Privacy

1. Information on data protection

We are pleased that you are visiting our website and thank you for your interest in our company and our products. At this point we would like to inform you about which data we collect, use and process, when and how we handle your personal data.

2. Data collection and data use

Personal data is information that can be used to identify a person as such. This includes, for example, your name, your address, your email address or your telephone number.

(1) Collection of personal data when using the website

When you use the website purely for information purposes, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you would like to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security:

IP address
Date and time of the request
Time zone difference to Greenwich Mean Time (GMT)
Content of the request (specific page)
Access status/HTTP status code
amount of data transferred in each case
Website from which the request comes
Browser
Operating system and its interface
Language and version of the browser software.
The legal basis for storing the data is Article 6 Paragraph 1 Letter f GDPR.

(2) Collection of personal data upon registration

We offer you the opportunity to register on our website by providing personal data.
Depending on the type of contract concluded, we store the following data:

Names, first names
Address
Billing address
E-mail address
Telephone number

The data is entered into an input mask and transmitted to us and stored. A transfer of data to third parties does not take place. Users can access their user account to order goods via the app.
As part of the registration process, the user's consent to the processing of this data was obtained, Article 6 Paragraph 1 a) GDPR. Registration is also required to fulfill a contract for the purchase of goods in our online shop or to carry out pre-contractual measures, Article 6 Paragraph 1 b) GDPR. The data collected serves us to process the purchase of goods in our online shop, in particular to enable the correct shipping of ordered goods.
The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case if registration on our website is canceled or changed or if the data is no longer required to carry out the contract. Even after a contract has been concluded, there may be a need to store the contractual partner's personal data in order to comply with contractual or legal obligations (e.g. for tax reasons).
Users have the option to cancel their registration at any time. You can have the data stored about you changed at any time, namely as follows:
If the data is necessary to fulfill a contract or to carry out pre-contractual measures, early deletion of the data is only possible unless contractual or legal obligations prevent deletion.

If you give your consent, the legal basis for processing the data is Art. 6 Para. 1 lit. a GDPR and, if the registration serves to fulfill a contract or carry out pre-contractual measures with you, additionally Art. b GDPR.

3. Name and contact details of the person responsible

The person responsible for the management of personal data is

VYBE Beauty GmbH
Vogelsanger Str. 197 B
50825 Cologne
Managing Director: Rashad Jungbluth
Email: privacy@get-vybe.com

Contact details of the data protection officer

You can reach our data protection officer at:
Email: privacy@get-vybe.com

4. Purposes of processing personal data

We only store your data for the following purposes:
To process orders (including payment processing and, if necessary, credit checks), to send us advertising and for customer service.

We store and process your personal data at our central company headquarters.

Your personal data will only be transferred to third parties if the transfer is necessary as part of contract processing or for billing or debt collection purposes (e.g. shipping companies or payment service providers) or if you have expressly consented.

The legal basis for the transmission of data to third parties for the purpose of contract processing or for billing purposes is Article 6 Paragraph 1 Letter b GDPR and for the transfer in the context of legally mandated cases Article 6 Paragraph 1 Letter c GDPR.

5. Duration of data storage

We store your data for as long as the respective purpose requires, taking into account your legitimate interests. If there is a tax retention period for certain data that is processed for the processing of sales contracts, the data will be stored for 6 or 10 years. During this period, the processing of data is restricted after 2 years, meaning the data will only be used to comply with legal obligations. The retention obligation begins at the end of the calendar year in which the order was placed by the customer or the contract was fulfilled.

6. Disclosure of personal data to third parties

We may share your personal data with the following companies/categories of people in accordance with legal requirements:

Tax auditing and other authorities
External service providers and professional consultants such as lawyers, auditors, accountants, credit agencies for credit checks, debt collection service providers,

Postal/shipping service providers, freight forwarders e.g. UPS, DHL, Deutsche Post
Payment providers such as PayPal (Europe) S.à rl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg; Klarna AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, (Amazon Pay) Amazon Payments Europe sca, 5 Rue Plaetis, L-2338 Luxembourg; (Apple Pay) Apple Distribution International, Hollyhill Industrial Estate, Hollyhill Cork, Ireland; Shopify Payments, 126 York Street, Suite 200, Ottawa, ON, Canada, K1N 5T5; Google Pay (Europe), Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

E-commerce platform Shopify
To operate our online shop, we use Shopify, a service provided by Shopify Inc., 126 York Street, Suite 200, Ottawa, ON, Canada, K1N 5T5. This service provides an e-commerce platform through which we offer our goods for sale. The data transmitted as part of your order is stored on a Shopify server.

