Privacy policy of Pretty Nail Shop 24 GmbH

Thank you for your interest in Pretty Nail Shop 24 GmbH and our online shop jolifin.de. We take the protection of personal data very seriously and always process it in accordance with the applicable data protection regulations, in particular the EU General Data Protection Regulation. With this privacy policy, we would like to inform you in full about the type, scope and purpose of the personal data processed by us and your rights as a data subject.

Controller and general information

Your data will be processed by Pretty Nail Shop 24 GmbH, Bäckerbarg 3 , 22889 Tangstedt, phone 0 41 09 / 25 393 - 0, e-mail: [email protected] (service provider within the meaning of the German Telemedia Act (TMG) and controller within the meaning of the General Data Protection Regulation (GDPR). We also refer to them when we use formulations such as "we" or "us". In this document, "Pretty Nail Shop 24 GmbH" refers to jolifin.de and the various apps, including all subpages, content and functions available there (e.g. internet forums, competitions). Our data protection officer, lawyer Christoph Matthias Beinlich, can be contacted at the address Zur Helling 4, 24143 Kiel and the telephone number (0431) 55685002.

Our services are intended for the general public and not for children. We do not knowingly collect personal data from users who are considered children under the relevant national legislation.

1. Access data and hosting

You can visit our website without providing any personal data.

When you visit our website, the browser used on your device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file. The following information / access data is recorded without any action on your part and stored until it is automatically deleted:

• IP address of the requesting computer,
• Date and time of access,
• Name and URL of the retrieved file,
• Website from which the access was made (referrer URL),
• browser used and, if applicable, the operating system of your computer and the name of your access provider.

This data is processed exclusively for the purpose of ensuring a smooth connection to the website and improving our offer. In accordance with Art. 6 para. 1 sentence 1 lit. f GDPR, this serves to safeguard our legitimate interests in the correct presentation of our website, which are overriding in the context of a balancing of interests. All access data will be deleted no later than seven days after the end of your visit to our website. Under no circumstances do we use the data collected for the purpose of drawing conclusions about your person.

2. Collection and storage of personal data for contract processing and opening a customer account

We collect personal data when you provide us with your data when placing an order, opening a customer account, registering or contacting us via contact form or e-mail. Mandatory fields are always labelled as such, as in these cases we require the data to process the contract, to process your contact or to open a customer account/registration and the order and/or opening of a customer account cannot be completed without this data. Which data is collected in each case can be seen from the respective input forms.

We use the data provided by you in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR for contract processing and processing your enquiries.

After completion of the contract or deletion of your customer account, your data will be restricted for further processing and deleted after expiry of the retention periods under tax and commercial law, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this declaration. Deletion of your customer account is possible at any time and can be done either by sending a message to the contact option described below or via a function provided for this purpose in the customer account.

3. Forwarding of data

In order to fulfil the contract in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR, we pass on your data to the shipping company commissioned with the delivery, insofar as this is necessary for the delivery of ordered goods.

Depending on which payment service provider you select in your order process with us, we will pass on the necessary payment data collected for the processing of payments to the credit institution commissioned with the payment or the payment service provider or selected payment service commissioned by us. In some cases, data is collected by the payment service providers themselves if you create an account with them. In this case, you must log in to the payment service provider with your access data during the ordering process. In this respect, the privacy policy of the respective payment service provider applies.

We use a shipping service provider based in a country outside the European Union. The transfer of personal data to this company only takes place within the scope of the necessity to fulfil the contract.

In addition, we only transfer your personal data to third parties if the transfer is necessary to fulfil our contractual obligations to you and this is clearly carried out with or together with another provider (e.g. in the case of cooperation), if we are otherwise legally entitled or obliged to pass it on, or if you have given us your consent to do so.

In order to provide our services, selected personal data may be shared with certain departments within our company. These include employees in the accounting, product management, marketing and IT departments.

