Privacy Policy
We are pleased that you have visited our website www.ellen-wille.de ('website') and are interested in our business. When you visit our website, we also process personal data according to Art. 4 (1) GDPR (‘data’). We are aware of the importance of the data with which we are entrusted. It is important to us to protect your private sphere when your data are processed; we take this into account during our business processes. We handle your data consistent with the statutory requirements on data protection.
1. Controller and data protection officer
Controller pursuant to Art. 4 (7) GDPR for processing your data in the context of this website is:
ellen wille THE HAIR-COMPANY GmbH (‘Ellen Wille' or ‘we’)
Lauenburger Str. 3-5
65824 Schwalbach am Taunus
Tel.: +49 (0)6196/88152-0
E-mail: datenschutz@ellen-wille.de
Ellen Wille’s data protection officer can be reached as follows:
UBG mbH
Im Breitspiel 21
69126 Heidelberg
Tel : +49 (0)69/6530006-23
E-mail: datenschutz@ellen-wille.de
2. Purpose of data processing, legal basis, storage duration, recipients, as well as third country transfer
Depending on the processing purpose, your data may be processed based on a different legal basis. Contract processors support us in some aspects of operating our website, processing your data on our behalf and based on our instruction and are thus recipients of your data (‘service providers’). Your data may also be disclosed to other businesses.
As a consequence, we state various purposes for which your data may be processed on our website, stating the relevant legal basis as well as information on the storage duration. We also inform you as to whether this business is a service provider and whether your data are transferred outside of the EU or the European Economic Area (‘EEA’).
a. Viewing our website and server log file
To display our website on your device, it is technically required for our web server on which our website is hosted to process your data. For this purpose, we process your IP address together with date and time of the visit, name and URL of the retrieved file, referrer URL (website from which the access takes place), the transmitted amount of data and loading time in a server log file.
The legal basis for saving information in the form of cookies and/or in a server log file on your device and/or accessing this information in your device is section 25 (2) no. 2 Telecommunication Telemedia Data Protection Act.
Your data are processed pursuant to Art. 6 (1) f) GDPR. Your IP address needs to be processed to maintain our legitimate interest in our website being available and correctly displayed. The storage of your data above and beyond this in a server log file helps to uphold our legitimate interests, operate our website securely and on a fault-free basis, and recognise, isolate and rectify faults and errors.
Your data in our server log file are erased automatically 24 hours following the visit to our website.
We use a service provider to host our website. This service provider has its Registered Office in the EU.
b. Contacting us
You can contact us on our website in relation to various subjects.
If you use our contact form to contact us, the mandatory fields you need to fill in are labelled as such. These details are required to be able to process your enquiry. All further details are provided voluntarily and used only to answer your enquiry more specifically. Additionally, you can contact us by telephone, e-mail, post or fax. Your data that we process in this context may vary depending on the communication channel, however regularly include your first and last names, your address, your telephone number, your e-mail address as well as your fax number.
If your contact with us is based on concluding a contract or is in the context of a contract, we process your data based on Art. 6 (1) b) GDPR. If your contact with us is of a general nature, we process your data pursuant to Art. 6 (1) f) GDPR based on our legitimate interests to reply to your enquiry regarding our business and/or our offerings in a custom and optimum manner.
If your data relate to a contractual relationship, we may not erase your data until expiry of retention duties under commercial or fiscal law, which may be up to 6 years starting from the expiry of the year in which you contacted us. We erase all other data if your enquiry has been ultimately clarified and we are not subject to a statutory obligation to retain the relevant data.
c. Customer portal
We offer to you as a customer the opportunity to view and manage your customer data, your orders or your invoices online.
As part of the customer relationship between you and us, we regularly collect data from you (particularly name, address, invoice and delivery address, VAT ID, website, if relevant - further contact persons involved in the contact, if relevant - ‘acting for’) as well as information on the business relationship (particularly bank details, payment conditions, rate of returns, desired invoice type).
The legal basis for the relevant data processing is Art. 6 (1) b) GDPR as well as Art. 6 (1) f) GDPR. It is essential to process your data as part of processing the business relationship and to promote the sale of goods or services.
Moreover, you can purchase download products or online seminars. For this purpose, we process your contact data, your invoice address, as well as your payment information regarding your credit card or debit card. The legal basis for processing your data is Art. 6 (1) b) GDPR.
