Privacy policy

Privacy Policy

 

1. Introduction and Contact Details of the Controller

1.1 Introduction

We are delighted to welcome you to the CallistaÉVA website and thank you for your interest in our brand. Protecting your personal data is a priority for us, and we aim to handle it responsibly and transparently. This Privacy Policy explains how your personal data is collected, processed, and used when you visit our website.

Personal data refers to any information that can personally identify you, such as your name, email address, or IP address. For a comprehensive understanding of how we manage your personal information, please read the full Privacy Policy below.

 

1.2 General Information on Data Collection

Who is responsible for data collection on this website?

The processing of personal data on this website is carried out by CallistaÉVA. You can find the contact details of the responsible body in the "Contact Information" section of this Privacy Policy.

How do we collect your data?

• Direct Collection: Your data is collected when you voluntarily provide it to us, for example, by filling out a contact form, subscribing to a newsletter, or placing an order.
• Automatic Collection: When you visit our website, certain technical data is automatically collected by our IT systems. This includes, but is not limited to, information such as your browser type, operating system, IP address, and time of page access.

What do we use your data for?

We collect your data for the following purposes:

• To ensure the website is delivered without technical errors.
• To analyze user behavior and improve our website's functionality and user experience.
• To process inquiries, orders, or any communication initiated by you.

 

What rights do you have regarding your data?

As a user, you have the following rights regarding your personal data:

• Access: Request information about the origin, recipients, and purpose of your stored data.
• Correction: Request the correction of inaccurate or incomplete data.
• Deletion: Request the deletion of your data unless legal obligations require its retention.
• Revocation: Withdraw your consent to data processing at any time for future activities.
• Restriction: Under certain conditions, request the restriction of processing your data.
• Complaint: File a complaint with the relevant supervisory authority if you believe your data is being misused.

For any questions related to your data or to exercise your rights, you can contact us at the details provided in the "Contact Information" section below.

1.3 Analysis Tools and Third-Party Tools

When you visit the CallistaÉVA website, your browsing behavior may be analyzed for statistical purposes. This analysis is typically carried out using tools such as cookies or analytics programs. Detailed information about the tools we use for analysis can be found in later sections of this Privacy Policy.

 

2. Hosting

Website Hosting with Shopify

Our website is hosted on the Shopify platform, provided by Shopify International Limited, located at Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter referred to as “Shopify”).

Shopify enables us to build, host, and manage our online store efficiently. When you visit the CallistaÉVA website, Shopify collects certain technical data, such as:

• Your IP address
• Information about your browser type and device
• Data related to user behavior, visitor statistics, and sources of traffic

If you make a purchase through our website, Shopify processes additional personal data, including:

• Your name
• Email address
• Shipping and billing addresses
• Payment details
• Contact information such as your phone number
• Information about your purchase, such as order details and transaction value

To ensure smooth operation and analysis, Shopify may also store cookies in your browser. These cookies help monitor user activity and improve your shopping experience on our website.

Legal Basis

The use of Shopify is based on our legitimate interest (Article 6(1)(f) GDPR) in providing a secure, reliable, and high-performing website for our customers. If you provide consent (e.g., to cookies or tracking tools), the processing of your data will occur exclusively under Article 6(1)(a) GDPR and § 25 TTDSG (for cookies and similar technologies, such as device fingerprinting). You can withdraw this consent at any time.

For more information about Shopify’s data protection practices, please refer to their Privacy Policy: https://www.shopify.com/legal/privacy.

 

3. Cookies

To make your visit to our website as pleasant as possible and to enable the use of certain features, we use cookies. Cookies are small text files that are stored on your device. Some of these cookies are automatically deleted when you close your browser (session cookies), while others remain on your device for a longer period and allow us to save specific settings (persistent cookies). You can view the storage duration of persistent cookies in the settings section of your web browser.

As we use Shopify to host and manage our website, some cookies are provided and managed directly by Shopify. These cookies help ensure the proper functionality of our store, analyze website traffic, and enhance your shopping experience.

