Free shipping on orders over €29 in Germany / €50 in the EU and Switzerland
A. Website Privacy Policy
B. Data protection declaration for social media sites
As of: 05/2022
We only process users’ personal data (hereinafter “data”) to the extent that this is necessary to provide a functional and convenient website as well as our content and services.
“Processing” refers to the collection, use, disclosure and/or storage. According to the EU General Data Protection Regulation (hereinafter “GDPR”), “personal data” is basically all data that can be used to identify a natural person. The exact definitions of the terms are set out in Article 4 GDPR.
The following information informs you in particular about the type, scope, purpose, duration and legal basis of the processing of personal data, the purposes and means of processing which we decide alone or jointly with others, as well as about the optimization and quality of use we may decide on Components used by third parties who process data under their own responsibility:
I. Information about the person responsible
II. User rights
III. Information on data processing
The person responsible (hereinafter “provider”) within the meaning of the GDPR and other national data protection laws of the member states as well as other data protection regulations is:
Scheller Cosmetics GmbH
Hinterer Holzweg 36
73733 Esslingen a.N.
Mobile phone: +49/ (0)160/ 99400488
E-mail: hello@ecoelio.com
With regard to the processing of their personal data described below by the provider, the user has the right to
1. to request confirmation as to whether the data concerning him is being processed and for precise information about this data as well as further information and copies of the data in accordance with Art. 15 GDPR;
2. to demand the immediate correction of incorrect data concerning him or the completion of this data in accordance with Art. 16 GDPR;
3. to demand that the data concerning him be deleted immediately in accordance with Article 17 GDPR, alternatively, if, for example, further processing is necessary in accordance with Article 17 Paragraph 3 GDPR, a restriction on the processing of the data in accordance with Article 18 GDPR to demand;
4. that he receives the data concerning him and provided by him in accordance with Article 20 GDPR and to request that they be transmitted to other responsible persons;
5. to file a complaint with the supervisory authority in accordance with Art. 77 GDPR if the user is of the opinion that the processing of their data by the provider violates the GDPR.
6. In principle, the user can object to the future processing of data concerning him, which is carried out by a person responsible on the basis of Art. 6 Para. 1 lit. f GDPR, at any time in accordance with Art. 21 GDPR. The objection can in particular be made against processing for direct advertising purposes.
7. The provider is also obliged to communicate any correction or deletion of personal data or a restriction of processing that occurs on the basis of Article 16 GDPR, Article 17 Paragraph 1 GDPR and Article 18 GDPR to all recipients of the data to whom the data is received from him were disclosed. The obligation does not apply if this notification proves to be impossible or involves disproportionate effort. The user has the right to information regarding these recipients.
If no detailed information is provided below about the individual data processing, the user's data processed by the provider will be deleted or blocked as soon as the purpose of storage no longer applies and deletion does not conflict with any legal retention obligations.
For communication and security reasons, the following data, which the user's Internet browser transmits to the provider or its web space provider, is collected during the visit to the website (so-called server log files):
– Browser type and version;
– operating system used;
– Website from which the user switched to the provider’s website (referrer URL);
– Website that the user visits;
– Date and time of access;
– User’s Internet Protocol (IP) address.
The data is also temporarily stored. This data is not stored together with other personal data of the user. The legal basis for the temporary storage is Article 6 Paragraph 1 Letter f GDPR based on the legitimate interest in improving the stability, functionality and security of the website.
The data will be deleted after seven days at the latest. Data whose further storage is necessary for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.
a) Cookies
The person responsible uses so-called cookies on his website. Cookies are small text files or other storage technologies that the Internet browser used by the user files and stores on the device. These cookies process certain user information on an individual basis, such as browser and location data and IP address values.
The use allows those responsible to make their website more user-friendly, effective and secure.
The processing serves the legitimate interest of the person responsible in improving the functionality of the website as well as the fulfillment of legal requirements and is based on the legal basis of Article 6 (1) (f) GDPR.