You can erase your customer account at any time and thus erase the recorded data. However, we do not erase the data collected as part of an order until expiry of retention duties under commercial or fiscal law, which may be up to 10 years.
d. Technologically essential cookies
Cookies are small files sent by us to the browser of your device and saved there as part of your visit to our website. On our website, we use technologically essential cookies to ensure the basic functions of our website. The cookies contain a so-called session ID, with which various enquiries from your device during your visit to our website can be apportioned.
The legal basis for saving information in the form of cookies on your device and/or accessing this information in your device is section 25 (2) no. 2 Telecommunication Telemedia Data Protection Act.
The legal basis for relevant processing of your data is Art. 6 (1) f) GDPR. Technologically essential cookies need to be used to maintain our legitimate interest in our website being available, correctly displayed and ensuring it is entirely functional.
Technologically essential cookies are erased once you close your browser at the latest.
If you do not want cookies to be placed on your device, you can control this centrally using your browser. You can also erase cookies using your browser.
Blocking or erasing may however lead you to be able to use our website only with extremely restricted usability.
e. Cookiebot
We use the Cookiebot consent tool on our website; this is a tool of Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (‘Cybot’). We use Cookiebot to save your consent. Cybot collects the following data:
- IP address in anonymised form (the final three digits are set to ‘0’);
- Date and time of the consent;
- Browser user agent;
- The URL from which the consent was sent;
- An anonymous, random and coded key;
- Consent status.
The key and the consent status are saved in your browser in a ‘CookieConsent’ cookie meaning that our website can read your consent to all subsequent website enquiries and future end user sessions for up to 12 months automatically and follow such. The key is used to prove the consent and for an option verifying whether the consent status saved in your browser is unchanged compared with the original consent transmitted to Cybot.
The legal basis for placing cookies on your device is section 25 (2) no. 2 Telecommunication Telemedia Data Protection Act. Your data are subsequently processed pursuant to Art. 6 (1) f) GDPR. Cookiebot is necessary to maintain our legitimate interests in obtaining legally compliant consent, as well as in clearly displaying the cookies used on our website.
The cookies used by Cybot have a lifespan of 12 months and are used to prove that you have provided consent for cookies to be placed.
You can set your browser to prevent cookies from being generally saved on your device. Please bear in mind that if you prevent cookies from being saved on our website, this may lead you to no longer being able to use all of our website’s functions in full.
For further information on data processing by Cookiebot, please visit the Cybot Privacy Policy: www.cookiebot.com/de/privacy-policy.
f. Google Analytics
On our website, we use the Google Analytics tool of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (‘Google Ireland’).
We use Google Analytics to analyse and evaluate how our website is used, enabling us to compile reports on website activities by the visitors based on this information. Google Analytics also creates pseudonymised use profiles of the website visitors. By using Google Analytics, technically unnecessary cookies and online names (including cookie IDs), IP addresses and your device IDs are used. We use Google Analytics exclusively with the ‘anonymize IP’ add-on, meaning that a section of your IP address is erased before its transmission to Google. Google Ireland is the service provider as part of using Google Analytics.
Additionally, we have activated the ‘demographic characteristics’ Google Analytics advertising function. This enables us to analyse the visitors to our website based on age (18-24, 25-34, 35-44, 45-54, 55-64, 65+), gender (male, female), affinity categories (lifestyle similar as to TV target groups, e.g. technology enthusiasts, sports fans and hobby cooks), segments with purchase-willing target groups (interested in product purchase), as well as further categories and to create re-marketing target groups based on this. Google Ireland ( https://support.google.com/analytics/answer/2799357?hl=de#zippy=%2Cthemen-in-diesem-artikel) says that these data originate from a DoubleClick third-party cookie, an Android advertising ID or iOS Identifier for Advertisers (IDFA). We cannot ascertain which visitor is exactly allocated to one of the specific groups named above. We do not know if Google Ireland can identify you personally.
If you consent to the use of Google Analytics, cookies are placed on your device. The legal basis for this is section 25 (1) Telecommunication Telemedia Data Protection Act. Your data are then subsequently processed based on consent you granted to us according to Art. 6 (1) a) GDPR.
The cookies used by Google Analytics have a lifespan of one minute to 2 years and are used to limit the enquiry rate, to be able to differentiate between the users, identify the user and display personalised advertising to the user.
