Privacy Policy

The controller responsible for the processing of personal data in connection with this online shop is:

If you have questions about data protection or wish to exercise your rights, you can contact us at any time using the contact details above.

We process personal data only where this is necessary for a specific purpose. Depending on how you use our shop, this may include in particular:

• identity and contact data such as name, address, email address and telephone number
• order, shopping-cart, payment, invoice and return data
• shipping, tracking and delivery information
• customer-account and login data
• contents of messages, chats, forms and support requests
• newsletter, consent and unsubscribe information
• quiz, survey, review and referral data
• affiliate and referral identifiers
• IP address, device, browser, session and technical usage data
• interaction, analytics and marketing data where the required consent has been given

Where information is stored on or accessed from your device, additional ePrivacy rules apply. For users in Germany, this includes Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). For users in other EU or EEA countries, the corresponding national rules implementing Article 5(3) of Directive 2002/58/EC may apply.

We receive most of your data directly from you, for example when you place an order, register, send us a message, subscribe to a newsletter, complete a quiz or submit a review.

In individual cases, we may also receive personal data from other sources. These may include in particular:

• payment and transaction status information from payment service providers
• shipping and delivery status information from shipping and fulfilment providers
• referral or affiliate identifiers through partner programmes
• review or invitation information from review platforms
• technical security and risk information from Shopify and connected security services
• data from apps and interfaces connected to Shopify where required for the respective function described

Such indirectly collected data are processed only for the purposes described in this Privacy Policy.

Our online shop is operated using Shopify. For merchants in the European Economic Area, Shopify International Limited in Ireland is generally the relevant Shopify entity.

Shopify processes customer data as part of the platform functions we use. This may include identity, contact, order, shopping-cart, payment, device, browser, security, session and technical log data.

Depending on the function, the legal basis is Article 6(1)(b) GDPR for performance of a contract or Article 6(1)(f) GDPR for the secure and functional operation of the shop.

Shopify may use affiliated companies and subprocessors. Personal data may therefore also be processed outside the European Economic Area. Further information can be found in the section on international data transfers.

Our shop uses cookies and comparable technologies such as local storage, pixels, tags, scripts and device identifiers.

Strictly necessary technologies may in particular be required for:

• shopping cart and checkout
• customer accounts and login
• language and country settings
• security and fraud prevention
• session management
• storage of your privacy preferences

For users in Germany, storing or accessing information on a device that is strictly necessary to provide a digital service explicitly requested by the user may be permitted under Section 25(2) TDDDG. For users in other EU or EEA countries, the corresponding national provisions implementing Article 5(3) of the ePrivacy Directive apply.

Non-essential analytics, marketing, affiliate, personalisation and comparable technologies are activated only after the consent required under the applicable ePrivacy rules has been obtained. Where personal data are processed on the basis of that consent, the legal basis is Article 6(1)(a) GDPR. For users in Germany, Section 25(1) TDDDG also applies to the relevant storage of or access to information on the device.

Your choice is stored through the consent-management solution used in our shop. You can change or withdraw your choice at any time using the cookie or privacy settings in the footer of our shop.

When you place an order with us, we process in particular:

• first and last name
• billing and delivery address
• email address
• telephone number where provided or required
• products ordered, quantities and prices
• payment method and payment status
• customer, order and invoice numbers
• shipping, tracking, return and refund information
• contents of voluntary messages

Processing is carried out for performance of the contract, payment, delivery, communication regarding order status and the handling of returns, complaints and refunds.

The legal basis is Article 6(1)(b) GDPR. Data that must be retained by law are additionally processed on the basis of Article 6(1)(c) GDPR.

If you create a customer account, the data you enter are processed to provide and manage that account. The account may be deleted at your request unless statutory retention obligations require continued storage of certain data.

For payment processing, the data required for the transaction are transmitted to the payment service provider selected by you during checkout.

