PRIVACY

Privacy Policy

A. General information

§ 1 Information about the collection of personal data

(1) In the following, we provide information about the processing of personal data when using our website. Personal data is all data that can be related to you personally, e.g. name, address, email addresses, user behavior. In this way, we would like to inform you about our processing procedures and at the same time comply with legal obligations, in particular those arising from the EU General Data Protection Regulation (GDPR).

(2) The responsible party according to Art. 4 Para. 7 GDPR is LAWÉ GmbH, Emil-Andresen-Straße 105, 22529 Hamburg, hello@lawebeauty.com (see our legal notice).

(3) When you contact us by telephone, email or via a contact form, the data you provide (your email address, if applicable your name and your telephone number) will be stored by us in order to answer your questions. If the query is associated with a contract, we will delete the data collected in this context after the contract term has expired, otherwise after storage is no longer required, or we will restrict processing if there are statutory retention periods.

(4) If we use commissioned service providers for individual functions of our offer or would like to use your data for advertising purposes, we will always carefully select and monitor these service providers and inform you in detail about the respective processes below. We also state the specified criteria for the storage period.

§ 2 Your Rights

(1) You have the following rights vis-à-vis a responsible party with regard to the personal data concerning you:

• Right to information,

• Right to rectification or erasure,

• Right to restriction of processing,

• Right to object to processing,

• Right to data portability.(2) You also have the right to complain to a data protection supervisory authority about our processing of your personal data.

§ 3 Processing of personal data when visiting our website

When you use the website for informational purposes, i.e. simply viewing it without registering and without you otherwise providing us with information, we process the personal data that your browser transmits to our server. The data described below is technically necessary for us to display our website to you and to ensure stability and security and must therefore be processed by us. The legal basis is Art. 6 Para. 1 Clause 1 Letter f of GDPR:

• –IP address

• –Date and time of the request

• –Time zone difference to Greenwich Mean Time (GMT)

• –Content of the request (page visited)

• –Access status/HTTP status code

• –amount of data transferred

• –previously visited page

• –Browser

• –Operating system

• –Language and version of the browser software.

§ 4 Additional functions and offers on our website

(1) In addition to the purely informational use of our website, we offer various services that you can use if you are interested and use other common functions to analyze or market our offers, which are presented in more detail below. To do this, you usually have to provide additional personal data or we process such additional data that we use to carry out the respective services. The data processing principles mentioned above apply to all data processing purposes described here.

(2) We sometimes use external service providers to process your data. These are carefully selected by us, are bound by our instructions and are regularly monitored.

(3) We may also pass on your personal data to third parties if we offer participation in promotions, competitions, contract conclusions or similar services together with partners. Depending on the service, your data may also be collected by the partners on their own responsibility. You will receive further information when you provide your data or below in the description of the respective offers.

(4) If our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you about the consequences of this circumstance in the description of the offer.

§ 5 Objection or revocation against the processing of your data

(1) If you have given your consent to the processing of your data, you can revoke it at any time. Such a revocation affects the legality of the processing of your personal data after you have expressed it to us. The legality of the processing of your data up to the time of your revocation remains unaffected.

(2) If we base the processing of your personal data on the balance of interests, you can object to the processing. This is the case if the processing is not necessary to fulfill a contract with you, which we will explain in the following description of the functions. If you exercise such an objection, we ask you to explain the reasons why we should not process your personal data in the way we do. If you object, we will examine the situation and either stop or adapt the data processing or show you our compelling legitimate reasons on the basis of which we continue the processing.

(3) Of course, you can object to the processing of your personal data for advertising and data analysis purposes at any time. The best way to exercise your objection to advertising is to contact us using the contact details provided above.