The information collected by using Google Analytics is erased after 9 or 18 months respectively (https://policies.google.com/technologies/ads). When Google Analytics is used, Google Ireland is the service provider; the valid contract for contract processing also applying to Google Analytics can be found under the following link: https://business.safety.google/adsprocessorterms. Should Google Ireland offer a contract on joint responsibility in the future, we will conclude such.
Using Google Analytics may lead to your data being transferred to the USA. There is no adequacy decision of the European Commission regarding data transfers to the USA. Data are transferred, inter alia, based on standard contractual clauses as suitable guarantees to protect personal data; we have concluded these clauses with Google Ireland in the data processing contract.
You can prevent data from being transferred to Google Ireland also by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=en.
g. Google reCAPTCHA
On our website, we use ‘Google reCAPTCHA’ of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (‘Google Ireland’).
reCAPTCHA verifies whether data were entered on our website (e.g. in a contact form) by a human or by an automated program. For this purpose, reCAPTCHA analyses your use patterns based on various characteristics. This analysis commences automatically when our website is visited. For analysis, reCAPTCHA evaluates various pieces of information (e.g. IP address, time spent by the website visitor to the website or mouse movements made by the user). The data recorded during the analysis are forwarded to Google.
If you consent to the use of Google reCAPTCHA, cookies are placed on your device. The legal basis for this is section 25 (1) Telecommunication Telemedia Data Protection Act. Your data are then subsequently processed based on consent you granted to us according to Art. 6 (1) a) GDPR.
The cookies used by Google reCAPTCHA have a lifespan of between one minute and 179 days and are used to differentiate between humans and bots.
Google Ireland receives the data as an autonomous controller and not as a service provider in this case.
Using Google reCAPTCHA may lead to your data being transferred to the USA. There is no adequacy decision of the European Commission regarding data transfers to the USA. Therefore, the data transfer to the USA is based on your declared consent according to Art. 49 (1) a) GDPR.
For more information on Google reCAPTCHA, please refer to the Google Privacy Policy and the Google Terms of Use under the following links:
https://policies.google.com/privacy?hl=en and https://policies.google.com/terms?hl=en.
h. YouTube integration
On our website, we use a YouTube iframe of YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA (‘Google’).
We have embedded the YouTube iframe to enable you to play out our chosen videos on our website, with such videos hosted by YouTube. In the process, your IP address is also transmitted to YouTube. Each time that you visit a sub-section of our website in which a YouTube iframe is deployed, YouTube can ascertain that you visited this sub-section. If you are simultaneously logged in to YouTube, the aggregated data are allocated to your Google account. You must log out of YouTube to prevent this from happening.
If you consent to the use of YouTube, cookies are placed on your device. The legal basis for this is section 25 (2) no. 2 Telecommunication Telemedia Data Protection Act. Your data are then subsequently processed based on consent you granted to us according to Art. 6 (1) a) GDPR. YouTube is used based on consent you granted to us according to Art. 6 (1) a) GDPR.
Using YouTube iframes leads to your data being transferred to the USA. There is no adequacy decision of the European Commission regarding data transfers to the USA. Data are transferred based on, inter alia, standard contractual clauses as suitable guarantees for protecting personal data.
We use the ‘Activate Advanced Privacy Mode’ setting, meaning that Google does not place any cookies to analyse the use pattern when the videos are embedded. We use the YouTube No Cookies function, i.e. videos are viewed not via youtube.com, but via youtube-nocookie.com.
i. Facebook
We maintain a so-called fan page at www.facebook.com.
When you visit our fan page, various data are collected and processed. For a proportion of the processing taking place on www.facebook.com, we are jointly responsible together with Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ('Meta Platforms Ireland’) in terms of data protection law; for other data processing, we alone are responsible or Meta Platforms Ireland alone is responsible.
If you contact us on Facebook, we process your name as well as further information that you communicate to us directly or via the comment function. Responsibility for processing this data lies solely with us. These data that you communicate to us are processed based on Art. 6 (1) f) GDPR and pursue our legitimate interests in an appropriate and interactive corporate presentation.
Together with Meta Platforms Ireland, we are responsible for the ‘Page Insights’ Facebook function, with which we receive aggregated and anonymised statistical evaluations regarding your use and interaction with our fan page. You can view the agreement on joint responsibility according to Art. 26 GDPR using the following link: https://de-de.facebook.com/legal/terms/page_controller_addendum.
