Privacy Policy
The following notices provide a simple overview of what happens to your personal data when you visit our website. Personal data is any data by which you can be personally identified. Detailed information on the subject of data protection can be found in our privacy policy set out below this text.
Who is responsible for the collection of data on this website?
The protection of your personal data is an important concern for us. We observe the statutory provisions on data protection and data security. Below we inform you about the nature, scope and purpose of the collection and use of your personal data.
The data processing on this website is carried out by the website operator.
Who we are
Only Kosmetik GmbH, Responsible person: M. Sokiran
The address of our website is: https://onlysmile.de
Contact options
Address:
Königsallee 27
40212 Düsseldorf
Germany
Tel.: +49 211 33764072
Email of the person responsible for data protection: info@onlykosmetik.de
Access to our homepage
Each time our website at www.onlysmile.de is accessed, personal data is automatically collected and stored. The website is hosted by Shopify; details on this can be found in the section on Shopify below.
How do we collect your data?
Your data is collected, on the one hand, by you providing it to us. This may be, for example, data that you enter into a contact form.
Other data is collected automatically by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time of the page view). This data is collected automatically as soon as you enter our website.
What do we use your data for?
Some of the data is collected in order to ensure the error-free provision of the website. Other data may be used to analyse your user behaviour.
What rights do you have regarding your data?
You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction, blocking or deletion of this data. You can contact us at any time at the address given in the legal notice regarding this and any further questions on the subject of data protection. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.
General information and mandatory information
Data protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
When you use this website, various items of personal data are collected. Personal data is data by which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this takes place.
We point out that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.
Embedded content from other websites
Posts on this website may contain embedded content (e.g. videos, images, posts, etc.). Embedded content from other websites behaves in exactly the same way as if the visitor had visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking services and record your interaction with this embedded content, including your interaction with the embedded content if you have an account and are logged in to that website.
Your contact details
Personal data that you may send to us by email, contact forms or registration forms is provided on an expressly voluntary basis (the legal basis is Art. 6(1) sentence 1(a) GDPR) and serves exclusively the purpose intended by you. Please note the corresponding information on the forms. If you contact us via our contact form or by email, we store the information you provide in order to be able to answer your enquiry and to ask any follow-up questions. When you register for our events, your data will only be stored in our invitation distribution list if you expressly consent to receiving further invitations to our events in the future.
We expressly point out that data transmission over the internet (e.g. when communicating by email) may have security gaps and cannot be completely protected against access by third parties.
What rights you have to your data
If you have a customer account in our shop, you can request an export of your personal data from us, including all data that you have provided to us. In addition, you can request the deletion of all personal data that we have stored about you. This does not include the data that we are required to retain for administrative, legal or security-related reasons.
Social media
We use the platform of the social network Facebook. We point out that you use this platform on your own responsibility and that ONLY KOSMETIK GMBH obtains no knowledge of the content of the transmitted data or of its use by this social network. At www.facebook.com/privacy/explanation you will find the applicable privacy policy.
Cookies
The internet pages partly use so-called cookies. Cookies do not cause any damage to your computer and do not contain viruses. Cookies serve to make our offering more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and saved by your browser.
Most of the cookies we use are so-called “session cookies”. They are automatically deleted after the end of your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognise your browser on your next visit.
You can set your browser so that you are informed about the setting of cookies and allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when the browser is closed. If cookies are deactivated, the functionality of this website may be restricted.
Cookies that are necessary to carry out the electronic communication process or to provide certain functions requested by you (e.g. shopping cart function) are stored on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the storage of cookies for the technically error-free and optimised provision of its services. Insofar as other cookies (e.g. cookies for analysing your surfing behaviour) are stored, these are dealt with separately in this privacy policy.
Cookie consent management
To obtain, document and manage your consent to non-essential cookies, we use the TinyCookie application. The provider is Tobi AI Ltd, 93 Fernside Road, Poole BH15 2JQ, United Kingdom. For transfers to the United Kingdom, an adequacy decision of the European Commission pursuant to Art. 45 GDPR exists.
When you access our website, a consent banner is displayed to you. Your selection is stored in the cookies tinycookie and tinycookie_acc on your device so that the banner does not appear again on further page views and the services you have approved are loaded or blocked accordingly.
In this process, your consent decision, the time of the decision and technical information about the browser you use are processed. The storage of this information serves to fulfil our duty of proof pursuant to Art. 7(1) GDPR; the legal basis is Art. 6(1) sentence 1(c) GDPR.
You can change your selection at any time via the cookie banner.
Hosting and content delivery networks (CDN) - Shopify
We host our website with Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter: “Shopify”).