Where cookies process personal data, this processing occurs based on:

• Article 6(1)(b) GDPR: For the performance of a contract or pre-contractual measures
• Article 6(1)(a) GDPR: When you have provided consent
• Article 6(1)(f) GDPR: To safeguard our legitimate interest in offering a functional, user-friendly, and efficient website

You can configure your web browser to:

• Notify you when cookies are set
• Decide individually whether to accept cookies
• Block cookies in specific cases or generally

Please note that if you choose not to accept cookies, the functionality of our website may be limited.

For more information about Shopify cookies, you can refer to their Cookie Policy: https://www.shopify.com/legal/cookies.

 

 

4) Collection of Reviews and Customer Feedback

To ensure transparency, customer satisfaction, and continuous improvement of our products and services, we use external review platforms such as ShopVote and Trustpilot to collect verified customer feedback.

Purpose of Data Processing:
When you make a purchase on our website, we may send you an invitation to provide a review through these platforms. This enables us to evaluate and display feedback about our products and services to potential customers and improve their shopping experience.

Legal Basis:
The processing of your data for collecting reviews is based on Art. 6 (1) (f) GDPR, as it is in our legitimate interest to ensure transparency, enhance customer satisfaction, and promote trust in our brand. If you provide consent to receive review invitations, the legal basis is Art. 6 (1) (a) GDPR. You can revoke your consent at any time.

Data Processed:
The following data may be transmitted to the respective review platforms:

• Your name or initials (optional)
• Email address
• Order information (e.g., order ID, purchased products)
• Your feedback or review text

Third-Party Providers:
The data is processed and stored by the following external providers:

• ShopVote:
  Betreiber: Blickreif GmbH & Co. KG, Schulstraße 46, 80634 München, Deutschland.
  Data protection information: https://www.shopvote.de/datenschutz.
• Trustpilot:
  Betreiber: Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen, Denmark.
  Data protection information: https://legal.trustpilot.com/for-reviewers/end-user-privacy-terms.

Your Rights:
You have the right to object to the processing of your data for review collection purposes at any time. Please contact us via the details provided in this privacy policy if you wish to exercise your rights.

 

4.2 WhatsApp-Business

We offer visitors to our website the option to contact us via the messaging service WhatsApp Business, provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

When you contact us via WhatsApp in connection with a specific business matter (e.g., an order), we process your mobile phone number and, if provided, your first and last name in accordance with Art. 6 (1) (b) GDPR to handle and respond to your request. For general inquiries, this data is processed under Art. 6 (1) (f) GDPR, based on our legitimate interest in providing efficient and timely customer communication.

Data will only be used to address your query and will not be shared with third parties.

Please note that WhatsApp gains access to the address book of the device used for our WhatsApp Business account and may transfer contact details to servers of Meta Platforms Inc. in the USA. To ensure data compliance, only contact details of users who have initiated contact with us via WhatsApp are stored in our address book.

WhatsApp's Data Privacy Policy provides further details on data processing and your rights: https://www.whatsapp.com/legal/?eea=1#privacy-policy.

Data transfers to the USA are conducted under the EU-US Data Privacy Framework, ensuring compliance with European data protection standards.

 

4.3 Contact via Contact Form

When you contact us through our contact form (or by email), we process your personal data exclusively for the purpose of addressing and responding to your inquiry, and only to the extent necessary for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6 (1) (f) GDPR. If your contact is related to a contract or potential contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR.

 

4.4 Contact via Other Means

If you contact us through any other means (e.g., phone, social media, or messaging apps), we will process your personal data solely for the purpose of addressing and responding to your inquiry. The legal basis for processing is our legitimate interest in providing a timely and effective response to your request in accordance with Art. 6 (1) (f) GDPR.

 

4.5. Newsletters

If you wish to receive the newsletter offered on our website, we require your email address along with confirmation that you are the owner of the email address and consent to receiving the newsletter. No additional data is collected, or it is only collected voluntarily. We use this information solely for sending the requested newsletter and do not share it with third parties.