For further unilateral processing of your data above and beyond this by Meta Platforms Ireland, particularly in terms of potential transfer to the USA, only Meta Platforms Ireland is responsible. Meta Platforms Ireland uses cookies and other technologies to collect data from you. For information on the purposes and legal basis of this processing, please view the Facebook Privacy Policy (www.facebook.com/policy.php). Please note that when you visit the www.facebook.com website, Facebook Ireland can collect and process data about you even if you do not have a Facebook account or are not logged in to Facebook. However, we do not know which data Meta Platforms Ireland collects from you and the purposes for which they are processed.
j. Instagram
We maintain an Instagram account on www.instagram.com.
In principle, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (‘Meta Platforms Ireland’) is responsible for processing your data when you visit the www.instagram.com website. Meta Platforms Ireland uses cookies and other technologies to collect data from you. For information on the purposes of the data processing and the legal basis on which it takes place, please visit the Instagram Privacy Policy (https://help.instagram.com/519522125107875) as well as Instagram’s information on the cookies it uses (https://help.instagram.com/519522125107875). Please note that when you visit the www.instagram.com website, Meta Platforms Ireland can collect and process data about you even if you do not have an Instagram account or are not logged in to Instagram. However, we do not know which data Meta Platforms Ireland collects from you and the purposes for which they are processed.
However, we process such data from you which you provide to us via Instagram and can be viewed publicly. These data are processed based on Art. 6 (1) f) GDPR and pursue our legitimate interests in an appropriate and interactive corporate presentation.
With the ‘Instagram Insights’ function, Meta Platforms Ireland enables us to measure and analyse the visitor’s interactions with our Instagram channel. However, we can access only aggregated and anonymised data, not allowing us to identify individual users.
k. Pinterest
We maintain an offering at www.pinterest.de.
When you visit our offering, various data are collected and processed. For a proportion of the processing taking place on www.pinterest.de, we are jointly responsible together with Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland ('Pinterest Ireland’) in terms of data protection law; for other data processing, we alone are responsible or Pinterest Ireland alone is responsible.
If you contact us on Pinterest, we process your name as well as further information that you communicate to us. Responsibility for processing this data lies solely with us. These data that you communicate to us are processed based on Art. 6 (1) f) GDPR and pursue our legitimate interests in an appropriate and interactive corporate presentation.
We are responsible together with Pinterest Ireland for the ‘Pinterest Analytics’ function. With this function, Meta Platforms Ireland enables us to measure and analyse the visitors’ interactions with our Pinterest website. However, we can access only aggregated and anonymised data, not allowing us to identify individual users. Pinterest Ireland currently does not offer a contract on joint responsibility. Should Pinterest Ireland offer such a contract in the future, we will conclude such.
For further unilateral processing of your data above and beyond this by Pinterest Ireland, particularly in terms of potential transfer of your data to the USA, only Pinterest Ireland is responsible. Pinterest Ireland reserves the right to transfer your data even outside of the EEA and thus to a third country (https://policy.pinterest.com/de/privacy-policy#section-residents-of-the-eea). Pinterest Ireland uses cookies and other technologies to collect data from you. For information on the purposes and legal basis of this processing, please view the Pinterest Privacy Policy (https://policy.pinterest.com/de/privacy-policy).
l. YouTube
We maintain an offering at www.youtube.com.
When you visit our channel, various data are collected and processed. For a proportion of the processing taking place on www.youtube.com, we are jointly responsible together with Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ('Google Ireland’) in terms of data protection law; for other data processing, we alone are responsible or Google Ireland alone is responsible.
If you contact us on YouTube, we process your name as well as further information that you communicate to us directly or via the comment function. Responsibility for processing this data lies solely with us. These data that you communicate to us are processed based on Art. 6 (1) f) GDPR and pursue our legitimate interests in an appropriate and interactive corporate presentation.
Together with ‘YouTube Analytics’, we can jointly measure and analyse the visitors’ interactions with our Pinterest website. However, we can access only aggregated and anonymised data, not allowing us to identify individual users. Google Ireland currently does not offer a contract on joint responsibility. Should Google Ireland offer such a contract in the future, we will conclude such.