Shopify is a tool for creating and hosting websites. When you visit our website, Shopify records your IP address as well as information about the device and the browser you use. Shopify also analyses visitor numbers, visitor sources and customer behaviour and compiles user statistics. If you make a purchase on our website, Shopify additionally records your name, your email address, delivery and billing addresses, payment data and other data connected with the purchase (e.g. telephone number, amount of the sales made and the like).
For the analyses, Shopify stores cookies in your browser.
For details, please refer to Shopify's privacy policy:
https://www.shopify.de/legal/datenschutz.
Shopify is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable presentation of our website possible. Where corresponding consent has been requested, the processing takes place exclusively on the basis of Art. 6(1) lit. GDPR; the consent can be revoked at any time.
Server log files
The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:
- Browser type and browser version
- operating system used
- Referrer URL
- Host name of the accessing computer
- Time of the server request
- IP address of the accessing computer
This data is not merged with other data sources.
The legal basis for the data processing is Art. 6(1) sentence 1(f) of the General Data Protection Regulation (GDPR) applicable from 25 May 2018. Our legitimate interest follows from the purposes for data collection listed above. Under no circumstances do we use the data collected for the purpose of drawing conclusions about your person. We reserve the right to check the log files subsequently if there is a suspicion of unlawful use of our offering
CONSENT, ANALYSIS AND ADVERTISING
Consent to non-essential cookies
We use the analysis, marketing and remarketing services described in this section exclusively if you have given us your express consent to do so via our cookie banner. The legal basis is Art. 6(1) sentence 1(a) GDPR in conjunction with § 25(1) TDDDG. You can revoke or change your consent at any time with effect for the future by adjusting your selection in the cookie banner. The lawfulness of the processing carried out up to the revocation remains unaffected by the revocation.
Consent control of the Google and Meta services
The tags of Google and Meta are linked to your consent decision. As long as you have not given consent, these services are not loaded on our website. In that case, neither are cookies set nor is data transmitted to Google or Meta. Only after your consent are the tags loaded and do they begin with the measurement.
Integration via Simprosys
The technical integration of the Google and Meta services described below takes place via a Shopify application of Simprosys InfoMedia, B-303 Shapath Hexa, Opp. Gujarat High Court, S.G. Highway, Ahmedabad, Gujarat 380060, India. Simprosys processes the data arising in this connection exclusively on our behalf and in accordance with our instructions on the basis of a data processing agreement pursuant to Art. 28 GDPR. As the provider is established outside the European Union, the transfer takes place on the basis of the standard contractual clauses of the European Commission pursuant to Art. 46(2)(c) GDPR.
Google Analytics 4
This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and comparable technologies which enable an analysis of your use of the website. Among other things, the pages accessed, the time spent, the origin of the access, information about the browser and the device, the approximate geographical origin and triggered events such as viewing a product, adding it to the shopping cart and completing an order are recorded.
Your IP address is truncated by Google within the member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there.
Event-related data is automatically deleted after two months, user-related data after 14 months. Aggregated evaluations in the standard reports, which do not permit any conclusions to be drawn about individual users, remain available beyond that.
The legal basis is your consent pursuant to Art. 6(1) sentence 1(a) GDPR and § 25(1) TDDDG.
You can additionally prevent the collection by Google Analytics by downloading and installing the browser add-on available at https://tools.google.com/dlpage/gaoptout.
Google Ads: conversion tracking and remarketing
We use Google Ads, an online advertising programme of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Within the scope of Google Ads, we use conversion tracking. If you click on an advertisement placed by us, a cookie is stored on your device. If you subsequently access certain pages of our website, such as the order confirmation, Google and we are able to recognise that you clicked on the advertisement and completed an order. In doing so, we do not receive any information by which users can be personally identified, but exclusively statistical evaluations.
In addition, we use the remarketing and audience functions of Google Ads, including dynamic remarketing. In this process, advertisements for products that you previously viewed in our shop are displayed to you on third-party websites within the Google advertising network.
The legal basis is your consent pursuant to Art. 6(1) sentence 1(a) GDPR and § 25(1) TDDDG.
Meta pixel and Conversions API
We use the visitor action pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. This enables us to understand how visitors behave on our website after they have reached our pages via an advertisement on Facebook or Instagram. Among other things, pages accessed, triggered events such as shopping cart actions and orders, as well as information about the browser and the device are recorded.
Via the Conversions API, these events are additionally transmitted to Meta on the server side. In this process, encrypted (hashed) contact data such as email address or telephone number may also be transmitted so that Meta can assign an event to a user account existing there.
For the collection and transmission of this data, we are jointly responsible with Meta within the meaning of Art. 26 GDPR. The agreement concluded in this respect, as well as information on how Meta subsequently processes the data further under its own responsibility, can be found in Meta's privacy information.
The legal basis is your consent pursuant to Art. 6(1) sentence 1(a) GDPR and § 25(1) TDDDG.