The processing of the data provided during newsletter registration is based solely on your consent (Art. 6 Para. 1 lit. a GDPR). You can withdraw your consent at any time, for example, by using the "unsubscribe" link in the newsletter. Withdrawal does not affect the legality of any data processing carried out before the withdrawal.

The data you provide for newsletter subscription will be stored by us or the newsletter service provider until you unsubscribe. Once you unsubscribe or the data no longer serves the purpose, it will be deleted from our distribution list. We reserve the right to remove or block email addresses from our distribution list within the scope of our legitimate interest in accordance with Art. 6 Para. 1 lit. f GDPR.

Data stored for other purposes will remain unaffected.

After unsubscribing, your email address may be stored in a blacklist by us or the newsletter service provider to prevent future mailings. This data will only be used for that purpose and will not be merged with other data. The storage of your email address in the blacklist serves both your interests and ours, ensuring compliance with legal requirements for sending newsletters. This storage is indefinite unless you object, in which case your interests may override our legitimate interests.

 

4.6 Klaviyo – Email Marketing

We use Klaviyo (225 Franklin St, Boston, MA 02110, USA) to send our email newsletters.

Based on our legitimate interest in effective and user-friendly newsletter marketing, we share the data you provide during newsletter registration with Klaviyo, in accordance with Art. 6 Para. 1 lit. f GDPR, to enable them to send newsletters on our behalf.

With your explicit consent (Art. 6 Para. 1 lit. a GDPR), Klaviyo also conducts statistical evaluations of our newsletter campaigns using web beacons or tracking pixels embedded in the emails. These technologies allow Klaviyo to measure open rates and interactions with the newsletter's content. Additionally, device information (such as the time of access, IP address, browser type, and operating system) is collected and analyzed, but this data is not merged with other personal information.

You can withdraw your consent for newsletter tracking at any time with effect for the future.

We have signed a data processing agreement with Klaviyo to ensure the protection of your data and to prohibit the sharing of data with third parties.

For data transfers to the USA, Klaviyo has joined the EU-US Data Privacy Framework, which ensures compliance with European data protection standards based on the European Commission's adequacy decision.

 

4.7 Sending of Email Newsletter to Existing Customers

If you have provided us with your email address when purchasing goods or services, we reserve the right to send you regular offers for similar products or services from our range via email. For this type of marketing, no separate consent is required under Section 7 (3) UWG. The data processing is based on our legitimate interest in personalized direct marketing according to Art. 6 (1) lit. f GDPR. If you initially objected to the use of your email address for this purpose, no emails will be sent from us.

You have the right to object to the use of your email address for this marketing purpose at any time, with effect for the future, by notifying the controller mentioned above. Only basic transmission costs according to the standard rates will apply. Upon receipt of your objection, the use of your email address for marketing purposes will be immediately stopped.

 

 

 

5) Data Processing Upon Opening a Customer Account

In accordance with Art. 6 Para. 1 lit. b GDPR, personal data will be collected and processed to the necessary extent when you provide this information during the opening of a customer account. The data required for account creation can be found in the input fields of the respective form on our website.

You can delete your customer account at any time by sending a request to the contact address provided above. After the deletion of your account, your data will be erased, provided that all contracts concluded via the account have been fully settled, no statutory retention periods oppose this, and we have no legitimate interest in retaining the data any longer.

 

6) Product Availability Notification via Email

If a product is temporarily out of stock, you can sign up to receive an email notification when it becomes available again. To send you this notification, we will only need your email address. Providing additional information is voluntary and may be used to personalize our communication with you.

We use the Single Opt-In method for this service. After you provide your email address, you will immediately be added to the notification list, and we will send you a one-time email notification when the product becomes available.

By subscribing, you consent to the processing of your personal data, including your email address, to receive this notification as described in Article 6(1)(a) of the GDPR. We also collect your IP address, the date, and time of your subscription to prevent misuse of your email address in the future.