The legal basis for transmission of data required for payment processing is Article 6(1)(b) GDPR. Where payment providers carry out identity, security, creditworthiness or fraud checks under their own responsibility, their own privacy information also applies.

Individual pages may display information about deferred-payment or instalment-payment options offered by PayPal.

As part of the technical integration, information such as your IP address, browser, device and page data may be transmitted to PayPal.

Where the integration is not strictly necessary for the shop function or uses tracking technologies, it is activated only after the required consent has been obtained. For users in Germany, Section 25(1) TDDDG may apply to storage of or access to information on the device. In other EU or EEA countries, the corresponding national ePrivacy provisions apply. The legal basis for consent-based processing of personal data is Article 6(1)(a) GDPR.

For storage, picking, packing, shipping, tracking and processing returns, we transmit the data required for these purposes to our logistics and shipping service providers.

The legal basis is Article 6(1)(b) GDPR.

Your email address or telephone number will only be used for additional shipping notifications where this is necessary for the requested delivery communication or is otherwise permitted by law.

If you contact us by email, form, chat or another communication channel, we process the data you provide in order to handle your enquiry.

This may include in particular your name, email address, telephone number, order number, the content of your message, the time of the communication and technical connection information.

The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a contract or order. General enquiries are processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest is reliable customer communication.

Automated responses generated by a chatbot do not constitute medical advice or diagnosis.

We use Seguno Email in particular for newsletters, sign-up forms and automated email communication.

When you subscribe to a newsletter, we may process your email address, name, time of registration, consent information, unsubscribe information and data relating to your use of emails sent to you.

We send promotional newsletters on the basis of your consent under Article 6(1)(a) GDPR. For recipients in Germany, the requirements of Section 7 of the German Act against Unfair Competition (UWG) also apply. For recipients in other EU or EEA countries, the applicable national rules on electronic direct marketing, including rules implementing Article 13 of Directive 2002/58/EC, may additionally apply.

You may withdraw your consent at any time with effect for the future, in particular by using the unsubscribe link contained in every promotional email.

Where open, click or comparable personalised performance measurements are used, these are carried out only where a sufficient legal basis, including any required consent, exists.

Service and transactional messages required to process an order are sent independently of newsletter consent on the basis of Article 6(1)(b) GDPR.

Seguno may process data outside the European Economic Area. The safeguards described in the section on international data transfers apply to such transfers.

We use Microsoft Clarity to better understand how visitors use our shop and where usability and user experience can be improved.

Clarity may in particular process the following information:

• IP and device information
• browser information
• pages viewed
• clicks and scrolling activity
• mouse and touch interactions
• display and navigation events
• pseudonymous session identifiers
• technically processed recordings of usage sessions

We use Clarity technologies required for analytics and cross-session evaluation only after the required consent has been obtained.

For users in Germany, Section 25(1) TDDDG may apply to the relevant storage of or access to information on the device. In other EU or EEA countries, the corresponding national ePrivacy provisions apply. The legal basis for consent-based processing of personal data is Article 6(1)(a) GDPR.

You can withdraw your consent at any time using our privacy settings.

After the required consent has been obtained, we may use technologies provided by Meta, in particular the Meta Pixel and, where applicable, server-side conversion interfaces.

The following information may in particular be processed:

• IP address
• browser and device information
• page and product views
• shopping-cart, checkout and purchase events
• pseudonymous identifiers
• where applicable, contact information transmitted in a technically protected form

Processing is used in particular to measure advertising campaigns, attribute conversions, create audiences and – where consent has been given – deliver personalised advertising.

For users in Germany, Section 25(1) TDDDG may apply to the relevant storage of or access to information on the device. In other EU or EEA countries, the corresponding national ePrivacy provisions apply. The legal basis for consent-based processing of personal data is Article 6(1)(a) GDPR.

We use various Shopify apps for product data, search-engine optimisation, indexing and technical shop management.