Shopify has explicitly designed its infrastructure so that cross-border data transfer is GDPR-compliant. Personal data from people from Europe is first received and processed in Ireland, Shopify's EU headquarters, and then transferred to Canada to the parent company. If data is forwarded from there to processors based in other countries, e.g. the USA, this is done in accordance with the export requirements of the Canadian Data Protection Act recognized by the European Commission.

In addition, personal data may be transferred within a group of companies (e.g. between Shopify Inc. (Canada) and Shopify in the USA) if these companies have an internal policy to protect the data (so-called “Binding Corporate Rules” (BCR)), which is enforced by a European data protection authority (based here in Ireland) must be approved (Article 47 GDPR).

Finally, data transferred from Shopify Canada to the United States is encrypted in transit and at rest. This means that they cannot be easily decrypted.

For more information, see http://www.shopify.com/legal/privacy.

The legal basis for the transmission of data to third parties for the purpose of contract processing or for billing purposes is Article 6 Paragraph 1 Letter b GDPR and for the transfer in the context of legally mandated cases Article 6 Paragraph 1 Letter c GDPR.

7. Your rights

To exercise your rights, you can use the contact form (https://get-vybe.com/pages/kontakt) or you can contact the data protection officer or the person responsible or you can contact us at email: privacy@get-vybe. com

You have the following rights:

7.1 Revocation of consent
You can revoke your consent to the processing of personal data at any time with future effect.
The contact options above are available to you for this purpose (https://get-vybe.com/pages/kontakt).

7.2 Other Rights
You also have the following rights towards us with regard to your personal data:

right to information,
right to rectification,
Right to deletion or restriction of processing,
Right to object to processing,
Right to data portability,

You also have the right to complain to a data protection supervisory authority about our processing of your personal data.

The responsible data protection supervisory authority for North Rhine-Westphalia is:
State Commissioner for Data Protection and Freedom of Information for North Rhine-Westphalia
PO Box 20 04 44
40102 Düsseldorf

Telephone exchange: +49 (0)211 / 38424 - 0
poststelle@ldi.nrw.de

Internet: https://www.ldi.nrw.de/

8. Contact form

If you send us inquiries using the contact form, we will only use your data to process your request. This data will not be used for advertising purposes or passed on to third parties.

The legal basis for the processing of data transmitted via the contact form or when sending an email is Article 6 Paragraph 1 Letter f of the GDPR. If the contact is also aimed at concluding a contract, the additional legal basis for the processing is Article 6 (1) (b) GDPR.

The data you enter in the contact form will be stored by us until you request us to delete it, revoke your consent to storage or the purpose for storing the data no longer applies.

9. Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies. These are small text files that your web browser receives when you visit our pages and stores on your computer. Some of the cookies are deleted immediately after closing the browser. Other cookies remain permanently on your computer and enable us to recognize you or your computer the next time you visit our website.
This site uses the following types of cookies, the scope and functionality of which are explained below:

a) Transient cookies, these are automatically deleted when you close your browser. These include, in particular, session cookies. These store a so-called session ID, with which the various requests from your browser can be assigned to the common session. This allows your computer to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.

b) Persistent cookies, which are automatically deleted after a specified period of time, which may differ depending on the cookie. You can delete cookies at any time in your browser's security settings.
You can influence the use of cookies by changing your browser settings. Most browsers have an option that allows you to restrict or prevent the storage of cookies. Each browser is unique in the way it manages cookie settings. This is described in the respective help menu of your browser.

You can find these for the respective browsers under the following links:

Internet Explorer: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehne
Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Safari: https://support.apple.com/kb/ph21411?locale=de_DE

Please note, however, that deactivating cookies may mean that only limited functions of the website are available to you.
The legal basis for the use of cookies is Article 6 (1) (f) GDPR.
When using cookies, a distinction must be made between the absolutely necessary cookies and those for further purposes (measuring access numbers, advertising purposes). You generally have the choice via our consent manager to accept or reject all or some of the non-essential cookies. If you choose the last option, it is possible that you will not be able to fully use our offer. You can control and revoke this consent via our consent management (also known as “cookie banner” or “cookie settings”).