§ 6 Processing of data from your end devices (“Cookie Policy”)

(1) In addition to the data mentioned above, when you use our website we use technical tools for various functions, in particular cookies, which can be stored on your device. When you visit our website and at any time later, you have the choice whether you generally allow cookies to be set or which individual additional functions you would like to select. You can make changes in your browser settings or via our consent manager. Below we first describe cookies from a technical point of view before going into more detail about your individual options by describing technically necessary cookies and cookies that you can voluntarily select or deselect.

(2) Cookies are text files or information in a database that are stored on your hard disk and associated with the browser you use, so that certain information can be sent to the location that placed the cookies. Cookies cannot run programs or transmit viruses to your computer, but are primarily used to make the Internet faster and more user-friendly. This website uses the following types of cookies, the functionality and legal basis of which we will explain below:

– Transient cookies: These, especially session cookies, are automatically deleted when you close the browser or log out. They contain a so-called session ID. This allows different requests from your browser to be assigned to the shared session and your computer can be recognized when you return to our website.

– Persistent cookies: These are automatically deleted after a specified period of time, which varies depending on the cookie. You can view the cookies set and their lifespans at any time in your browser settings and delete the cookies manually.

- Other technologies: These functions are not based on cookies, but on similar technical mechanisms, such as Flash cookies, HTML5 objects or an analysis of your browser settings. The result is also that we can use the technologies described below. Here, too, you can of course consent or object.

(3) Mandatory functions that are technically necessary to display the website: The technical structure of the website requires that we use technologies, in particular cookies. Without these technologies, our website cannot be displayed (completely correctly) or the support functions could not be enabled. These are basically transient cookies that are deleted after the end of your website visit, at the latest when you close your browser. You cannot opt out of these cookies if you want to use our website. The individual cookies can be seen in the consent manager. The legal basis for this processing is Art. 6 Para. 1 Clause 1 Letter f of GDPR. (4) Optional cookies when you give your consent: We only set various cookies after you have given your consent, which you can select when you first visit our website using the so-called cookie consent tool. The functions are only activated if you consent and can be used in particular to enable us to analyze and improve visits to our website, to make it easier for you to use it across different browsers or devices, to recognize you during a visit or to display advertising (possibly also to tailor advertising to your interests, measure the effectiveness of ads or show interest-based advertising). The legal basis for this processing is Art. 6 Paragraph 1 Clause 1 Letter a of GDPR. You can revoke your consent at any time without affecting the legality of the processing up to the time of revocation. The functions we use, which you can select and revoke individually via the Consent Manager, are described below.

§ 7 SSL encryption

Visiting our website and transmitting personal data or personal content from our users is done via SSL encryption. Please ensure that SSL encryption is activated on your computer. The use of encryption is easy to recognize: the display in your browser line changes from "http://" to https:// when SSL encryption is activated. Data encrypted via SSL cannot be read by third parties. Therefore, only transmit your confidential information when SSL encryption is activated and contact us if in doubt.

B. Hosting via Ionos

We host our website with 1&1 IONOS SE. 1&1 IONOS SE offers web hosting, among other things, and is based in Germany at Elgendorfer Str. 57, 56410 Montabaur and in Austria at Gumpendorfer Straße 142/PF 266, 1060 Vienna. We have concluded a data processing agreement with 1&1 IONOS SE. You can find out more about data protection at 1&1 IONOS SE here: https://www.ionos.de/terms-gtc/datenschutzerklaerung/?tid=331672396071.

C. Special forms of use of websites

1. Use of the blog functions

(1) You can make public comments on our blog, in which we publish various articles on topics related to our activities. Your comment will be published with your specified user name in the article. We recommend using a pseudonym instead of your real name. Providing a user name and email address is required; all other information is voluntary. If you make a comment, we will continue to store your IP address, which we will delete after [one week]. Storage is necessary in order to be able to defend ourselves against liability claims in cases of possible publication of illegal content. We need your email address in order to contact you if a third party objects to your comment as being illegal. The legal basis is Art. 6 Para. 1 Clause 1 Letters c and f of GDPR. Comments are not checked before publication. We reserve the right to delete comments if they are objected to as being illegal by third parties.

