PRIVACYPOLICY

Controller

The controller responsible for processing personal data in connection with ANTLITZWERK is:

Scope, data categories and legal bases

This privacy policy applies to our online store at antlitzwerk.de, its customer accounts, ordering and service processes, interactive features and related communications.

Depending on how you use our services, we may process in particular:

• identity and contact data, including name, address, email address and telephone number;
• order, contract, payment, delivery, return, cancellation and refund data;
• customer-account, login and communication data;
• IP address, device, browser, connection, log and security data;
• usage, session, interaction, cookie and consent data;
• information you voluntarily enter into interactive features.

Depending on the purpose, processing is based in particular on Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract or pre-contractual steps), Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interests).

Visiting and securing our store

When you visit our store, technically necessary information may be processed, including your IP address, time of access, content viewed, referrer URL, browser type, operating system, device information and technical security logs.

This serves to provide the store securely and reliably, identify errors and prevent misuse, fraud and attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and functional operation of the store.

Shopify, hosting and Network Intelligence

Our online store is operated using Shopify. For customers in the European Economic Area, Shopify International Ltd., Ireland, is involved in providing the platform. Shopify provides hosting, cart, checkout, customer-account, order-management, security, analytics and payment-related functions.

Where Shopify processes data on our behalf, this takes place under Shopify’s contractual data-protection and processing terms. For certain independent services, including Shop, Shop Pay and Enhanced Services, Shopify may also process personal data as an independent controller.

Information may be shared with Shopify, affiliated companies and technical providers, including recipients in other countries. Non-essential processing is carried out in the relevant regions only after the required consent. You can change or withdraw your choice at any time through our cookie settings.

Further information is available in Shopify’s Consumer Privacy Policy. You can exercise privacy choices directly with Shopify through the Shopify Privacy Portal.

Orders, payments, fulfilment and delivery

Orders and contractual processing

When you place an order, we process the information needed to prepare, conclude and perform the contract. This includes your name, billing and delivery address, contact details, products ordered, order value, payment status and information relating to delivery, cancellation, return, complaint and refund.

The legal basis is Article 6(1)(b) GDPR. Processing required by commercial or tax law is based on Article 6(1)(c) GDPR. Security and fraud-prevention measures may also be based on Article 6(1)(f) GDPR.

Payment providers

Payments are processed using the payment methods and providers shown at checkout. Depending on your selection, the information necessary for the transaction — such as name, billing data, order amount, currency and transaction status — is transmitted to the selected provider. Full card or bank details are generally processed by the payment provider itself. Its own privacy information also applies.

Fulfilment, shipping and tracking

We transmit the data required for preparation, dispatch, delivery and, where applicable, tracking to our production, fulfilment, shipping and logistics partners. Orders are dispatched from Latvia within the European Union. The carrier used may vary depending on destination, shipping method and route.

Customer account, contact and email communication

Where offered, you can use a Shopify customer account. This may involve processing your email address, account information, saved addresses and orders. Login may take place by means of a one-time code sent to your email address.

If you contact us by email, telephone, contact form or another offered channel, we process the information you provide in order to handle your request. Contract-related enquiries are processed under Article 6(1)(b) GDPR; general enquiries under Article 6(1)(f) GDPR.

If you expressly subscribe to a newsletter, an ANTLITZWERK ritual or other voluntary email content, we use your email address for the communication announced at registration. The legal basis is Article 6(1)(a) GDPR. You can withdraw consent at any time through the unsubscribe link or by emailing atelier@antlitzwerk.de.

Service messages required for an order, security or customer-account administration are not marketing messages. Abandoned-cart reminders are sent only where consent or another legal permission is available.

Cookies, consent, analytics and marketing

Our store uses cookies, local storage and comparable technologies. Strictly necessary technologies enable security, cart, checkout, language, region, customer account and storage of your privacy choices.

