Privacy Policy Webshop Mallia Aesthetics GmbH

1. General information on data protection

This privacy policy is aimed at consumers in the European Economic Area (EEA) and explains how Mallia Aesthetics GmbH and its affiliated companies and subsidiaries (the “Mallia Group”) collect, use, share, and store personal data. It applies to all online and offline services that refer to this notice, including websites, mobile apps, and other offerings of the Mallia Group.

2. Controller and scope

The controller responsible for data processing is Mallia Aesthetics GmbH, Henkestr. 91, 91052 Erlangen (“Mallia Aesthetics”). The data protection practices are governed by the applicable legal requirements of the countries in which Mallia Aesthetics operates via the Mallia Group. For specific information regarding other regions, please refer to the respective local privacy policy.

3. Collection and use of personal data

Personal data are information relating to an identified or identifiable natural person (Art. 4(1) EU General Data Protection Regulation 2016/679 “GDPR”). A person is identifiable if they can be identified directly or indirectly, for example by name, addresses, email, telephone numbers, dates of birth, preferences (such as product choices), payment and delivery data, as well as information about user behaviour on the website.

The collection of these data depends on the particular interaction, such as when placing orders, creating a customer account, using support services, or participating in marketing activities. Processing is based on various legal grounds, including the performance of contractual obligations, your consent, Mallia Aesthetics’ legitimate interests, and legal requirements.

4. Purposes of data processing

4.1. Mallia Aesthetics uses personal data in particular to:

• Process orders and deliver products, incl. payment processing, invoicing, shipping, shipment tracking, and returns handling.
• Manage customer accounts, e.g., registration/login, password reset, maintenance of addresses and payment methods.
• Carry out identity and eligibility checks (e.g., for discounts/possible VAT ID verification, fraud prevention, abuse prevention).
• Personalise the user experience, e.g., by remembering the shopping cart, language/country.
• Handle support requests (customer service via email/phone/contact form).
• Send system and transactional emails required by contract (e.g., order, shipping and delivery information, status updates).
• Send marketing and promotional communications (only with your consent, e.g., newsletters).
• Conduct reach, conversion and usage analyses to improve products, content and processes (only with consent for non-essential cookies/technologies).
• Manage and document consents (consent management pursuant to the GDPR/TTDSG).
• Ensure the security and stability of the webshop, including through server logs, error management and access controls.
• Fulfil legal obligations (e.g., commercial/tax retention, warranty/guarantee cases, compliance).
• Refund payments and handle claims/complaints in a legally compliant manner.
• Protect legitimate interests, e.g., assertion/defence of legal claims.

5. Disclosure of data to third parties

Personal data are shared with the following categories of recipients:

• Group companies: Mallia Innovations GmbH, Henkestr. 91, 91052 Erlangen
• Hosting &a technical infrastructure: Operation of the website, storage/backups, logging and security purposes (EU/EEA).
• IT service providers / maintenance & support: Operation, maintenance and further development of our systems (e.g., shop/ERP/integration services).
• Payment service providers: Processing payments, where applicable risk/fraud prevention. The privacy notices of the respective provider apply.
  Legal basis: Art. 6(1)(b) GDPR.
• Fulfilment & shipping: Order processing, warehousing/picking, transport and shipment tracking by logistics and transport service providers.
  Legal basis: Art. 6(1)(b) GDPR.
• Address validation / maps API: Validation of entered addresses (e.g., at checkout) via a maps/address service through an API call.
  Legal basis: Art. 6(1)(b) and, where applicable, (f) GDPR; cookies/IDs only with consent.
• Analytics, tag management & marketing (only with consent)
  Use of tag management (e.g., Google Tag Manager) as well as analytics/marketing technologies (e.g., Google Ads/Analytics, Meta Pixel, Microsoft Clarity); where applicable, server-side tagging/proxy (e.g., stape.io) as a processor. GTM itself does not set tracking cookies, but controls the delivery of tags.
  Legal basis: Art. 6(1)(a) GDPR; for setting/reading cookies/IDs additionally Section 25(1) TTDSG. Note on possible third-country transfer/SCC—see chapter “International data transfers”.
• Communication & customer service
  Sending transactional emails/newsletters (if subscribed) and customer support tools.
• Advisors & auditors
  Legal and tax advice, auditing.
  Legal bases: Art. 6(1)(c) and/or (f) GDPR.
• Authorities & courts
  Where legally required or for the establishment, exercise or defence of legal claims.
  Legal basis: Art. 6(1)(c) or (f) GDPR.
• Corporate transactions
  In the context of restructurings/mergers/acquisitions while maintaining confidentiality.
  Legal basis: Art. 6(1)(f) GDPR.