10. Analysis tools

10.1 Use of Google Analytics
Our website uses Google Analytics, a web analysis service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies”, text files that are stored on your computer and that enable your use of the website to be analyzed. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website and internet usage to the website operator.

The IP address transmitted by your browser as part of Google Analytics is not combined with other Google data.

You can prevent the storage of cookies by setting your browser software accordingly; However, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by using the browser plug-in available under the following link. Download and install in: http://tools.google.com/dlpage/gaoptout?hl=de.

This website uses Google Analytics with the extension “_anonymizeIp()”. This means that IP addresses are further processed in abbreviated form, which means that any personal connection can be ruled out. If the data collected about you is personally related, this will be excluded immediately and the personal data will be deleted immediately.

We use Google Analytics to analyze the use of our website and to regularly improve it. We can use the statistics obtained to improve our offering and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

Third-party information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. User terms and conditions: http://www.google.com/analytics/terms/de .html, overview of data protection: http://www.google.com/intl/de/analytics/learn/privacy.html, and the data protection declaration: http://www.google.de/intl/de/policies/privacy .

10.2 Use of Hotjar
Our website uses Hotjar, an analysis software from Hotjar Ltd. 3 Lyons Range- 20 Bisazza Street- Sliema SLM 1640, Malta (http://www.hotjar.com), which enables us to analyze your use of the website. Hotjar uses cookies and a tracking code through which the collected data is transmitted to the Hotjar server. This data is essentially device-related information, such as the IP address, the screen size of your device, the device type and browser information, such as type and version, your geographical location and your language preference. Your email address with your first and last name will also be transmitted, provided you have provided us with this information. User interaction, such as mouse movement, websites visited and the date and time of use are also regularly transmitted to Hotjar. Your IP address is automatically anonymized by Hotjar and stored exclusively in this form. In addition, users of the website are assigned a unique user identifier (UUID), through which Hotjar can record recurring users of our website - without linking them to your personal data.

You can prevent Hotjar from collecting and using your data using the link https://www.hotjar.com/opt-out.

10.3 Use of Tidio
Our website uses Tidiochat, a service provided by Tidio Ltd. 220C Blythe Road, W14 0HH, London, United Kingdom (www.tidiochat.com). This service processes anonymized data for the purpose of web analysis and live chat. Cookies can be used for this purpose, which enable your browser to be recognized. Cookies are small text files that are stored on your hard drive associated with the browser you are using and through which certain information flows to the place that sets the cookie. Data collected using the Tidiochat service will not be used to identify you without your consent. The data will also not be merged with personal data about the bearer of the pseudonym used. You can configure your browser settings according to your wishes and e.g. B. refuse to accept third-party cookies or all cookies. We would like to point out that you may not be able to use all of the functions of this website.

Further information can be found in Tidio's privacy policy: https://www.tidiochat.com/en/privacy-policy .

Right to object

You can object to the collection and storage of data for the purpose of usage analysis at any time with future effect by informing us of your objection: e.g. by email: privacy@get-vybe.com

The legal basis for the use of analysis tools is Article 6 Paragraph 1 Sentence 1 Letter f GDPR.

11. Social Media Links

We link to the social media platforms Facebook, Instagram and YouTube on our website using the respective symbols. These are hyperlinks through which your data is not transmitted. If you click on the link, you will be immediately redirected to our respective social media presence. Your data will only be transmitted to the respective social media service if you are logged into your respective user account. In this case, the respective social media platform may receive information about what content you have viewed on our website.

The following are exclusively responsible for the social media services we link to:

for Facebook and its website, Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA;

for Instagram and its website, Instagram, LLC, 1601 Willow Rd. Menlo Park, CA 94025, USA;

for YouTube and its website, YouTube, LLC, 901 Cherry Ave., St. Bruno, CA 94066, USA;

for TikTok and its website, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

For further information about the purpose and scope of data collection and about the further processing and use of your data by the respective social media service, please refer to the data protection guidelines of the respective platform.