(2) By commenting, you can leave a comment on our posts, which will be saved and displayed as long as the commented post is online on our website, unless you delete the comment beforehand. You can use the comment function without registering as a guest or as a registered user on all websites that have integrated the plug-in.

2. Use of our webshop

(1) If you would like to order from our web shop, it is necessary for the conclusion of the contract that you provide your personal data, which we need for the purpose of processing your order. Mandatory information required for the processing of the contracts is marked separately, further information is voluntary. For payment, you can provide your payment details to our payment service provider or we pass your payment details on to our house bank, whereby these third parties are each independently responsible for payment processing. The legal basis for this is Art. 6 Paragraph 1 Clause 1 Letter b of GDPR. If you wish, you can create a customer account through which we can save your data for future purchases. When you create an account under "My Account", the data you provide will be stored revocably. You can always delete all other data, including your user account, in the customer area. We may also process the data you provide to inform you about other interesting products from our portfolio or to send you emails with technical information.(2) Due to commercial and tax law requirements, we are obliged to store your address, payment and order data for a period of ten years.

(3) To prevent unauthorized access to your personal data by third parties, the ordering process is encrypted using TLS technology.

3. Use of our portal

(1) If you would like to use our portal, you must register by providing your email address, a password of your choice and a user name of your choice. There is no obligation to use your real name; pseudonymous use is possible. Providing the data mentioned above is mandatory; you can provide all other information voluntarily by using our portal. For this service, we use the so-called double opt-in procedure, i.e. you will receive an email in which you must confirm that you are the owner of the email address provided and that you wish to receive notifications. You can unsubscribe from notifications at any time, e.g. by clicking on the link in the email or using the contact details provided. The data you provide, the time of your registration for the service and your IP address will be stored by us until you unsubscribe from the notification service.

(2) If you use our portal, we will store your data required to fulfil the contract, [including information on the method of payment] until you permanently delete your access. We will also store the voluntary data you provide for the duration of your use of the portal, unless you delete it beforehand. [You can manage and change all information in the protected customer area.] The legal basis is Art. 6 Paragraph 1 Clause 1 Letter b of GDPR.

(4) To prevent unauthorized access by third parties to your personal data, in particular financial data, the connection is encrypted using TLS technology.

4. Use of our contact form & email contact

(1) There is a contact form on our website that can be used to contact us electronically. If a user makes use of this option, the data entered in the input mask will be transmitted to us and stored. This data is:

The following is a list of the data in the input mask

- Name

- Email

- News

Your consent to the processing of the data is obtained during the sending process and reference is made to this privacy policy. Alternatively, you can contact us using the email address provided. In this case, the user's personal data transmitted with the email will be stored. The data will not be passed on to third parties in this context. The data will only be used to process the conversation.

(2) If the user has given their consent, the legal basis for processing the data is Art. 6 (1) (a) GDPR. The legal basis for processing the data transmitted when sending an email is Art. 6 (1) (f) GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR.

(3) The processing of personal data from the input mask serves us solely to process the contact. In the case of contact by email, this also represents the necessary legitimate interest in processing the data. The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

(5) The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and those that were sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. The additional personal data collected during the sending process will be deleted after a period of seven days at the latest. The user has the option of revoking his consent to the processing of personal data at any time. If the user contacts us by email, he can object to the storage of his personal data at any time. In such a case, the conversation cannot be continued.

D. Newsletter

(1) You can subscribe to our newsletter, with which we inform you about our current interesting offers, by giving your consent. The goods and services advertised are named in the declaration of consent.

(2) We use the so-called double opt-in procedure to register for our newsletter. This means that after you register, we will send you an email to the email address you provided, in which we ask you to confirm that you are the owner of the email address you provided and that you wish to receive notifications. If you do not confirm your registration within [24 hours], your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you use and the times of registration and confirmation. The purpose of the procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.

(3) The only mandatory information required to send the newsletter is your email address. [Providing additional, separately marked data is voluntary and will be used to address you personally.] After your confirmation, we will save your email address for the purpose of sending you the newsletter. The legal basis is Art. 6 Para. 1 Clause 1 Letter a of GDPR.

(4) You can revoke your consent to receive the newsletter at any time and unsubscribe from the newsletter. You can revoke your consent by clicking on the link provided in each newsletter email, by email to hello@lawebeauty.com or by sending a message to the contact details provided in the imprint.

(5) In addition, you can also give your consent for us to evaluate your user behavior when sending the newsletter. For this evaluation, the emails sent contain so-called web beacons or tracking pixels, which are single-pixel image files stored on our website. For the evaluations, we link the data mentioned above [in § 3] and the web beacons with your email address and an individual ID. Links received in the newsletter also contain this ID. We use the data obtained in this way to create a user profile in order to tailor the newsletter to your individual interests. We record when you read our newsletters, which links you click on and use this to deduce your personal interests. We link this data to actions you perform on our website. You can object to this tracking at any time by clicking on the separate link provided in each email or by informing us via another contact method, as shown above. The information is stored for as long as you are subscribed to the newsletter. After unsubscribing, we store the data purely statistically and anonymously. Such tracking is also not possible if you have deactivated the display of images in your email program by default. In this case, the newsletter will not be displayed in full and you may not be able to use all functions. If you display the images manually, the above-mentioned tracking will take place.

E. Social Media

1. Use of social media plug-ins

(1) We currently use the following social media plug-ins: Facebook, Instagram, Pinterest, TikTok, which are only loaded if you have previously activated the function with your consent. We use the plug-ins to offer you the opportunity to interact with social networks and other users. The legal basis for the use of the plug-ins is Art. 6 Para. 1 Clause 1 Letter a of GDPR, i.e. integration only takes place with your consent.

(2) The plug-in provider saves the data collected about you as user profiles and uses them for the purposes of advertising, market research and/or needs-based design of its website. Such an evaluation is carried out in particular (also for users who are not logged in) to display needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, but you must contact the respective plug-in provider to exercise this right. The data is passed on regardless of whether you have an account with the plug-in provider and are logged in there. If you are logged in with the plug-in provider, the data we collect from you will be assigned directly to your existing account with the plug-in provider. If you press the activated button and, for example, link to the page, the plug-in provider also saves this information in your user account and shares it publicly with your contacts. We recommend that you log out regularly after using a social network, but especially before activating the button, as this will prevent you from being assigned to your profile by the plug-in provider.

(3) The information collected is stored on the providers' servers, including servers outside Europe in the case of international providers. In these cases, the provider has stated that it has imposed a standard that corresponds to the former EU-US Privacy Shield and has promised to comply with applicable data protection laws when transferring data internationally. We have also agreed so-called standard data protection clauses with the providers, the purpose of which is to ensure compliance with an appropriate level of data protection in the third country.

(5) You can find more information about the purpose and scope of data collection and processing by the plug-in provider in the privacy policies of these providers provided below. There you will also find more information about your rights in this regard and setting options for protecting your privacy. Addresses of the respective plug-in providers and URL of the respective data protection notices: Instagram and Facebook are offered by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Information on data protection at Meta can be found here: https://www.facebook.com/privacy/center/ Pinterest is offered by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland ("Pinterest"). The information automatically collected by Pinterest about your use of our online presence on Pinterest is usually transferred to a server of Pinterest, Inc., 505 Brannan St., San Francisco, CA 94107, USA and stored there. Information on data protection at Pinterest can be found here: https://policy.pinterest.com/de/privacy-policy . TikTok is an offering from TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Information on data protection at TikTok can be found here:

https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE

2. Social sign-in buttons

(1) We have integrated the buttons “follow us on” Facebook, Pinterest, Instagram, TikTok on our website. With these functions we enable you to log in easily using your social network login. The legal basis for the use of the plug-ins is Art. 6 Paragraph 1 Clause 1 Letter a of GDPR, i.e. integration only takes place after your consent.