The cookies are deleted when the user closes their browser.
b) Third-party cookies
Cookies from third-party providers may also be used on the provider's website. These third-party providers are partner companies with which the provider cooperates for the purposes of advertising, analysis or the functionality of the website. If this is the case, the purposes and legal basis of the corresponding processing will be set out below.
c) Possibility of elimination
The user can prevent or restrict the installation of cookies by setting the browser accordingly. Cookies that have already been saved can also be deleted at any time. The settings for this depend on the respective browser. With Flash cookies, processing cannot be prevented via the browser settings, but rather by setting the Flash player accordingly. If the user prevents or restricts the installation of cookies, this may result in not all functions of the website being fully usable.
d) Settings
To obtain consent for the use of cookies that are not technically necessary on the website, the provider uses a cookie manager from Borlabs – Benjamin A. Bornschein, Rübenkamp 32, 22305 Hamburg.
When the website is accessed, a cookie with the settings information is stored on the user's device so that consent does not have to be asked on a subsequent visit. This cookie has a lifespan of 12 months.
The cookie is required to obtain legally compliant consent from the user.
The user can prevent or stop the installation of cookies through the settings of their browser. More about this under “Cookie Settings” above.
Here You can also see your cookie consent history.
a) Processing
The personal data provided by the user for the purpose of purchasing goods or services will be processed by the provider for the purpose of contract processing. The data provided is required to conclude the contract; The conclusion of the contract is not possible without the provision of the data. The legal basis for the processing is Article 6 Paragraph 1 Letter b GDPR. After the contract has been fully processed, the user's data will be deleted in consideration of tax and commercial law retention periods.
b) Passing on
As part of the contract processing, the user's personal data will be passed on to the transport company commissioned with the delivery, to the financial service provider or the shop software service provider, to the extent that this is necessary for the contract processing, delivery or payment of the goods. The legal basis for passing on the data is Article 6 Paragraph 1 Letter b GDPR.
Note about PayPal:
If the customer selects the payment service provider PayPal, creditworthiness inquiries may be carried out by PayPal for certain payment methods also selected by the customer. For more information on how PayPal processes the customer's personal data, see below
https://www.paypal.com/de/webapps/mpp/ua/privacy-full .
Note on Stripe:
For payment methods other than PayPal, the provider uses the payment service provider Stripe. This may result in creditworthiness inquiries by Stripe for certain payment methods selected by the customer. For more information on how Stripe processes the customer's personal data, please see
If the user registers for a customer account with the provider, the data entered during this registration (e.g. name, address, email address) will be used exclusively for the fulfillment of a contract or the implementation of pre-contractual measures as well as for the general management of the customer relationship ( e.g. retrieval of previous orders or wish list function) is collected and stored. When registering, the IP address and the date and time of registration are also saved. It will not be passed on to third parties.
If the user has given his consent, the legal basis is Article 6 (1) (a) GDPR. As part of the registration process, the user's consent to the above processing may be obtained and reference will be made to this data protection declaration. The data collected in this way is used exclusively for the aforementioned purpose. It will not be passed on to third parties.
If the opening of the customer account serves to fulfill a contract or to carry out pre-contractual measures, the additional legal basis is Art. 6 Para. 1 lit. b GDPR.
The user can revoke the consent given for the customer account at any time in accordance with Art. 7 Para. 3 GDPR by notifying the provider. The data processed in this context will be deleted as soon as their processing is no longer necessary. If the data is necessary to fulfill a contract or to carry out pre-contractual measures, the user's data will be deleted upon expiry of the tax and commercial law retention periods.
If the user contacts you, the user's personal data entered on this occasion will be used to process the request.
If the contact request serves to fulfill a contract or to carry out pre-contractual measures, such as a price inquiry, the legal basis is Article 6 (1) (b) GDPR.