You can unsubscribe from the product availability notifications at any time by sending a request to the contact address provided. Once you unsubscribe, your email address will be promptly removed from the notification list unless you have explicitly consented to the further use of your data for other purposes.

** The Single Opt-In method refers to a process where a user only needs to enter their email address to subscribe to a service (such as product availability notifications or a newsletter). After submitting their email address, they are immediately added to the relevant mailing list, and they will receive an email notification or newsletter without needing to confirm their subscription via a follow-up email or link.

 

7) Direct Mail Advertising

Based on our legitimate interest in personalized direct marketing, we reserve the right to store and use your first and last name, mailing address, and—if provided during the course of our contractual relationship—your title, academic degree, year of birth, and professional, industry, or business designation, in accordance with Article 6, Paragraph 1, Letter f of the GDPR. We may use this information to send you relevant offers and information about our products via postal mail.

You have the right to object to the storage and use of your personal data for this purpose at any time by contacting us. If you choose to exercise this right, we will promptly cease sending you such promotional materials.

 

8. Data Processing for Order Fulfillment

8.1 Transmission of Data for Delivery and Payment Purposes
To process your order, including delivery and payment, we will share the personal data we collect with the necessary parties, such as the delivery service provider and payment institution, in accordance with Article 6, Paragraph 1, Letter b of the GDPR.

If, based on an agreement, we owe you updates for goods with digital elements or digital products, we will process the contact data you provided during the order (name, address, email) to fulfill our legal obligation to inform you about upcoming updates. This will be done via appropriate communication channels (such as email or postal mail) within the legally prescribed period. Your contact data will only be used for the purpose of informing you about these updates and will only be processed as necessary for this purpose.

In order to fulfill your order, we work with service providers who assist us, either fully or partially, in carrying out the contracts. We will share certain personal data with these service providers as outlined in the following sections.

 

Shopify Payments

We use Shopify Payments as our primary payment provider. When you make a purchase, your payment information (including billing details and transaction information) is processed directly through Shopify Payments. This service is fully integrated into our website and allows you to pay securely via credit card, debit card, and other available payment methods. The processing of your data during payment is carried out in compliance with the relevant legal provisions and Shopify’s privacy policies.

Your payment information will only be used for processing the payment and completing your order, and we do not store any sensitive payment data on our servers.

If you choose to pay using a payment method provided by Shopify Payments, your data will be shared with Shopify solely for the purpose of completing the transaction and fulfilling your order.

 

The provider of this payment service in the EU is Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter "Shopify Payment").

Details can be found in Shopify Payment's privacy policy: https://www.shopify.de/legal/datenschutz .

 

PayPal
When using PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg) as a payment method, we will transmit your payment information (including name, address, bank or card details, currency, and transaction number) to PayPal for payment processing in accordance with Article 6, Paragraph 1, Letter b of the GDPR. This data will only be shared to the extent necessary to process the payment.

 

Apple Pay

The payment service provider is Apple Inc., Infinite Loop, Cupertino, CA 95014, USA. You can find Apple's privacy policy at: https://www.apple.com/legal/privacy/de-ww/ .

Google Pay

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You can find Google's privacy policy here: https://policies.google.com/privacy .

Stripe

The provider for customers within the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter "Stripe").

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://stripe.com/de/privacy and https://stripe.com/de/guides/general-data-protection-regulation .

You can read more about this in Stripe's data protection declaration under the following link: https://stripe.com/de/privacy .

 

Mastercard

The provider of this payment service is Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium (hereinafter "Mastercard").

Mastercard may transfer data to its parent company in the United States. Data transmission to the USA is based on Mastercard's Binding Corporate Rules. Details can be found here: https://www.mastercard.de/de-de/datenschutz.html and https://www.mastercard.us/content/dam/mccom/global/documents/mastercard-bcrs.pdf .