(2) The plug-in provider stores the data collected about you as user profiles and uses them for the purposes of advertising, market research and/or needs-based design of its website. Such an evaluation is carried out in particular (also for users who are not logged in) to display needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, although you must contact the respective plug-in provider to exercise this right. The data is passed on regardless of whether you have an account with the plug-in provider and are logged in there. If you are logged in with the plug-in provider, the data we collect from you will be assigned directly to your existing account with the plug-in provider and information will be exchanged that enables you to log in to us as well.

3. Our presence in social networks

(1) We have various presences on so-called social media platforms. We operate these presences with the following providers:

Instagram and Facebook are offered by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Information on data protection at Meta can be found here: https://www.facebook.com/privacy/center/Pinterest is an offer from Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland ("Pinterest"). The information automatically collected by Pinterest about your use of our online presence on Pinterest is usually transferred to a server of Pinterest, Inc., 505 Brannan St., San Francisco, CA 94107, USA and stored there. Information on data protection at Pinterest can be found here: https://po licy.pinterest.com/de/privacy-policy . TikTok is an offer from TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Information on data protection at TikTok can be found here:

https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE

(2) We use the technical platform and the services of the providers for these information services. We would like to point out that you use our appearances on social media platforms and their functions at your own risk. This applies in particular to the use of interactive functions (e.g. commenting, sharing, rating). When you visit our appearances, the providers of the social media platforms record your IP address and other information that is available on your device in the form of cookies. This information is used to provide us, as the operator of the accounts, with statistical information about the interaction with us.

(3) The data collected about you in this context will be processed by the platforms and may be transferred to countries outside the European Union, in particular the USA. All of the aforementioned providers claim to maintain an appropriate level of data protection that corresponds to that of the former EU-US Privacy Shield and we have concluded the standard data protection clauses with the companies (with the exception of Xing, as this provider is based within the EU). We do not know how the social media platforms use the data from your visit to our account and interaction with our posts for their own purposes, how long this data is stored and whether data is passed on to third parties. Data processing may differ depending on whether you are registered and logged in to the social network or visit the site as a non-registered and/or non-logged in user. When you access a post or account, the IP address assigned to your device is transmitted to the provider of the social media platform. If you are currently logged in as a user, a cookie on your device can be used to track how you have moved around the network. Using buttons integrated into websites, the platforms can record your visits to these websites and assign them to your respective profile. This data can be used to offer content or advertising tailored to you. If you want to avoid this, you should log out or deactivate the "stay logged in" function, delete the cookies on your device and restart your browser.

(4) In addition, as the provider of the information service, we only process the data from your use of our service that you provide to us and that require interaction. For example, if you ask a question that we can only answer by email, we will store your information in accordance with the general principles of our data processing, which we describe in this data protection declaration. The legal basis for the processing of your data on the social media platform is Art. 6 Para. 1 Clause 1 Letter f of GDPR.

(5) To exercise your rights as a data subject, you can contact us or the provider of the social media platform. If one party is not responsible for answering the request or needs to receive the information from the other party, we or the provider will forward your request to the respective partner. If you have any questions about profiling or the processing of your data when using the website, please contact the operator of the social media platform directly. If you have any questions about the processing of your interaction with us on our site, write to the contact details provided above.

(6) The providers describe what information the social media platform receives and how it is used in their privacy policies (see link in the table above). There you will also find information about contact options and the setting options for advertisements. You can also find more information about social networks and how you can protect your data at www.youngdata.de.