The user's data will be deleted if the user's request has been answered conclusively and there are no legal retention obligations, such as subsequent contract processing.
The legal basis can also be the user's consent in accordance with Article 6 Paragraph 1 Letter a GDPR.
The user can revoke the consent given for the contact request at any time in accordance with Art. 7 Para. 3 GDPR by notifying the provider. The data processed in this context will be deleted as soon as their processing is no longer necessary.
The provider reserves the right to use the data collected when placing an order for direct advertising by email or post in accordance with Section 7 Paragraph 3 UWG if the user does not object to this use. Direct advertising only includes offers for products or services similar to those already purchased by the user from the provider. The legal basis in this case is Article 6 Paragraph 1 Letter f GDPR. The provider's legitimate interest lies in the economic interest of sales and improving its services.
a) Registration
If the user registers for the provider's free newsletter, the data requested in the input mask (email address and, optionally, name and address) will be processed by a service provider - see Shipping below. In addition, the IP address and the date and time of registration are stored. As part of the registration process, the user's consent is obtained and the content is specifically described. At the same time, reference is made to this data protection declaration.
b) Shipping
The provider uses “MailChimp” to send newsletters. “MailChimp” is a service provided by The Rocket Science Group, LLC, 512 Means Street, Suite 404, Atlanta, GA 30318, USA, hereinafter “The Rocket Science Group”.
It cannot be ruled out that processing by The Rocket Science Group takes place on servers in the USA.
However, according to data protection supervisory authorities, the USA currently does not have an adequate level of data protection. However, there are so-called standard contractual clauses between the provider and The Rocket Science Group:
However, these are private law agreements and therefore have no impact on the access options of the authorities in the USA.
Further information on data protection at The Rocket Science Group:
https://www.intuit.com/privacy/statement/
c) Analysis
The newsletters sent by the provider via The Rocket Science Group contain so-called web beacons, which the provider can use to identify whether and when an email was opened and which links in the newsletter were followed by the user.
This analysis data is stored by the provider alongside the technical data (system data and IP address) so that the newsletter can be optimally tailored to the user's wishes and interests. Accordingly, the data collected is used to constantly improve the quality of the newsletter.
d) Legal basis
The legal basis for sending the newsletter and the analysis is Article 6 Paragraph 1 Letter a. GDPR.
e) Revocation
The user can revoke their consent to this at any time in the future in accordance with Art. 7 Para. 3 GDPR by notifying the provider or using the unsubscribe link contained in the newsletter.
To integrate various functions on the website, the provider uses the Google Tag Manager. The Google Tag Manager is a product of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043 USA, hereinafter “Google”.
The Google Tag Manager's sole function is to upload certain content to the provider's website and to enable the management of these functions by the provider on an interface provided by Google.
When you access the website, the functions are loaded from a Google server, which may also be located in the USA. The server must process the user's IP address in order to transmit the functions.
The corresponding functions are finally listed in the provider’s data protection declaration. Any consent the user may not have given for these functions will also be observed when using the Google Tag Manager.
However, according to data protection supervisory authorities, the USA currently does not have an adequate level of data protection. However, there are so-called standard contractual clauses between the provider and Google:
https://privacy.google.com/businesses/compliance/#!#gdpr
However, these are private law agreements and therefore have no impact on the access options of the authorities in the USA.
The legal basis for this is Article 6 Paragraph 1 Letter f GDPR. The provider's legitimate interest lies in the optimization and economic operation of the website.
This website uses Google Analytics, a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043 USA, hereinafter “Google”.
Google Analytics is used by the provider to analyze the use of the website. The legal basis for this is Article 6 Paragraph 1 Letter a GDPR. The user can revoke their consent to this at any time in the future in accordance with Art. 7 Para. 3 GDPR by changing the cookie settings on the website.
Information, such as the time, location and frequency of the user's website visit, including their IP address, is transmitted to a Google server in the USA and stored there.