VISA

The provider of this payment service is Visa Europe Services Inc., London Branch, 1 Sheldon Square, London W2 6TT, United Kingdom (hereinafter “VISA”).

Great Britain is regarded as a safe third country under data protection law. This means that Great Britain has a data protection level that corresponds to the data protection level in the European Union.

VISA may transfer data to its parent company in the United States. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.visa.de/bedingungen/visa-globale-datenschutzmitteilung/mitteilung-zu-srechtigkeitsfragen-fur-den-ewr.html .

For more information, see VISA's privacy policy: https://www.visa.de/bedingungen/visa-privacy-center.html .

 

Payment via Sofort

For payments made through Sofort GmbH (Theresienhöhe 12, 80339 Munich), we offer the "Sofortüberweisung" payment method. With this service, we receive a real-time payment confirmation from Sofort GmbH, enabling us to immediately begin processing and fulfilling your order.

If you choose the "Sofortüberweisung" payment method, you will be required to send your PIN and a valid TAN to Sofort GmbH, allowing them to log into your online banking account. Upon logging in, Sofort GmbH automatically checks your account balance and completes the transfer to us using the TAN you provided. A transaction confirmation will then be sent to us instantly.

During this process, Sofort GmbH also checks your account details, including sales, credit limits, overdraft facilities, and other account balances. Along with the PIN and TAN, your personal data—such as your first and last name, address, phone numbers, email address, IP address, and any other data necessary for payment processing—will be transmitted to Sofort GmbH. This data transmission is essential to verify your identity and to prevent fraudulent activities.

For more information on payment with Sofortüberweisung, please refer to Sofort GmbH's privacy policy: Sofort Privacy Policy and Klarna's Sofort service: Klarna Sofort.

 

 

Use of Payment Service Providers (Payment Services)

For payments made through third-party payment providers, such as  for example Mollie B.V. (Keizersgracht 313, 1016 EE Amsterdam, Netherlands), we will share the payment information you provide during checkout (including name, address, bank and card details, currency, and transaction number) with the payment provider, in accordance with Article 6, Paragraph 1, Letter b of the GDPR. This data sharing is necessary solely for payment processing purposes and will only involve the data required for this purpose.

 

In the cases or events, If we are required to make a pre-payment for your order, we may request additional personal information from you (such as first and last name, street, house number, postal code, city, date of birth, email address, phone number, or details of an alternative payment method). For our legitimate interest in verifying your creditworthiness, we may share these details with the payment provider to perform a credit check in accordance with Article 6, Paragraph 1, Letter f of the GDPR. The provider will evaluate your data, including order details and payment history, to assess whether the chosen payment option is feasible in terms of payment and/or credit risk.

This credit check may include probability values (so-called score values). These values are generated using a scientifically recognized mathematical-statistical method, which includes factors like address data.

 

You have the right to object to the processing of your data for credit checking purposes by contacting us or the payment provider. However, the provider may still process your data if it is necessary for fulfilling the payment contract.

8.2 Data Sharing with Collection Agencies
If payment for an order is not made despite prior reminders, we reserve the right to pass your data to a collection agency (such as twenty4collect GmbH, In den Weiden 9, 56729 Weiler, Germany). In this case, the outstanding payment will be directly collected by the agency.

The transfer of your data is carried out for the fulfillment of the contract in accordance with Article 6, Paragraph 1, Letter b of the GDPR and to safeguard our legitimate interests in effectively pursuing and enforcing our payment claims in accordance with Article 6, Paragraph 1, Letter f of the GDPR.

 

9) General Information and Mandatory Information on Data Protection

At CallistaÉVA Cosmetics and Lifestyle UG (haftungsbeschränkt), we take the protection of your personal data very seriously. We treat your personal information confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data refers to information that can be used to personally identify you. This privacy policy explains what data we collect and how we use it. It also outlines how and for what purposes this data is collected and processed.

Please note that data transmission over the internet (e.g., when communicating via email) may have security gaps. Complete protection of your data against unauthorized access by third parties is not guaranteed.