F. Online advertising

Advertising with Facebook (Pixel and Conversion Tracking)

(1) The website also uses advertising measures from Facebook Inc. ("Facebook"). By integrating the so-called "Facebook Pixel" on our website, we can show users of our website and the social network Facebook our advertising measures ("Facebook Ads") and measure and evaluate their success ("conversion tracking"). This connection between Facebook and our website is technically made via the "Facebook Pixel". The legal basis for the processing of your data is Art. 6 Para. 1 Clause 1 Letter a of GDPR, i.e. the integration only takes place with your consent.

(2) Due to the marketing tools used, your browser automatically establishes a direct connection to the Facebook server when you visit our website. We have no influence on the scope and further use of the data collected by Facebook through the use of this tool and therefore present you with the processes known to us: By integrating the Facebook pixel, Facebook receives the information that you have accessed the corresponding web page on our website or clicked on an ad from us. If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are not registered with Facebook or have not logged in, there is a possibility that the provider will find out your IP address and other identification features and use them to create a profile.

(3) The information collected is stored on Facebook servers, including in the USA. For these cases, the provider has stated that it has imposed a standard that corresponds to the former EU-US Privacy Shield and has promised to comply with applicable data protection laws when transferring data internationally. We have also agreed so-called standard data protection clauses with Facebook, the purpose of which is to maintain an appropriate level of data protection in the third country.

(4) You can revoke your consent at any time without affecting the legality of the processing up to the time of revocation. The easiest way to revoke your consent is via our Consent Manager or by clicking [here]. In addition, you can object (only logged in users) using the provider's function at the following link: www.facebook.com/settings/?tab=ads#_.

(5) For further information on data processing by Facebook, please contact Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Information on data protection at Meta can be found here: https://www.facebook.com/privacy/center/

(6) We also use the remarketing function "Custom Audiences", which also uses the Facebook pixel, to display interest-based advertisements when you visit our website or other websites that also have the Facebook pixel integrated. This allows us to show you advertisements that are of interest to you in order to make our website more interesting for you and to market our offering.

G. Other services of Shopify International Limited

1. Shop system - Shopify

We use the online shop system Shopify. This is offered by Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify also processes your personal data outside the European Union, e.g. in the USA. According to the European Court of Justice, there is currently no adequate level of protection for data transfer to the USA. Shopify uses standard contractual clauses provided by the EU Commission (= Art. 46. Para. 2 and 3 GDPR - Standard Contractual Clauses - SCC) as the legal basis for data processing by recipients in third countries (outside the European Union, Iceland, Liechtenstein, Norway, in particular in the USA). These model clauses are intended to ensure that the level of data protection prevailing in the EU is adhered to when processing personal data in contracting third countries. These clauses are based on an implementing decision of the EU Commission. This decision and the standard contractual clauses can be found here: https://eur-lex.europa.eu/eli/dec_impl/ 2021/914/oj?locale=de

You can find more information about how Shopify processes your data here: https://www.shopify.de/legal/datenschutz or https://help.shopify.com/en/manual/your-account/privacy/GDPR/gdpr-faq#will-shopify-sign-standard-contractual-clauses

H. Applicant data

All data that you provide to us via our homepage or as an application by other means will be processed solely for the purpose of carrying out the application and selection process and will only be used to assess your professional suitability and to contact you. This includes your title, first name, last name, address, telephone number, email address, your CV and data on your education and qualifications, Art. 6 Para. 1 b) GDPR, 26 BDSG. If you yourself provide “special categories of personal data” in accordance with Art. 9 GDPR in the application letter or other documents you submit during the application process, your consent also applies to this data. We ask that you refrain from providing special categories of personal data in the application if possible. Your application documents will only be passed on to those responsible for evaluating the application and, if necessary, hiring. Your application data will only be used for our application processes. The data and files you submit will only be stored and used for purposes related to the recording and processing of your application. By submitting your application, you also consent to the storage of your application data. Your application data will be deleted 6 months after the application process has been completed. No separate notification will be given of this. The principles described also apply to unsolicited applications, i.e. if you are not applying for a specific position or if the application data is sent by post or email.