In certain cases, we also use external service providers or affiliated companies that are commissioned by us to process data for us in accordance with our instructions. Such service providers are contractually bound by us as processors in accordance with the strict requirements of the GDPR and may not use your data for any other purposes. The processors we use provide us with the following services in particular Payment service(s), printers, hosting, debt collection / receivables management, lettershop and newsletter dispatch.

The transfer of data to processors takes place on the basis of Art. 28 para. 1 GDPR, alternatively on the basis of our legitimate interest in the economic and technical advantages associated with the use of specialised processors, Art. 6 para. 1 lit. f GDPR.

If we are legally obliged to do so or if this is permitted under data protection law, we transmit personal data to authorities, for example the police or public prosecutor's office (Art. 6 para. 1 lit. c GDPR). This data is passed on on the basis of our legitimate interest in combating misuse, prosecuting criminal offences and securing, asserting and enforcing claims and that your rights and interests in the protection of your personal data do not prevail, Art. 6 para. 1 lit. f GDPR.

4. E-mail advertising

E-mail advertising with registration for the newsletter

If you have registered for our newsletter and have expressly consented in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, we will use your e-mail address or the data you have provided separately for this purpose to send you regular information about our offers. The only mandatory information for sending the newsletter is your e-mail address. The provision of any other data is voluntary and is used to address you personally. We use the so-called double opt-in procedure. This means that we will only send you an e-mail newsletter if you have expressly confirmed to us that you consent to the sending of newsletters. We will then send you a confirmation e-mail asking you to confirm that you wish to receive future newsletters by clicking on a corresponding link. When you register for the newsletter, we store your IP address entered by the Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your e-mail address at a later date. Unsubscribing from the newsletter is possible at any time and can be done either by sending a message to the contact option described below or via a link at the end of each newsletter. After cancellation, we will delete your e-mail address unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this, which is permitted by law and about which we inform you in this declaration.

Email advertising without subscribing to the newsletter and your right to object

If we receive your e-mail address in connection with the sale of a product or service and you have not objected to this, we reserve the right to regularly send you offers for products similar to those you have already purchased from us by e-mail on the basis of Section 7 (3) UWG. This serves to safeguard our legitimate interests, which predominate in the context of a balancing of interests, in a promotional approach to our customers. You can object to this use of your e-mail address at any time by sending a message to the contact option described below or via a link provided for this purpose in the advertising e-mail, without incurring any costs other than the transmission costs according to the basic tariffs.

The newsletter or e-mail advertising is sent as part of processing on our behalf by a service provider to whom we pass on your e-mail address for this purpose.

This service provider is located within a country of the European Union or the European Economic Area.

5. Use of data for payment processing

Identity and credit check when selecting Klarna payment services

In order to be able to offer you Klarna's payment options, we will transmit personal data, such as contact details and order data, to Klarna. This enables Klarna to assess whether you can use the payment options offered via Klarna and to customise the payment options to your needs. You can find general information about Klarna here. Your personal data will be treated by Klarna in accordance with the applicable data protection regulations and in accordance with the information in Klarna's privacy policy.

PayPal

We have integrated the payment option PayPal on our website. PayPal is an online payment service provider of PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg. Payments are processed via so-called PayPal accounts, which are virtual private or business accounts. PayPal also offers the option of processing virtual payments via credit cards if a user does not have a PayPal account. A PayPal account is managed via an e-mail address, which is why there is no classic account number. PayPal makes it possible to initiate online payments to third parties or to receive payments. PayPal also assumes trustee functions and offers buyer protection services. If the data subject selects "PayPal" as a payment option during the ordering process in our online shop, the data of the data subject is automatically transmitted to PayPal. By selecting this payment option, the data subject consents to the transfer of personal data required for payment processing. The personal data transmitted to PayPal is usually first name, surname, address, email address, IP address, telephone number, mobile phone number or other data required for payment processing. Personal data that is necessary for processing the purchase contract is also data that is related to the respective order. The purpose of transmitting the data is to process payments and prevent fraud. We will transmit personal data to PayPal in particular if there is a legitimate interest in the transmission. The personal data exchanged between PayPal and the customer may be transmitted by PayPal to credit agencies. The purpose of this transfer is to check identity and creditworthiness. PayPal may pass on personal data to affiliated companies and service providers or subcontractors if this is necessary to fulfil contractual obligations or if the data is to be processed on our behalf. The data subject has the option to withdraw consent to the handling of personal data from PayPal at any time. A revocation does not affect personal data that must be processed, used or transmitted for (contractual) payment processing. The applicable data protection provisions of PayPal may be retrieved under https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