 

Information on the Responsible Party

The responsible party for data processing on this website is:

 

CallistaÉVA Cosmetics and Lifestyle UG (haftungsbeschränkt)

Bornheimer Straße 127,

53119, Bonn, Germany

Email: hello@callistaevacosmetics.com

The responsible party is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g., names, email addresses, etc.).

 

Data Storage Duration and Legal Basis for Data Processing

At CallistaÉVA Cosmetics and Lifestyle UG (haftungsbeschränkt), we are committed to protecting your personal data and will retain it only for as long as necessary to fulfill the purposes for which it was collected. If no specific retention period is mentioned in this privacy policy, your personal data will be kept until the purpose for processing is no longer relevant. However, if you request the deletion of your data or withdraw your consent for processing, we will remove your data unless there are other legal reasons requiring its retention, such as obligations under tax or commercial law. In such cases, your data will be deleted once these obligations are no longer applicable.

Legal Basis for Data Processing

We process your personal data in compliance with the General Data Protection Regulation (GDPR) on the following legal bases:

1. Consent: If you have provided explicit consent for data processing, we will process your personal data under Article 6(1)(a) GDPR or, where applicable, Article 9(2)(a) GDPR (for sensitive data). You can withdraw your consent at any time. For cookie storage or accessing information on your device, the legal basis is Article 25(1) of the German Telecommunications-Telemedia Data Protection Act (TTDSG).
2. Contractual Necessity: If processing is necessary for the fulfillment of a contract or to carry out pre-contractual measures, we will process your data in accordance with Article 6(1)(b) GDPR.
3. Legal Obligation: If processing is required to comply with a legal obligation, we process your data under Article 6(1)(c) GDPR.
4. Legitimate Interest: In some cases, we process your data based on our legitimate interests in accordance with Article 6(1)(f) GDPR. This includes activities where our business interests align with ensuring the smooth operation of our services, customer support, and marketing activities, among others.

Please refer to the specific sections of this privacy policy for further details on how and why your data is processed, as well as your rights in relation to your personal data.

 

Data Transfer to the USA and Other Third Countries

As part of the services we use at CallistaÉVA Cosmetics and Lifestyle UG (haftungsbeschränkt), certain tools from companies based in the USA or other countries outside of the European Union are employed. These countries may not provide the same level of data protection as is required under EU law. If such tools are active, your personal data could be transferred to and processed in these third countries.

It is important to note that in some cases, companies based in these countries, such as the USA, may be required to disclose personal data to government authorities without your consent or the ability to contest such actions. As a result, there is a possibility that your data could be accessed, monitored, or stored by foreign government agencies, including intelligence services, for purposes such as surveillance. Unfortunately, we do not have control over these potential data processing activities.

Revocation of Consent to Data Processing

In many instances, we rely on your explicit consent to process your personal data. You have the right to withdraw any consent you have previously given for the processing of your personal data at any time. The withdrawal of consent will not affect the lawfulness of any processing carried out before the withdrawal.

If you wish to revoke your consent or have any concerns regarding the processing of your personal data, please feel free to contact us.

 

Right to Object to Data Collection in Special Cases and to Direct Advertising (Art. 21 GDPR)

 

You have the right to object to the processing of your personal data in specific situations, especially when the processing is based on Article 6, Paragraph 1, Letters (e) or (f) of the GDPR, which includes profiling based on these provisions. If you have concerns regarding the way your data is being processed, you can object at any time. Once we receive your objection, we will stop processing your personal data, unless we can demonstrate compelling legitimate reasons that override your interests, rights, and freedoms.

If your personal data is being used for direct marketing purposes, you have the right to object at any time. If you object, we will cease using your data for such purposes. This applies even to profiling related to direct marketing.

Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data is in violation of the GDPR, you have the right to lodge a complaint with a supervisory authority. You can file the complaint in the EU country of your habitual residence, place of work, or where the alleged violation occurred. This right to complain does not affect any other legal remedies you may have available.