Non-essential technologies for preferences, analytics, personalisation or marketing are used in the relevant regions only after the required consent. Access to or storage of information on your device is governed in Germany in particular by section 25 TDDDG; subsequent personal-data processing is additionally governed by the GDPR.

Our ANTLITZWERK cookie banner is connected to Shopify’s Customer Privacy API. In order not to ask for your choice on every page view, a necessary consent record is stored in the cookie aw_cookie_consent_v3 and in local browser storage under aw_cookie_consent, generally for up to twelve months.

Where Shopify or another provider processes data independently for analytics, personalisation or advertising, its privacy information applies in addition.

Interactive ANTLITZWERK features

Your water profile

For “Your Water Profile”, we process the location information you enter, in particular country and postcode. If you choose a more precise lookup, town, district, street or a water-hardness value entered by you may also be processed. The feature does not request your name or email address.

The information is transmitted to a technical evaluation function hosted on Cloudflare infrastructure and processed with suitable public sources to provide the requested water-hardness assessment. To locate, retrieve and evaluate publicly available supplier information, the server-side function may use technical web-search, document-extraction and artificial-intelligence services. For this purpose, only the location details required for the query and publicly available source documents are processed; the feature does not transmit your name or email address.

Standard technical connection data, including the IP address, may arise in security and server logs. To improve availability and avoid repeated external searches, the location query and verified result may be stored in a technical cache for a limited period, generally for up to 120 days, without being linked to a customer account. We do not use your entries to create a personal advertising profile without a separate legal basis.

Processing requested through this feature is based on Article 6(1)(b) GDPR; security, error analysis, abuse prevention and technically necessary caching are based on Article 6(1)(f) GDPR. Further information is available in Cloudflare’s Privacy Policy.

Virtual lipstick try-on

The camera or an image file selected by you is used only after you start the feature and grant the required browser or device permission. Face and lip analysis and the colour rendering take place locally in your browser. The current ANTLITZWERK integration does not upload the photograph to an ANTLITZWERK server and does not store it permanently.

The feature is not used to identify you, conduct biometric identity verification or create an advertising profile. You can revoke camera or file permissions in your browser or device settings at any time. Processing takes place to provide the feature you requested on the basis of Article 6(1)(b) GDPR; where consent is required for access to the camera or selected file, Article 6(1)(a) GDPR applies.

Recipients, international transfers and retention

Personal data is shared only where necessary for the relevant purpose and where a legal basis exists. Recipients may include Shopify, payment providers, production and fulfilment partners, carriers, IT and security providers, communication providers, technical web-search, document-extraction and artificial-intelligence providers used for the water-profile feature, analytics and marketing providers where legally permitted, professional advisers and public authorities where required by law.

Some providers or subprocessors may process data outside the European Economic Area. Where no adequacy decision exists, transfers take place only under the statutory requirements, in particular on the basis of appropriate safeguards such as standard contractual clauses.

ANTLITZWERK does not sell personal data for money. Certain transfers for interest-based advertising may nevertheless be defined as “sale”, “sharing” or “targeted advertising” under individual laws outside the EU. Where such rights apply, you can use the relevant privacy choices.

We retain data only for as long as required for the relevant purpose or for statutory retention duties. Depending on the document type, contract, order, accounting and business records may be subject in particular to retention periods of six, eight or ten years.

Your rights and complaints

Subject to the statutory requirements, you have in particular the rights of access, rectification, erasure, restriction, data portability and objection, as well as the right to withdraw consent with effect for the future. To exercise your rights, email atelier@antlitzwerk.de. Where we have reasonable doubts about your identity, we may request information necessary to allocate the request securely.

Depending on where you live, additional privacy rights may apply. You can use our Privacy Choices where relevant. Rights concerning processing for which Shopify is independently responsible can also be exercised through the Shopify Privacy Portal.

You also have the right to complain to a data-protection authority. The authority particularly competent for ANTLITZWERK is: