US authorities may gain access to your data. Further information on data processing by Microsoft Advertising and on DPF certification can be found in Microsoft’s privacy policy.

11. Advertising services provided by Meta

We use various advertising services provided by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland; hereinafter: Meta) to optimise our advertising activities and deliver targeted advertising. The following services are used:

• Meta Pixel: The Meta Pixel enables us to track users’ behaviour on our website after they have clicked on one of our Facebook or Instagram adverts. This involves the collection of personal data such as your IP address, information about your device, interactions with the website and pages visited, in order to measure the effectiveness of our advertising and to serve personalised adverts.
• Meta Conversion API: The Meta Conversion API enables us to transmit server-side data regarding user interactions on our website to Meta. Similar to the Meta Pixel, this data includes information about pages visited and actions completed (e.g. purchases or form submissions). This helps us to measure the performance of our advertising campaigns more accurately and to improve them.
• Meta Custom Audiences: Meta Custom Audiences enables us to target users who have already interacted with our website or our content. To this end, certain personal data, such as pages visited and actions taken, are processed to create a target audience for bespoke adverts.

The processing of the above-mentioned data for the use of the respective services is based on your consent in accordance with Section 25(1) of the German Telemedia Act (TDDDG) and Article 6(1)(a) of the GDPR, which you can provide individually via our cookie banner.

Meta may also process your data outside the European Union, in particular in the USA. The transfer takes place on the basis of the EU-US Data Privacy Framework (DPF). Meta is certified under the DPF and undertakes to ensure a level of data protection equivalent to that of the EU. Nevertheless, we would like to point out that, in the event of access by US authorities, there is a risk that you will not be informed of this and will not have sufficient legal remedies. Further information on data processing by Meta and on the DPF certification can be found in Meta’s privacy policy.

12. Rapidmail

We use the ‘Rapidmail’ service provided by Rapidmail GmbH (Kaiserstraße 24, 76133 Karlsruhe, Germany) to send newsletters and other informational emails. When using Rapidmail, personal data such as your email address, first name, surname and, where applicable, any other information you have provided is processed. This data is used exclusively for sending and analysing the emails we send.

Processing is carried out on the basis of your consent in accordance with Article 6(1)(a) of the GDPR, which you give when you subscribe to our newsletter. You may withdraw your consent at any time by unsubscribing from the newsletter or by clicking the relevant link in any email we send. Your personal data will be stored for as long as you remain subscribed to the newsletter. Once you have unsubscribed, your data will be deleted, unless statutory retention obligations require it to be stored for a longer period. Further information on data processing by Rapidmail can be found in Rapidmail’s privacy policy.

13. ChatGPT Ads

We display advertisements via the “ChatGPT Ads” service. For users in the European Economic Area, the provider of this service is OpenAI Ireland Limited (1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; hereinafter: OpenAI).

In order to measure the success of our adverts, enable the attribution of conversions, and evaluate, manage and optimise our advertising activities, we use the “OpenAI Measurement Pixel” on our website, subject to your consent. If you arrive at our website via an advert in ChatGPT, a click identifier (“oppref”) is appended to the URL of the landing page. The pixel stores this identifier in a cookie (“__oppref”) on your device. If you subsequently carry out an action relevant to us, such as submitting a contact form or completing a purchase, the pixel transmits a corresponding event to OpenAI so that the action can be attributed to the previous ad click. In particular, the following data is processed: the click identifier, the type and time of the event, the page accessed or the referring URL, your IP address, and technical device and browser information. [Optional, if enabled: In addition, contact details entered by you in forms (e.g. email address, telephone number) may already be transmitted in your browser in hashed, i.e. pseudonymised form (SHA-256), so that OpenAI Conversions can attribute ad clicks (‘Advanced Matching’).]

We ourselves receive from OpenAI exclusively aggregated, non-personal statistics on the performance of our adverts. We are responsible for the processing described above in the context of performance measurement. OpenAI also processes the transmitted data as an independent data controller for its own purposes, in particular for attributing conversions, for managing and optimising adverts, for creating target groups, and for developing and improving its own products and services. OpenAI is responsible for this processing; in this respect, you may exercise your rights – as set out in section 3 – directly against OpenAI. For further information, in particular regarding the purposes of processing and retention periods, please refer to OpenAI’s privacy policy: https://openai.com/policies/privacy-policy/

The processing is carried out on the basis of your consent in accordance with Section 25(1) of the TDDDG for the storage and retrieval of information on your device (setting the ‘__oppref’ cookie and the activation of the pixel), as well as in accordance with Article 6(1)(a) of the GDPR for the subsequent processing and transfer of personal data. Consent is voluntary; the use of our website is not conditional upon your granting of consent, and you will not suffer any disadvantages as a result of withholding or withdrawing your consent. You may withdraw your consent at any time with future effect via our cookie banner or the cookie settings; the lawfulness of the processing carried out up to the point of withdrawal remains unaffected. The “__oppref” cookie is stored for [duration as per browser or CMP scan] and is then automatically deleted. The retention period for the data transmitted to OpenAI is governed by the provisions of the OpenAI Privacy Policy; we have no influence over this.

A transfer of your data to the USA to affiliates of OpenAI cannot be ruled out. Insofar as the respective recipient participates in the EU-US Data Privacy Framework (DPF) and is listed on the US Department of Commerce’s DPF list, the transfer is based on the EU Commission’s adequacy decision of 10 July 2023. Otherwise, such transfers are made on the basis of appropriate safeguards in accordance with Article 44 et seq. of the GDPR.”