12. Facebook Connect

We use the “Facebook Connect” service from Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (“Facebook”) on our website. We offer you the opportunity to log in to our website with Facebook Connect if you have a Facebook profile and give us your express consent to exchange data with Facebook. In this case, additional registration is not required. To register, you will be redirected to the Facebook page, where you can log in with your usage data. This means your browser establishes a direct connection to Facebook's servers, linking your Facebook profile and our service. Through this link, Facebook receives the information that your browser has accessed the corresponding page on our website, even if you do not have a Facebook profile or are not currently logged in to Facebook. By linking, we automatically receive the following information from Facebook Inc., depending on your data protection setting on Facebook (name, email address, date of birth, address, Facebook name, user ID, age, gender and, if applicable, profile picture , the friends list and the likes). From this data, we only use your name, your email address, your date of birth and your address to create a user account, if you have approved these on Facebook. This information is necessary for the conclusion of the contract in order to be able to identify you.

For further information about Facebook Connect and the privacy settings, please see the data protection information and the terms of use of Facebook Inc. http://www.facebook.com/policy.php

If you do not want Facebook to link the data obtained via our website with your Facebook profile, you must log out of Facebook before visiting our website. You can also exclude the Facebook Connect plugin using add-ons for your browser.

revocation
The consent given to the exchange of data via Facebook Connect can be canceled at any time in the future by sending a message to the e-mail: privacy@get-vybe.com can be revoked.

13. Google Tag Manager

On our site we use the Google Tag Manager service from Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94.043 USA. Google Tag Manager allows marketers to manage website tags from one interface. A tag is a marking or labeling of a data set. However, the tag manager itself, which uses the tags, works without cookies and does not collect any personal data. The tags set up via Google Tag Manager only ensure the collection of data that is passed on to the target system. Because the data is only passed on, the system does not collect or store the data itself. The tag manager therefore only ensures that other tags are triggered, which in turn may collect data. Corresponding explanations for these respective third-party providers can be found in this data protection declaration. However, Google Tag Manager does not use this data. If you have set or otherwise deactivated cookies, this will be taken into account for all tracking tags that were used with the Google Tag Manager, so the tool does not change your cookie settings.

Google may ask you for permission to share some product data (such as your account information) with other Google products to enable certain features, such as: B. to make it easier to add new conversion tracking tags for AdWords. In addition, Google developers review product usage information from time to time to further optimize the product. However, Google will not share this type of data with other Google products without your consent.

For more information, please see the Google Usage Policy and Google Privacy Policy for this product.

14. Newsletters

(1) With your consent, you can subscribe to our newsletter, with which we inform you about our current interesting offers. The advertised goods and services are named in the declaration of consent.

(2) To register for our newsletter we use the so-called double opt-in procedure. This means that after you register, we will send you an email to the email address you provided, in which we will ask you to confirm that you would like to receive the newsletter. If you do not confirm your registration within [24 hours], your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you use and the times of registration and confirmation. The purpose of the procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.

(3) The only mandatory information for sending the newsletter is your email address. Providing further, separately marked data is voluntary and is used to address you personally. After your confirmation, we will save your email address for the purpose of sending you the newsletter. The legal basis is Article 6 Paragraph 1 Sentence 1 Letter a GDPR.

(4) You can revoke your consent to receive the newsletter at any time and unsubscribe from the newsletter. You can declare your revocation by clicking on the link provided in every newsletter email, by email to (hello@get-vybe.com) or by sending a message to the contact details provided in the legal notice.

To send our newsletters, we use the Klaviyo service from Klaviyo Inc,, 225 Franklin St, Floor 10, Boston, MA 02110, USA. The processing of your data stored when you register for the newsletter (email address, if applicable name, IP address, date and time of your registration) can also take place in the USA. According to the European Court of Justice, an adequate level of data protection cannot currently be assumed in the USA.

Klaviyo uses so-called standard contractual clauses in accordance with Article 46 Paragraphs 2 and 3 GDPR (https://eur-lex.europa.eu/eli/dec_impl/2021/914/) as the basis for processing or transferring data to countries outside the EU . oj?locale=de ). Through these clauses, Klaviyo undertakes to comply with EU data protection standards when processing your data, even if the data is transferred to third countries such as the USA and processed and stored there. You can find out more about this on the Klaviyo website https://www.klaviyo.com/legal/data-processing-agreement and https://www.klaviyo.com/legal/privacy/privacy-notice

(5) We would like to point out that we evaluate your user behavior when sending the newsletter. For this evaluation, the emails sent contain so-called web beacons or tracking pixels, which represent single-pixel image files that are stored on our website. For the evaluations, we link the data mentioned in Section 3 and the web beacons with your email address and an individual ID. We use the data obtained in this way to create a user profile in order to tailor the newsletter to your individual interests. We record when you read our newsletters, which links you click in them and infer your personal interests.
Right to object

You can object to this tracking at any time by clicking on the special link provided in each email or by contacting us via another contact method, for example by email: inform privacy@get-vybe.com. The information will be stored for as long as you have subscribed to the newsletter. After you unsubscribe, we store the data purely statistically and anonymously. Such tracking is also not possible if you have deactivated the display of images in your email program by default. In this case, the newsletter will not be displayed to you in its entirety and you may not be able to use all functions. If you display the images manually, the tracking mentioned above occurs.

15. Use of social media plug-ins

On our website we use so-called social plugins (“plugins”) from Instagram, which is operated by Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA (“Instagram”).

We use the so-called two-click solution. This means that when you visit our site, no personal data will initially be passed on to Instagram. The plug-in in the form of images is provided with the heading “Follow us on Instagram”. We give you the opportunity to communicate directly with Instagram using the button. Only if you click on the marked field and thereby activate it will Instagram receive the information that you have accessed our website. In addition, the data mentioned in Section 1 of this declaration will be transmitted. By activating the plug-in, your personal data will be transmitted to Instagram and stored there (with US providers in the USA).
We have no influence on the data collected and data processing operations, nor are we aware of the full extent of data collection, the purposes of processing, or the storage periods. We also have no information about the deletion of the data collected by Instagram.

When you interact with the plug-in, especially by clicking on the plug-in image, your browser establishes a direct connection to Instagram's servers. The content of the plug-in is transmitted directly to your browser by Instagram and integrated into the page. Through this integration, Instagram receives the information that your browser has accessed our website, even if you do not have an Instagram profile or are not currently logged in to Instagram. This information (including your IP address) is transmitted from your browser directly to an Instagram server in the USA and stored there. If you are logged in to Instagram, Instagram can directly assign your visit to our website to your Instagram account. The information will also be published on your Instagram account and shown to your contacts there. We recommend that you log out regularly after using a social network, but especially before activating the button, as this allows you to avoid being assigned to your Instagram profile.

Instagram saves the data collected about you as usage profiles and uses them for advertising, market research and/or needs-based design of its website. Such an evaluation is carried out in particular (also for users who are not logged in) to display tailored advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, although you must contact Instagram to exercise this.

Further information on the purpose and scope of data collection and the further processing and use of the data by Instagram as well as your related rights and setting options to protect your privacy can be found in Instagram's data protection information: https://help.instagram.com/155833707900388/.
If you do not want Instagram to directly assign the data collected via our website to your Instagram account, you must log out of Instagram before visiting our website. You can also completely block the Instagram plugins from loading using add-ons for your browser, e.g. B. with the script blocker “NoScript” (http://noscript.net/).
The legal basis for the use of the plug-ins is Article 6 Paragraph 1 Sentence 1 Letter f of the GDPR.

16. Remarketing/retargeting

(1) On our websites we use “Custom Audiences” from Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”) for retargeting or remarketing purposes. This service uses so-called tracking or remarketing pixels. These are pixel image files that enable log file analysis. By using the pixels, the service provider can see when and how many users have accessed the pixel, or whether and when an email was opened or a website was visited.

(2) With the help of this service, users of the website can be shown interest-based advertisements (“Facebook Ads”) when they visit the social network Facebook or other websites that also use the process. Our aim is to show you advertising that is of interest to you in order to make our website more interesting for you. When you visit our website, a direct connection to the Facebook servers is established via the pixel. This enables Facebook to identify you based on your browser ID, as this can be linked to your user account. We have no influence on the extent and further use of the data collected by Facebook through the use of this tool and therefore inform you according to our level of knowledge: By integrating Facebook Custom Audiences, Facebook receives the information that you have accessed the corresponding website of ours Visited our website or clicked on an advertisement from us. If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are not registered with Facebook or have not logged in, there is a possibility that the provider will find out and store your IP address and other identifying features.

(3) Deactivating the “Facebook Custom Audiences” function is possible for logged in users at https://www.facebook.com/settings/?tab=ads#_.

(4) The legal basis for the processing of your data is Article 6 Paragraph 1 Sentence 1 Letter f GDPR. Further information on data processing by Facebook can be found at https://www.facebook.com/about/privacy/.
Right to object
If you do not want to be shown advertising generated by the respective targeting service, you can object to the use of retargeting technology on our websites by sending us a message privacy@get-vybe.com.