For further unilateral processing of your data above and beyond this by Google Ireland, particularly in terms of potential transfer of your data to the USA, only Google Ireland is responsible. Google Ireland uses cookies and other technologies to collect data from you. For information on the purposes and legal basis of this processing, please view the Google Privacy Policy (https://policies.google.com/privacy). Please note that when you visit the www.youtube.com website, Google Ireland can collect and process data about you even if you do not have a YouTube account or are not logged in to YouTube. However, we do not know which data Google Ireland collects from you and the purposes for which they are processed.
m. LinkedIn
We maintain an offering at www.linkedin.com.
When you visit our offering, various data are collected and processed. For a proportion of the processing taking place on www.linkedin.com, we are jointly responsible together with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (‘LinkedIn Ireland’) in terms of data protection law; for other data processing, we alone are responsible or Meta Platforms Ireland alone is responsible.
If you contact us on LinkedIn, we process your name as well as further information that you communicate to us. Responsibility for processing this data lies solely with us. These data that you communicate to us are processed based on Art. 6 (1) f) GDPR and pursue our legitimate interests in an appropriate and interactive corporate presentation.
Together with LinkedIn Ireland, we are responsible for the ‘Page Insights’ function, with which we receive aggregated and anonymised statistical evaluations regarding your use and interaction with our offering. You can view the agreement on joint responsibility according to Art. 26 GDPR using the following link: https://legal.linkedin.com/pages-joint-controller-addendum.
For further unilateral processing of your data above and beyond this by LinkedIn Ireland, particularly in terms of potential transfer of your data to the USA, only LinkedIn Ireland is responsible. LinkedIn Ireland uses cookies and other technologies to collect data from you. For information on the purposes of the data processing and the legal basis on which it takes place, please visit the LinkedIn Cookie Policy (https://de.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy) as well as LinkedIn’s Privacy Policy (hhttps://de.linkedin.com/legal/privacy-policy?trk=lithograph_footer-privacy-policy).
Please note that when you visit the www.linkedin.com website, LinkedIn Ireland can collect and process data about you even if you do not have a YouTube account or are not logged in to YouTube. However, we do not know which data LinkedIn Ireland collects from you and the purposes for which they are processed.
3. Transfer to a third country
Using the businesses stated under 2. f. to m., your data may be transferred to a third country and thus outside of the EEA. You can find details in each description.
4. Data recipients
When you visit our website, initially only the service providers and businesses named above are recipients of your data. Moreover, service providers we enlist support us in servicing, maintaining and further developing our website, processing your data only upon our instruction and on our behalf.
Your data are forwarded above and beyond this only due to a statutory obligation, such as to authorities or to avert, assert, exercise or defend legal claims.
5. Requirement of data collection
You are not duty bound contractually or statutorily to provide the data described in this Privacy Policy.
6. Rights of the data subject
According to the GDPR, you have the following rights and claims against the controller:
- the Right to Obtain Information (Art. 15 GDPR)
- the Right to Rectification (Art. 16 GDPR)
- the Right to Erasure (Art. 17 GDPR)
- the Right to Limitation of Processing (Art. 18 GDPR)
- the Right to Data Transmission (Art. 20 GDPR)
You also have the right to revoke previously granted consent with effect for the future at any time. This applies also to consents for cookies and other technologies.
7. Right to revocation of the data subject pursuant to Art. 21 GDPR
According to Art. 21 GDPR, the data subject has the right to lodge an objection at any time to the data processing concerning the data subject rendered based on Art. 6 (1) f) resulting from his/her particular situation with effect for the future.
The data controller shall no longer process the personal data of the data subject unless the data controller can prove compelling and legitimate grounds outweighing the data subject’s interests, rights, and freedoms or the processing serves to assert, exercise or defend legal claims.
The data subject may object to data processing for the purpose of direct advertising at any time with effect for the future. In the event of revocation, the data controller shall cease and desist from any further data processing for the purpose of direct advertising.
8. Right of complaint to a supervisory authority
The data subject has the right to complain to a supervisory authority according to Art. 77 GDPR. According to this, each data subject shall have the right to lodge a complaint with a supervisory authority without prejudice to any other administrative or judicial remedy, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes GDPR.
The following data protection supervisory authority is responsible for us:
The Commissioner for Data Protection and Freedom of Information of Hesse
Gustav-Stresemann-Ring 1
65189 Wiesbaden
The online complaint form can be found under the following link:
https://datenschutz.hessen.de/service/beschwerde
However, you can by all means firstly contact us too. As is well known, many matters can be clarified in a telephone call.
This form is protected by reCAPTCHA - the Google Privacy Policy and Terms of Service apply.