These services primarily process product, content and technical shop data. Where technical personal data such as IP addresses, log data or administrative data are processed as part of providing the service, this is carried out on the basis of Article 6(1)(f) GDPR or within the framework of the data-processing arrangements agreed with the respective service provider.

Where personal conversion or usage data are processed through connected advertising platforms, the relevant sections on analytics and marketing additionally apply.

We use Trustpilot and Trustoo / CWILL to display, manage and, where applicable, collect product and company reviews.

The following data may in particular be processed:

• name or chosen display name
• email address
• order and product information
• review text and star rating
• uploaded images or videos
• technical usage data

Review content is published only where you submit a review yourself or otherwise agree to publication.

Where review requests are sent by email, this is done only where a sufficient legal basis exists.

Trustpilot may act as a service provider for the technical handling of review invitations and may process data that you subsequently provide directly on the Trustpilot platform partly under its own data protection responsibility.

For voluntary product quizzes, product recommendations, surveys and customer feedback, we may in particular use the following services:

This may include answers relating to skin feel, product preferences, skincare goals and desired product characteristics, as well as technical usage data.

If you voluntarily provide your email address, it may also be processed, for example to provide your result or – only where the required consent has been given – to enable marketing communication.

Our quizzes are intended to assist with cosmetic product selection. They do not replace medical diagnosis or treatment.

We avoid intentionally requesting medical diagnoses. If special categories of personal data within the meaning of Article 9 GDPR were intentionally collected in an individual case, this would only take place on the basis of the explicit consent required for such processing.

A product recommendation generated by a quiz does not have legal effect and does not constitute automated decision-making producing legal or similarly significant effects.

We may in particular use UpPromote and Shopjar Referral Program for affiliate and referral programmes.

Depending on the programme, referral and affiliate identifiers, click information, order number, order value, the referral link or discount code used and technical device information may be processed.

Where cookies, pixels or comparable non-essential tracking technologies are used for this purpose, they are used only after the required consent has been obtained. For users in Germany, Section 25(1) TDDDG may apply to the relevant storage of or access to information on the device. In other EU or EEA countries, the corresponding national ePrivacy provisions apply. The legal basis for consent-based processing of personal data is Article 6(1)(a) GDPR.

Data relating to registered affiliate partners may additionally be processed for performance and settlement of the partner agreement on the basis of Article 6(1)(b) GDPR and for compliance with legal obligations on the basis of Article 6(1)(c) GDPR.

For discount campaigns, bundle offers and additional product recommendations, we use Shopify's own functions as well as services including Discounty and Kaching Bundles.

Product, shopping-cart, order and technical usage data may be processed where required for the respective function.

The legal basis is Article 6(1)(b) GDPR where processing is necessary for a requested purchase process, or Article 6(1)(f) GDPR for the economic and technical optimisation of how our offers are presented.

Non-essential tracking functions are used only after the required consent has been obtained.

For internal order processing, inventory management, invoicing, accounting, tax documentation and business analysis, we use in particular:

This may include customer, order, invoice, payment, shipping, return and product data.

The legal bases are Article 6(1)(b) GDPR for performance of contracts, Article 6(1)(c) GDPR for statutory accounting and documentation obligations and Article 6(1)(f) GDPR for internal analyses and optimisation of business processes.

To provide a digital option for exercising the right of withdrawal, Shopify or the “EU Withdrawal Button” function used by us may process the information you enter.

This may include your name, email address, order number, information about the order and the date, time and content of your declaration of withdrawal.

Processing takes place in order to handle your withdrawal and comply with legal obligations on the basis of Article 6(1)(b) and (c) GDPR.

Personal data are disclosed to other parties only where this is necessary for one of the purposes described or required by law.

Recipients or categories of recipients may in particular include:

• shop and hosting service providers
• payment service providers and financial institutions
• shipping, fulfilment and logistics service providers
• IT, support and communication service providers
• newsletter and marketing service providers
• analytics and tracking providers following consent
• review, quiz, survey, affiliate and referral service providers
• accounting, tax and reporting service providers
• tax advisers, legal advisers and public authorities where legally required

Where a service provider processes personal data on our behalf, the cooperation is governed by the data-protection agreements required by applicable law.