(5) We may use pixels or similar tracking technologies from TikTok to analyze the performance of our marketing campaigns. These technologies allow us to collect anonymous information about how you interact with our website. This data can help us to optimize our website and our offerings.

(6)

We may use TikTok remarketing tags to show you personalized advertising on TikTok after you visit our website. TikTok may place cookies on your device to track your user behavior and show you relevant ads based on your visits to our website.

Please note that we have no control over TikTok's collection and use of your information. We therefore recommend that you review TikTok's privacy policy to learn more about how your data is used on their platform.

If you do not want to use TikTok to visit our website or follow our offers, you can make appropriate settings in your TikTok account or deactivate TikTok completely.

17. VYBE app

The following information describes the processing of personal data when installing and using the mobile application of VYBE Beauty GmbH (“VYBE App”). It also explains the choices you have regarding your personal information.

Processing of data when downloading the app:
By downloading our app, you have authenticated yourself to the respective App Store or Google Play Store, for example via your ID. VYBE Beauty GmbH cannot rule out a use by Apple or Google of the data collected in connection with the download or use of the applications that is not in accordance with the EU General Data Protection Regulation (GDPR). The VYBE Beauty GmbH has no influence on this.
A transfer of data by the VYBE Beauty GmbH does not sell to Apple or Google.
Before downloading or using it for the first time, you will be informed about the permissions that the app requires and you agree to these when you download the app or agree to its use. These permissions can be deactivated at any time under “Settings”:

show notifications
access all networks
Get network connections
Disable hibernation
Control vibration alarm
Number of new notifications read
Get internet data
Eligibility for advertising ID
Play Install Referrer API
Run foreground service
Google Play Billing Service
Google Play License Check
Run at startup

Processing of data when using the app:
Certain data is automatically collected by VYBE Beautyy GmbH's IT systems when using the app. This is primarily technical data (e.g. mobile device, operating system or time and usage). This data is collected automatically as soon as you use the app and is carried out in accordance with Article 6 (1) (b) or (f) GDPR to enable the use of the app as well as analysis and troubleshooting. The following data may be processed:

Type of mobile device
operating system used
language used
technical information about the device used
Date and time of the request
IP address
Current geo coordinates of the mobile device. (Analytics only)

Push messages:
You can register to receive so-called push notifications. For this we use the “CleverPush” service, which is operated by CleverPush GmbH, Brauhausstraße 15A, 22041 Hamburg (“CleverPush”).

You will receive regular information about news, discount campaigns, competitions & more via our push notifications.

In order to register for push notifications, you must confirm that your browser or device asks you to receive notifications. This process is documented and saved by CleverPush. For this purpose, the login time and a push token or device ID are saved. This data is used, on the one hand, to be able to send you push notifications and, on the other hand, as proof of your registration. The legal basis for this processing is your consent and therefore Article 6 Paragraph 1 Letter a GDPR.

CleverPush also evaluates our push notifications statistically. This allows CleverPush to recognize whether and when our push notifications were displayed and clicked on. This allows us to determine which push notifications interest recipients in order to tailor future messages to the presumed interests of all recipients and thus increase interest in our offer. In addition to the push token or device ID, we also store the topic focus of the app on which the push notifications were activated (e.g. business, sports, etc.). We also use this information to send push notifications to the relevant subscribers that are presumably in their interest. The legal basis for processing is Article 6 Paragraph 1 Letter f of the GDPR. A push token or device ID is only assigned to a specific person if we are legally obliged to do so, to defend claims against us, if this is required as evidence, and for possible prosecution of violations of the law.

You can revoke your consent to the storage and use of your personal data to receive our push notifications at any time with future effect. The revocation of consent does not affect the lawfulness of the processing carried out based on the consent before its revocation. Furthermore, you can object to the use of personal data described above at any time on the basis of Article 6 Paragraph 1 Letter f. For this purpose, please revoke your consent. You can revoke your consent in the settings provided for receiving push notifications in the settings of your device or browser.

Your data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. Your data will therefore be stored for as long as your subscription to our push notifications is active.

The cancellation process is explained in detail at the following link: https://cleverpush.com/faq .

To accelerate the retrieval of content (e.g. images) and to defend against attacks, CleverPush uses the offers from cloudflare.com, an offer from Cloudflare, Inc., as part of order processing based on the standard contractual clauses.