6. Cookies and web analytics

We use so-called cookies on various pages to make visiting our website attractive and to enable or improve the use of certain functions, to display suitable products or for market research. This serves to safeguard our legitimate interests, which predominate in the context of a balancing of interests, in a needs-based design and statistical evaluation of our offer in accordance with Art. 6 Para. 1 S. 1 lit. f GDPR.

Cookies are small text files that are automatically stored on your end device. Some of the cookies we use are deleted again at the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and enable us to recognise your browser on your next visit (persistent cookies). Information is stored in the cookie that results in each case in connection with the specific end device used. However, this does not mean that we immediately gain knowledge of your identity.

The duration of storage can be found in the overview in the cookie settings of your web browser. You can configure your browser so that no cookies are stored on your computer or so that a message always appears before a new cookie is created. Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings.

However, completely deactivating cookies may mean that you cannot use all the functions of our website.

Use of Google (Universal) Analytics for web analytics

We use Google Analytics, a web analysis service of Google Inc(https://www.google.de/intl/de/about/)(1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter referred to as "Google") for the purpose of designing and continuously optimising our website to meet your needs. This serves to safeguard our legitimate interests, which predominate in the context of a weighing of interests, in an optimised presentation of our offer in accordance with Art. 6 Para. 1 S. 1 lit. f GDPR.

Google (Universal) Analytics uses methods that enable your use of the website to be analysed.

In this context, pseudonymised user profiles are created and cookies (see section 6) are used. The information generated by the cookie about your use of this website, such as

• Browser type/version
• operating system used,
• Referrer URL (the previously visited page),
• Host name of the accessing computer (IP address),
• Time of the server enquiry

are transmitted to a Google server in the USA and stored there. The information is used to analyse the use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage for the purposes of market research and the needs-based design of this website.

By activating IP anonymisation on this website, the IP address is shortened before transmission within the member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. The anonymised IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. The data collected in this context will be deleted after the end of the purpose and use of Google Analytics by us.

Google LLC is headquartered in the USA and is certified under the EU-US Privacy Shield. A current certificate can be viewed here. Based on this agreement between the USA and the European Commission, the latter has established an adequate level of data protection for companies certified under the Privacy Shield.

You can prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: http: //tools.google.com/dlpage/gaoptout?hl=en

As an alternative to the browser plugin, you can click this link to prevent Google Analytics from collecting data on this website in the future. An opt-out cookie will be stored on your end device. If you delete your cookies, you must click the link again.

Further information on data protection in connection with Google Analytics can be found in the Google Analytics help centre(https://support.google.com/analytics/answer/6004245?hl=en).

Address Autocomplete (Google Maps Platform)

When entering addresses (registration, checkout) we use the Places API by Google LLC (USA) to display address suggestions.

Use of Facebook Pixel

Our website uses the visitor action pixel from Facebook, Facebook Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook") to measure conversions.

This allows the behaviour of site visitors to be tracked after they have been redirected to the provider's website by clicking on a Facebook ad. This allows the effectiveness of Facebook ads to be evaluated for statistical and market research purposes and future advertising measures to be optimised.