Objecting to Promotional Emails

We strongly object to the use of contact data, which is published as part of the legal imprint, for sending unsolicited advertising and promotional materials. We reserve the right to take legal action against any form of unsolicited advertising, including spam emails.

 

Right to Data Portability

You have the right to request that the personal data we process based on your consent or to fulfill a contract be provided to you or to a third party in a commonly used, machine-readable format. If technically feasible, you can request that we directly transfer your data to another responsible party.

Right to Information, Deletion, and Correction

You have the right to request information about your stored personal data at any time, including its origin, recipient, and the purpose of processing. If necessary, you also have the right to request corrections or deletions of your data. Please feel free to contact us if you have any questions regarding your personal data.

Right to Restriction of Processing

You can request the restriction of the processing of your personal data in certain circumstances. These include situations where the accuracy of your data is disputed, the processing is unlawful, or if you need the data to assert legal claims, even if we no longer need it. Additionally, if you have filed an objection to processing, you have the right to request that the processing be restricted until it is determined whose interests prevail.

SSL or TLS Encryption

To ensure the security of your personal data, especially when processing confidential content like orders or inquiries, our website uses SSL or TLS encryption. You can identify an encrypted connection by the “https://” prefix in the browser address bar and the padlock symbol, indicating that your transmitted data is protected from unauthorized access.

Encrypted Payment Transactions

For payment transactions (e.g., via Visa/MasterCard or direct debit), we use encrypted SSL or TLS connections to ensure the protection of your payment details. You can recognize this secure connection by the “https://” in the browser’s address bar and the padlock icon. With encrypted communication, your payment information is securely transmitted and cannot be read by third parties.

10) Use of Web Analytics and Tracking Services

 

Google Tag Manager

This website uses the "Google Tag Manager" service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Tag Manager acts as a technical foundation for managing and controlling various web applications, including tracking and analytics services, through a unified interface. It does not collect or read information from user devices, nor does it conduct independent data analysis. However, when the page is accessed, your IP address may be transferred to Google, where it may be stored. There is also the possibility of transferring this data to Google LLC servers in the USA.

This processing only takes place if you have explicitly consented to it, according to Art. 6 Abs. 1 lit. a GDPR. Without your consent, the use of Google Tag Manager will be prevented during your website visit. You can revoke your consent at any time in the future by disabling the service via the "Cookie Consent Tool" provided on the website.

We have signed a Data Processing Agreement with the provider, ensuring the protection of our website visitors' data and prohibiting unauthorized third-party access. For data transfers to the USA, the provider is part of the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection under an adequacy decision by the European Commission.

Hotjar

This website uses the web analytics service from Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta.

Hotjar uses cookies and/or similar technologies (tracking pixels, web beacons, algorithms to read device and browser information) to collect and store pseudonymized visitor data. This includes information such as the IP address and browser details of the device used, which are analyzed for statistical purposes regarding website usage behavior. This helps create pseudonymized user profiles. One of the features includes heatmap analysis, showing patterns of page visits, interaction with content (such as typing, scrolling, clicks, and mouse-overs). Pseudonymization ensures that a direct identification of individuals is generally excluded. No connection is made with any other personally identifiable data.

All of the above-mentioned processing activities, especially reading or storing information on the device used, will only occur if you have given us explicit consent, according to Art. 6 Abs. 1 lit. a GDPR. You can revoke your consent at any time by deactivating the service in the "Cookie Consent Tool" available on the website.

We have entered into a Data Processing Agreement with Hotjar to ensure the protection of our visitors' data and to prevent unauthorized disclosure to third parties.

11) Tools and Other Services

DATEV

To manage our accounting, CallistaÉVA Cosmetics and Lifestyle UG (haftungsbeschränkt) utilizes the cloud-based accounting software service of the following provider: DATEV eG, Paumgartnerstr. 6-14, 90429 Nürnberg, Germany.