CleverPush does not store any data on Cloudflare's servers that contains personal information, only general content such as text or images. When you access this content, the device you are using establishes a connection to Cloudflare and the IP address of the device you are using is processed.

Further information on how CleverPush uses your personal data can be found at https://cleverpush.com/de/gdpr/.

Tracking tools:
The app uses various tracking and analysis tools. Data processing is carried out on the basis of your consent in accordance with Article 6 Paragraph 1 Sentence 1 Letter a GDPR. The transfer to a third country takes place on the basis of Art. 49 Para. 1 lit. a GDPR. You can prevent the use of this tool via our consent tool and revoke your consent at any time.

Google Analytics for Firebase and Google Play Store Analytics
The app uses the technologies Google Analytics for Firebase and Google Play Store Analytics from Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA (“Firebase”). For Europe, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services.
Google Analytics uses so-called “cookies”, text files that are stored on your computer and that enable your use of the website to be analyzed. The information generated by the cookies about your use of this website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymization is activated on this website, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and there shortened.
In principle, an adequate level of data protection cannot be assumed in the USA. There is a risk that authorities may access the data for security and surveillance purposes without you being informed or able to exercise legal recourse.
Further information about the Google Analytics data protection guidelines can be found at https://support.google.com/analytics/answer/6004245?sjid=3364535034656199429-EU.

Apple App Store Analytics

The app uses the Apple App Store Analytics technology from Apple Inc., One Apple Park Way, Cupertino, 95014 California, USA.

Apple may provide statistics about your use of the App to its partners and third-party developers. This serves Apple to further develop its apps, products and services. The analysis data and statistics are aggregated or transmitted in a form that does not allow any conclusions to be drawn about you personally.

You have the option not to send app usage data to third-party app developers. To do this, open Settings, select “Privacy & Security,” tap “Analytics & Improvements,” and then turn off the “Share with app developers” option. If Share iPhone & Watch Analytics is disabled, sharing data about crashes and other statistics about your app usage with third-party app developers is automatically disabled.

For more information about Apple's privacy policy, please visit www.apple.com/de/privacy .

18. Orders via our website or app

In order to be able to place orders via our websites or via our app, the user must enter certain personal data, namely the following data: name, address, if applicable payment details (credit card details). We store this data and use it exclusively for the purpose of order processing. The following data is also stored automatically: IP address, date and time of registration.

Data will only be passed on to third parties if and to the extent that this is necessary for the proper processing of an order and the purchase contract that has been concluded. For shipping processing, order-relevant data (contact and delivery details) can be transmitted to our shipping partner:

Shipping within Germany:

Hive Technologies GmbH
Rosenstrasse 16-17, 10178 Berlin, Germany
Managing Directors: Oskar Ziegler, Franz Purucker
Commercial register: registered under HRB 217337 at the Charlottenburg district court
VAT identification number: DE330492525
Email: hi@hive.app

Shipping within Switzerland:

The legal basis for data processing is Article 6 Paragraph 1 b) GDPR.
We will delete the data collected as soon as it is no longer necessary to achieve the purpose for which it was collected, i.e. after the contract has been fully fulfilled.
The collection of data is absolutely necessary for the proper processing of an order and fulfillment of the contract. There is therefore no possibility for the user to object.

Paypal
Our online shop allows payment via PayPal. The payment service provider is PayPal (Europe) S.à.rl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg.

If you pay with PayPal, the payment details you entered will be transmitted to PayPal.

Your data will be transmitted to PayPal on the basis of Art. 6 Para. 1 lit. a GDPR (consent) and Art. 6 Para. 1 lit. b GDPR (processing to fulfill a contract). You can revoke the consent you have already given at any time. Past data processing operations remain effective if revoked.

Klarna
In order to enable you to pay via Klarna, your personal data (contact and delivery details) may be transmitted to Klarna. This is necessary so that Klarna can check your qualification to use the payment method. Personal data submitted to Klarna will be processed in accordance with Klarna's privacy policy .

19. WhatsApp

To send newsletters, we use the instant messaging service WhatsApp Business from WhatsApp LLC, 1601 Willow Road Menlo Park, California 94025, USA via the service provider Charles GmbH, Gartenstr. 86-87, 10115 Berlin.