Some service providers used by us or their subprocessors may process personal data outside the European Economic Area, in particular in the United States, Canada or other third countries.

Such transfers take place only where the requirements of Articles 44 et seq. GDPR are met.

Depending on the respective recipient, the safeguards used may include in particular:

• an adequacy decision of the European Commission
• for appropriately certified US companies, the EU-US Data Privacy Framework
• Standard Contractual Clauses adopted by the European Commission
• where appropriate, supplementary technical and organisational safeguards

Where an adequacy decision or certification is relied upon as the basis for a transfer, it must actually apply to the respective recipient.

We retain personal data only for as long as necessary for the respective purpose or for as long as statutory retention obligations apply.

The following criteria generally apply in particular:

• Order and contract data are retained for performance of the contract and subsequently in accordance with applicable statutory retention and limitation periods.
• Under the statutory retention requirements applicable to us in Germany, accounting vouchers are generally retained for eight years.
• Annual financial statements, opening balance sheets and certain other documents may have to be retained for ten years.
• Commercial and business correspondence is generally retained for six years.
• Newsletter data are generally retained until consent is withdrawn or you unsubscribe. A suppression entry may subsequently be retained in order to prevent further mailings.
• Records of consent may be stored for as long as required to demonstrate the lawfulness of processing.
• Customer accounts are generally retained until the account is deleted, unless legal obligations require certain information to be retained for longer.
• Data from chats, quizzes and surveys are deleted or anonymised when no longer required for the respective purpose and where no legal or contractual reason requires longer retention.

Once the respective purpose no longer applies and relevant retention periods have expired, data are deleted or anonymised.

Data that we necessarily require in order to enter into and perform a purchase contract must be provided so that we can process and fulfil the order.

Without required order, contact, payment or address information, it may not be possible to complete a purchase contract.

Newsletter subscriptions, quizzes, surveys, reviews, additional profile information and marketing consents are generally voluntary.

Automated processes may be used in our shop, for example for product recommendations, internal process management, fraud prevention or segmentation of technical processes.

Automated product recommendations generated through quizzes are intended solely to assist with product selection and do not have legal or similarly significant effects.

Automatically generated security or risk indicators are not used as the sole basis for decisions producing legal or similarly significant effects for an individual unless the legal requirements for such processing are met.

We do not sell personal data to advertisers or other companies as a standalone business model.

Data are transmitted to service providers and platforms only for the purposes described in this Privacy Policy and on the basis of the applicable legal requirements.

Subject to the applicable legal requirements, you have in particular the following rights:

• right of access under Article 15 GDPR
• right to rectification under Article 16 GDPR
• right to erasure under Article 17 GDPR
• right to restriction of processing under Article 18 GDPR
• right to data portability under Article 20 GDPR
• right to object under Article 21 GDPR
• right to withdraw consent under Article 7(3) GDPR
• right to lodge a complaint with a supervisory authority under Article 77 GDPR

To exercise your rights, you can simply contact:

info@thesourcelab.de

You can change cookie and tracking consent using the privacy settings in our shop. You can also withdraw newsletter consent using the unsubscribe link contained in every promotional email.

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.

Where personal data are processed for direct-marketing purposes, you may object to such processing at any time without having to provide reasons relating to your particular situation.

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR.

Under Article 77 GDPR, you may in particular lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement.

The supervisory authority generally responsible for our company in Germany is:

This does not restrict your right to contact another supervisory authority that is competent for you under the GDPR.

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and unauthorised disclosure.

These measures include in particular encrypted data transmission, access restrictions, authorisation concepts, technical security measures and appropriate monitoring processes.

We update this Privacy Policy where legal requirements, our data processing activities or the services we use change materially.

The current version published on this website applies.