The data collected is anonymous to us as the operator of this website; we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with the Facebook Data Usage Policy. This enables Facebook to place adverts on Facebook pages and outside of Facebook. This use of the data cannot be influenced by us as the site operator.

You can find further information on protecting your privacy in Facebook's data protection information: https: //www.facebook.com/about/privacy/.

You can also deactivate the remarketing function "Custom Audiences" in the settings for adverts at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be logged in to Facebook to do this.

If you do not have a Facebook account, you can deactivate usage-based advertising from Facebook on the website of the European Interactive Digital Advertising Alliance: http: //www.youronlinechoices.com/de/praferenzmanagement/.

7. Adroll

With AdRoll, our partner for display adverts, we can then present you with retargeting adverts on other websites according to your previous interaction on jolifin.de. The technologies used by our partners do not collect any personal data such as name, e-mail address, postal address or telephone number. This is retargeting, i.e. the delivery of interest-based advertising on other advertising spaces outside our offer. After visiting our website, this application can be used to show you adverts for the services/products previously viewed on our website when you visit other websites. The cookie stored in your browser is used to recognise you. This allows AdRoll to recognise your interest in certain products based on your previous visit to our website and use this information to display targeted advertising on other websites.

The purpose of this use is to provide you with interest-based advertising and to advertise our products in a targeted manner. We have concluded standard contractual clauses with Adroll, as the provider is based in the USA. The legal basis for the storage of cookies is the consent given (Art. 6 para. 1 sentence 1 lit. a GDPR). The further analysis of the collected data over a period of up to two years is based on Art. 6 para. 1 sentence 1 lit. f GDPR. You can unsubscribe from targeted advertising by AdRoll and its partners on this page.

8. etracker

The provider of this website uses services from etracker GmbH in Hamburg, Germany (www.etracker.com) to analyze usage data. The etracker consent manager module is used for consent management. The etracker tag manager module can be used to integrate script codes from other tools. When used in combination, the etracker tag manager and consent manager enable the control of certain cookies and services with the appropriate consent. Even if statistical cookies are rejected, usage data is collected in accordance with the legal requirements of the EU General Data Protection Regulation (EU GDPR) and the Telecommunications Digital Services Data Protection Act (TDDDG). Data processing is carried out on the basis of the legal provisions of Art. 6 (1) lit. f (legitimate interest) of the EU GDPR. Our concern within the meaning of the EU GDPR (legitimate interest) is the optimization of our online offering and the legally compliant integration and administration of additional services on our website. Provided that consent has been given, other technologies are used on the basis of Art. 6 (1) (a) of the EU GDPR. Consent can be revoked at any time.

The web analysis data generated by etracker is processed and stored exclusively in Germany on behalf of the provider of this website and is therefore subject to strict German and European data protection laws and standards. etracker has been independently audited, certified, and awarded the ePrivacyseal data protection seal of approval. As the privacy of our visitors is important to us, data that could potentially be linked to an individual, such as IP addresses, login IDs, or device IDs, is anonymized or pseudonymized as soon as possible. It is not used for any other purpose, combined with other data, or passed on to third parties.

You can object to the data processing described above at any time by clicking on the slider. Objecting will not have any negative consequences. If no slider is displayed, data collection has already been prevented by other blocking measures.

Further information on data protection at etracker can be found here.

9. Advertising via marketing networks

Google AdWords Remarketing

We use Google AdWords to advertise this website in Google search results and on third-party websites. For this purpose, the so-called remarketing cookie is set by Google when you visit our website, which automatically enables interest-based advertising by means of a pseudonymous cookie ID and on the basis of the pages you visit. This serves to safeguard our legitimate interests, which predominate in the context of a balancing of interests, in the optimal marketing of our website in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR. After the end of the purpose and the end of the use of Google AdWords Remarketing by us, the data collected in this context will be deleted.