The provider processes incoming and outgoing invoices, as well as, if applicable, the company’s bank transactions, to automatically capture invoices, match them to transactions, and create financial accounting in a semi-automated process.

If personal data is processed during this, the processing is carried out in accordance with Art. 6 Para. 1 lit. f GDPR, based on our legitimate interest in the efficient organization and documentation of our business operations.

CallistaÉVA Cosmetics and Lifestyle UG (haftungsbeschränkt) MAY UTILIZE VARIOUS THIRD-PARTY TOOLS AND SERVICES TO SUPPORT OUR OPERATIONS, SUCH AS FOR ACCOUNTING, CUSTOMER SERVICE, DOCUMENT MANAGEMENT, MARKETING, AND ANALYTICS. THESE SERVICES MAY PROCESS PERSONAL DATA IN THE COURSE OF THEIR FUNCTIONS. THE PROCESSING OF PERSONAL DATA THROUGH THESE TOOLS IS CARRIED OUT IN ACCORDANCE WITH APPLICABLE DATA PROTECTION LAWS AND IS BASED ON OUR LEGITIMATE INTEREST IN IMPROVING OPERATIONAL EFFICIENCY, PROVIDING SERVICES, AND ENSURING COMPLIANCE WITH LEGAL OBLIGATIONS.

WE ENSURE THAT ANY THIRD-PARTY SERVICE PROVIDERS WITH WHOM WE ENGAGE ARE COMPLIANT WITH THE GDPR, AND WE HAVE ENTERED INTO DATA PROCESSING AGREEMENTS TO PROTECT YOUR PERSONAL DATA AND PREVENT UNAUTHORIZED DISCLOSURE.

 

 

12) RIGHTS OF THE DATA SUBJECT

THE APPLICABLE DATA PROTECTION LAW GRANTS YOU THE FOLLOWING RIGHTS WITH RESPECT TO THE PROCESSING OF YOUR PERSONAL DATA BY THE CONTROLLER (RIGHTS OF ACCESS AND INTERVENTION), WITH REFERENCE TO THE LEGAL BASIS PROVIDED FOR THE EXERCISE OF EACH RIGHT:

RIGHT OF ACCESS UNDER ART. 15 GDPR;
RIGHT TO RECTIFICATION UNDER ART. 16 GDPR;
RIGHT TO ERASURE UNDER ART. 17 GDPR;
RIGHT TO RESTRICT PROCESSING UNDER ART. 18 GDPR;
RIGHT TO NOTIFICATION UNDER ART. 19 GDPR;
RIGHT TO DATA PORTABILITY UNDER ART. 20 GDPR;
RIGHT TO WITHDRAW CONSENT UNDER ART. 7(3) GDPR;
RIGHT TO LODGE A COMPLAINT UNDER ART. 77 GDPR.

13) Right to object

if we process your personal data based on our legitimate interests, you have the right to object to such processing at any time, for reasons related to your particular situation, with future effect.

if you exercise your right to object, we will cease processing your data. however, we may continue the processing if we can demonstrate compelling legitimate grounds for the processing that override your rights and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.

 

14) Duration of Storage of Personal Data

Personal data will be stored as long as necessary based on the legal basis, processing purpose, and applicable retention periods.

·       Consent-based processing (Art. 6(1)(a) GDPR): Data will be stored until you withdraw consent.

·       Contractual obligation (Art. 6(1)(b) GDPR): Data will be stored until the retention period expires, unless needed for contract fulfillment or a legitimate interest.

·       Legitimate interest processing (Art. 6(1)(f) GDPR): Data will be stored until you object, unless we can prove overriding legitimate reasons for processing.

·       Direct marketing (Art. 6(1)(f) GDPR): Data will be stored until you object to processing.

·       Other cases: Data will be deleted when no longer needed for the purposes they were collected.

 

if we process your personal data for direct marketing purposes, you have the right to object to this processing at any time. you can exercise this right as described above.

if you exercise your right to object, we will stop processing your data for direct marketing purposes.