Registration for the WhatsApp newsletter takes place using the double opt-in procedure. After you register via a CTA or QR code, you will be sent a message asking you to confirm that you would like to receive messages from us via WhatsApp. If you no longer wish to receive messages, you can revoke your consent at any time and unsubscribe from the newsletter using a keyword that we have specified .

The only mandatory information for sending the newsletter is your telephone number . After your confirmation, your telephone number will be forwarded to our service provider Charles GmbH for the purpose of sending the newsletter and will be processed and stored there. The legal basis is Article 6 Paragraph 1 Sentence 1 Letter a GDPR.

If you communicate with us via WhatsApp, certain data that you share with the app will be stored and processed by WhatsApp. This includes, in particular, information provided by the user such as messages, photos, videos, billing data and stored profile pictures. WhatsApp states that it only stores this data end-to-end encrypted. Some metadata is collected by WhatsApp unencrypted. This includes telephone number, location, IP address, information about your device, type and frequency of app use, location and information about the time and recipient of the messages you send. According to WhatsApp's privacy policy, this information is sometimes shared with other meta companies, which include Facebook and Instagram based in the US. In some cases, such data is also shared with external companies, service providers or partners.

Data processing can also take place in the USA. According to the European Court of Justice, an adequate level of data protection cannot currently be assumed in the USA.

WhatsApp uses so-called standard contractual clauses in accordance with Article 46 Paragraphs 2 and 3 GDPR ( https://eur-lex.europa.eu/eli/dec_impl/2021/914/ ) as the basis for processing or transferring data to countries outside the EU. oj?locale=de ). Through these clauses, WhatsApp undertakes to comply with EU data protection standards when processing your data, even if the data is transferred to third countries such as the USA and processed and stored there. You can find out more about this in WhatsApp’s privacy policy at https://www.whatsapp.com/legal/privacy-policy-eea/?locale=de_DE .”

20. Emails

We use the service provider Klaviyo Inc., 225 Franklin St, Floor 10, Boston, MA 02110, USA to send emails. This applies to transactional emails such as order confirmations, shipping confirmations, emails with promotional content and newsletters.

Klaviyo has access to your data. Data processing can also take place in the USA. According to the European Court of Justice, an adequate level of data protection cannot currently be assumed in the USA.

Klaviyo uses so-called standard contractual clauses in accordance with Article 46 Paragraphs 2 and 3 GDPR ( https://eur-lex.europa.eu/eli/dec_impl/2021/914/ ) as the basis for processing or transferring data to countries outside the EU. oj?locale=de ). Through these clauses, Klaviyo undertakes to comply with EU data protection standards when processing your data, even if the data is transferred to third countries such as the USA and processed and stored there. You can find out more about this on the Klaviyo pages at https://www.klaviyo.com/legal/data-processing-agreement and https://www.klaviyo.com/legal/privacy/privacy-notice .

21. Loyalty program

To implement our loyalty program, we use the loyalty tool from LoyaltyLion Ltd., HubHub – LoyaltyLion, 20 Farringdon Street, London, EC4A 4EN, Great Britain. The data submitted as part of your participation in the program will be processed and stored by LoyaltyLion. This includes in particular your name, address, email address, telephone number if applicable, date of birth if applicable and all purchase-related data .

The legal basis for the processing of mandatory collected personal data is Article 6 (1) (b) GDPR. In order to initiate and implement the contract to participate in the loyalty program, the processing of this personal data is necessary in order to be able to allocate your loyalty points and your points account. The processing of voluntarily provided personal data is based on our legitimate interest, Art. 6 Para. 1 lit. f GDPR. The data is used to improve our offering and advertising that is tailored to your interests. You can object to this processing of your data at any time or, alternatively, simply remove this data from your account.

22. Data Security

We have taken a variety of security measures to protect your personal information. Our servers and databases are protected, among other things, by physical and technical measures.

When collecting and transmitting data via our website, we use standardized SSL encryption technology. Personal data is transmitted as part of the ordering process via SSL encryption, which can be recognized by the lock symbol in the browser and the addition “https://” in the address bar.

With encrypted communication, the payment details you transmit to us cannot be read by third parties. When communicating via email, 100% data security cannot be guaranteed.

23. Changes to this Privacy Policy

We can change this data protection declaration at any time. Any changes to this Privacy Policy will be posted on this website and will automatically take effect 30 days after being posted. We will inform you of any significant changes to this privacy policy by email.