6. International data transfers

Principle. We primarily process personal data within the European Union or the European Economic Area (EU/EEA). The webshop is hosted on servers within the EU/EEA.

Transfers to third countries. Where, in individual cases, service providers outside the EU/EEA are used (in particular providers of tag management, analytics, advertising, maps/address services or payment services), a transfer to so-called third countries— including the USA—may occur. Data potentially affected include, for example, IP address, device/browser data, usage/event data (page views, clicks), and, where required for the respective purpose, order or payment metadata.

Legal bases & safeguards. For such transfers we ensure an adequate level of data protection, in particular through:

• Adequacy decisions under Art. 45 GDPR (e.g., EU-U.S. Data Privacy Framework, provided the respective provider is certified), and/or
• Standard Contractual Clauses (SCC) of the EU Commission under Art. 46(2)(c) GDPR including supplementary technical and organizational measures.

Additional protective measures. Depending on the service, we use, among other things, data minimization, pseudonymization/IP truncation, encryption in transit and at rest, strict access rights and—where possible—EU-based processing paths (e.g., server-side tagging/proxy within the EU/EEA).

Consent-based tools. Analytics, marketing and maps/address services (e.g., Google Ads/Analytics, Meta Pixel, Microsoft Clarity, Google Maps/Places; controlled via Google Tag Manager) are loaded only after your consent in the consent manager. With your consent (Art. 6(1)(a) GDPR; for cookies/IDs additionally Section 25(1) TTDSG), a third-country transfer may also be triggered. You can withdraw consent at any time with effect for the future.

Transparency. The providers used, categories of data, processing purposes and transfer mechanisms (adequacy decision/SCC) are listed in our consent manager and/or in the list of service providers in this privacy policy. Upon request, we will provide you with copies of the relevant Standard Contractual Clauses or information on how to inspect them.

Payment services & logistics. For payments and shipping, depending on your selection, international sub-processors of the respective providers may also be involved. The privacy notices of these providers apply additionally; we select service providers with appropriate safeguards pursuant to Art. 44 et seq. GDPR.

7. Retention period and data security

Personal data are stored only for as long as necessary for the respective purposes or as required by law. Mallia Aesthetics implements technical, organizational and administrative measures to ensure data security and to protect data against unauthorized access, loss or misuse.

8. Your rights as a data subject

• Access to stored data,
• Rectification of inaccurate or incomplete information,
• Erasure of data where no statutory retention obligations apply,
• Restriction of processing,
• Objection to processing,
• Withdrawal of consent given,
• Data portability to another provider,
• Complaint to a data protection supervisory authority.

To exercise these rights, you can contact Mallia Aesthetics at datenschutz@mallia.com. In certain cases, Mallia Aesthetics may request proof of identity.

9. Cookies, tracking and marketing

Mallia Aesthetics uses cookies that identify your browser. These cookies collect and store information when you visit our website in order to learn how you use this website. They enable recording of website usage, optimized service and a better browsing experience, as well as the performance of analytics. The personal data we collect using these technologies are also used to manage your session.

Further information about cookies and their use can be found in the information provided in our consent manager, through which you can also give or withdraw your consent and manage your overall cookie preferences.

10. Special notes for children

Our services are not directed to children under 16 years of age. We do not knowingly process personal data of children. Parents/guardians can contact us at any time at datenschutz@mallia.com if they suspect unlawful data collection; we will promptly review and take deletion/protection measures.

11. Contact and competent supervisory authority

11.1. Contact

If you have questions or concerns about data protection, you can contact Mallia Aesthetics at datenschutz@mallia.com. Complaints can also be addressed to the competent supervisory authority.

11.2. Competent supervisory authority

The supervisory authority for Mallia Aesthetics is:

• The Bavarian Data Protection Commissioner
• Write: Postfach 22 12 19, 80502 Munich
• Visit: Wagmüllerstraße 18, 80538 Munich (Please by prior appointment only)
• Call: 089 212672-0
• Fax: 089 212672-50
• Email: poststelle@datenschutz-bayern.de

12. Notice of changes

Mallia Aesthetics reserves the right to update this privacy policy as needed. You will be informed of material changes, for example through notices on the website or by email.