Any further data processing will only take place if you have consented to Google linking your web and app browsing history to your Google account and using information from your Google account to personalise ads that you see on the web. In this case, if you are logged in to Google while visiting our website, Google will use your data together with Google Analytics data to create and define target group lists for cross-device remarketing. For this purpose, Google temporarily links your personal data with Google Analytics data to create target groups.

Google AdWords Remarketing is an offer from Google LLC (www.google.de). Google LLC is headquartered in the USA and is certified under the EU-US Privacy Shield. A current certificate can be viewed here. Based on this agreement between the USA and the European Commission, the latter has established an adequate level of data protection for companies certified under the Privacy Shield.

You can deactivate the remarketing cookie via this link. You can also obtain information from the Digital Advertising Alliance about the setting of cookies and make settings for this.

For information on how Google uses personal data, see Business Data Responsibility.

OpenAI Ads (advertising in ChatGPT)

With your consent, we use the OpenAI pixel to measure the effectiveness of our ads in ChatGPT and to optimise our advertising campaigns. This sets cookies and transmits information about your use of our shop and your purchases to OpenAI. The cookies __oppref and __obref expire after 30 and 365 days respectively.

The legal bases are Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act) and Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via our cookie settings.

Data may be transferred to the USA during processing. For more information, please refer to OpenAI's privacy policy.

10. Social media plug-ins

We do not use any social media plug-ins within the website visit.

11. Data security

We use the widespread SSL (Secure Socket Layer) method in conjunction with the highest level of encryption supported by your browser when you visit our website. As a rule, this is 256-bit encryption. You can recognise whether an individual page of our website is transmitted in encrypted form by the closed display of the key or lock symbol in the lower status bar of your browser.

We also use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

12. Contact details and data subject rights

As a data subject, you have the following rights:

• in accordance with Art. 15 GDPR, the right to receive information from us free of charge at any time as to whether personal data relating to you is processed by us and also specifically which data is stored about you and can request a copy of the stored data;
• in accordance with Art. 16 GDPR, the right to demand the immediate correction of incorrect or incomplete personal data stored by us
• in accordance with Art. 17 GDPR, the right to request the erasure of your personal data stored by us, unless further processing is required
  • to exercise the right to freedom of expression and information
  • for the fulfilment of a legal obligation;
  • for reasons of public interest or
  • for the establishment, exercise or defence of legal claims
  is necessary. Please note that there are statutory retention obligations and that we are therefore not always permitted to delete your data completely. In this case, your data will be marked with the aim of restricting its future processing
• in accordance with Art. 18 GDPR, the right to request the restriction of the processing of your personal data, insofar as
  • the accuracy of the data is contested by you
  • the processing is unlawful, but you oppose the erasure of the data
  • we no longer need the data, but you need it for the establishment, exercise or defence of legal claims; or
  • You have objected to the processing pursuant to Art. 21 GDPR;
• in accordance with Art. 20 GDPR, the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another controller
• in accordance with Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters.

If you have any questions regarding the collection, processing or use of your personal data, for information, correction, blocking or deletion of data as well as revocation of any consent given or objection to a specific use of data, please contact our data protection officer, Christoph Matthias Beinlich, lawyer, Zur Helling 4, 24143 Kiel, Tel (0431) 55685002.

Right to object

If we process your personal data to protect our legitimate interests, which outweigh your interests, as explained above, you can object to this processing with effect for the future.

If the processing is carried out for direct marketing purposes, you can exercise this right at any time as described above. If the processing is carried out for other purposes, you only have the right to object if there are grounds relating to your particular situation.

After exercising your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

This does not apply if the processing is for direct marketing purposes. In this case, we will no longer process your personal data for this purpose.

If you would like to exercise your right to object, simply send an email to [email protected]

13. Up-to-dateness and amendment of this privacy policy

This privacy policy is currently valid and was last updated in May 2018.

It may become necessary to amend this privacy policy as a result of the further development of our website and services or due to changes in legal or official requirements. You can access and print out the current privacy policy at any time on the website.