Transfer to the USA
Google and Meta also process data on servers in the United States. Both companies are certified under the EU-US Data Privacy Framework. For transfers to companies certified thereunder, an adequacy decision of the European Commission pursuant to Art. 45 GDPR exists. In addition, we have agreed the standard contractual clauses of the European Commission with the providers. We point out that US authorities may access this data under certain conditions and that legal protection corresponding in every respect to European standards is not guaranteed in all cases.
FURTHER SERVICES USED
Klaviyo
For sending our newsletter and for marketing messages, we use Klaviyo, a service of Klaviyo Inc., 125 Summer Street, Boston, MA 02110, USA. Klaviyo processes the email address you have provided as well as information about whether and when you opened our messages and which links you clicked in them. On our website, Klaviyo additionally records which pages and products you have accessed and, for this purpose, stores an identifier in the cookie file __kla_id as well as information in the local storage of your browser.
The legal basis for sending the newsletter is your consent pursuant to Art. 6(1) sentence 1(a) GDPR; for the onsite tracking, the legal basis is your consent pursuant to Art. 6(1) sentence 1(a) GDPR in conjunction with § 25(1) TDDDG. You can revoke your consent at any time, in the case of the newsletter via the unsubscribe link in every message.
Product reviews
For the collection and display of product reviews, we use Judge.me, a service of Judge.me Ltd. After a purchase, we may invite you by email to submit a review. In this process, your name or the display name chosen by you, your email address, the product reviewed and the content of your review are processed. Only what you have designated for publication is published.
The legal basis for the display of reviews is our legitimate interest in a transparent presentation of our products pursuant to Art. 6(1) sentence 1(f) GDPR; for the review request by email, the legal basis is Art. 6(1) sentence 1(a) or (f) GDPR.
Google reviews
On individual pages we embed reviews that have been submitted about our company on Google. The display takes place via a widget of the provider Reputon. When the widget is loaded, a connection is established to servers of Reputon and to servers of Google; the profile pictures of the reviewers are loaded directly from Google in this process. Google thereby obtains knowledge that our page has been accessed via your IP address.
The legal basis is your consent pursuant to Art. 6(1) sentence 1(a) GDPR and § 25(1) TDDDG.
Functions for language, currency and product recommendations
For the display of content in your language and currency as well as for product recommendations, notice banners and voucher campaigns, we use applications of third-party providers. For this purpose, these store information in the local storage of your browser, such as the language you have selected, notices already displayed and a randomly assigned session identifier. This information is not merged with your name or your address.
Insofar as this information is strictly necessary for the function expressly requested by you, the legal basis is § 25(2) no. 2 TDDDG. In all other respects, the legal basis is your consent pursuant to Art. 6(1) sentence 1(a) GDPR and § 25(1) TDDDG.
Payment service providers
For the processing of payments, we use PayPal, Klarna and Shop Pay, depending on the payment method you have selected. A connection to the servers of the respective provider is established as soon as the payment buttons are accessed. The payment data you enter is transmitted exclusively to the respective provider; we ourselves do not receive any complete payment data.
The legal basis is the performance of the contract pursuant to Art. 6(1) sentence 1(b) GDPR.
PLUGINS AND TOOLS
Google Fonts
This page uses so-called web fonts provided by Google for the uniform display of fonts. When you access a page, your browser loads the required web fonts into its browser cache in order to display texts and fonts correctly.
For this purpose, the browser you use must establish a connection to the servers of Google. Google thereby obtains knowledge that our website has been accessed via your IP address. Google Web Fonts are used in the interest of a uniform and appealing presentation of our online offerings. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.
If your browser does not support web fonts, a standard font from your computer is used.
Further information on Google Web Fonts can be found at https://developers.google.com/fonts/faq and in the privacy policy of Google: https://www.google.com/policies/privacy/.
Right to object
Insofar as your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1) sentence 1(f) GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR. If you wish to exercise your right of revocation or objection, it is sufficient to send an email to info@onlysmile.de
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place insofar as it is technically feasible.
Information, blocking, deletion
Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to correction, blocking or deletion of this data. You can contact us at any time at the address given in the legal notice regarding this and any further questions on the subject of personal data.
Objection to advertising emails
The use of contact data published within the scope of the legal notice obligation for the transmission of advertising and information material that has not been expressly requested is hereby objected to. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example by spam emails.
Amendment of our privacy policy
In order to ensure that our privacy policy always complies with the current statutory requirements, we reserve the right to make changes at any time. This also applies in the event that the privacy policy has to be adapted due to new or revised services, for example new service offerings. The new privacy policy then applies on your next visit to our offering.
Further legal notices
The design and the contents of this website are protected by copyright.
We endeavour to provide correct information, but cannot accept any legal liability for it.
Further information
All contents and images are protected by copyright. Reproduction, distribution or other use is permitted only with our express consent.