However, according to data protection supervisory authorities, the USA currently does not have an adequate level of data protection. However, there are so-called standard contractual clauses between the provider and Google:
https://privacy.google.com/businesses/compliance/#!#gdpr
However, these are private law agreements and therefore have no direct impact on the access options of the authorities in the USA.
The provider uses Google Analytics with an anonymization function. With this addition, Google will in this case shorten the IP address within member states of the European Union or in other contracting states to the Agreement on the European Economic Area.
Google will use the data collected to evaluate the user's visit to the website and to compile reports on website activity for the provider. The data is also used to provide other services related to website use and internet use. Google may also transfer this information to third parties if required by law or if third parties process this data on behalf of Google.
According to its own information, Google will under no circumstances associate the user's IP address with other Google data. Google offers further information, in particular on the options for preventing data use, under the following link:
https://www.google.com/intl/de/policies/privacy/partners
Google also offers a deactivation add-on for the most common browsers, which gives the user more control over what data Google collects about the website the user accesses. The add-on tells Google Analytics' JavaScript (ga.js) that no information about the website visit should be transmitted to Google Analytics. However, the Google Analytics deactivation add-on for browsers does not prevent information from being transmitted to the provider or to other web analysis services that may be used by the provider and listed in this data protection declaration. Further information on installing the browser add-on is available at the following link:
Browser add-on to deactivate Google Analytics
The provider uses the Facebook visitor action pixel on the website, a web analysis and conversion measurement service from Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, a subsidiary of Meta Platforms Inc., 1601 S. California Ave., Palo Alto , CA 94304, USA, hereinafter “facebook”.
The Facebook visitor action pixel is used by the provider to analyze the use of the website and to advertise its services on the Facebook platform. The legal basis for this is Article 6 Paragraph 1 Letter a GDPR. The user can revoke their consent to this at any time in the future in accordance with Art. 7 Para. 3 GDPR by changing the cookie settings on the website.
The use of the visitor action pixel creates a connection with the Facebook server in the USA. This means that the IP address and information about the user's browser are recorded by Facebook. Facebook also records an individual pixel ID and the user's associated website activities.
However, according to data protection supervisory authorities, the USA currently does not have an adequate level of data protection. However, there are so-called standard contractual clauses between the provider and Facebook. However, these are private law agreements and therefore have no direct impact on the access options of the authorities in the USA.
Based on this processing, Facebook is able to show the user personalized advertising from the provider on Facebook or a third-party site. Conversion measurement also enables the provider to use a cookie to record and evaluate the behavior of users after clicking on a Facebook ad and being redirected to the provider's website. This allows the provider to optimize its Facebook advertisements.
Further information on the collection and use of data by Facebook as well as the relevant rights and options for protecting the user's privacy can be found in Facebook's data protection information:
https://www.facebook.com/policy.php
The provider uses a tool from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043 USA, hereinafter “Google” to display video sequences on the website. a.
The legal basis for this is Article 6 Paragraph 1 Letter a GDPR. The user can revoke their consent to this at any time in the future in accordance with Art. 7 Para. 3 GDPR by changing the cookie settings on the website.
The provider uses YouTube with the “extended data protection mode” option offered by YouTube.
If the user visits a page that has an embedded video, a connection is established to the Google servers in the USA and the content is displayed on the website via a message to the user's browser. For this purpose, Google processes at least the IP address, the date, the time and the page visited by the user. This also leads to a connection with the Google Double-Click advertising network. If the user is logged in to YouTube at the same time, the connection information is assigned to the user's YouTube member account.
However, according to data protection supervisory authorities, the USA currently does not have an adequate level of data protection. However, there are so-called standard contractual clauses between the provider and Google:
https://privacy.google.com/businesses/compliance/#!#gdpr
However, these are private law agreements and therefore have no direct impact on the access options of the authorities in the USA.
According to Google, in “enhanced data protection mode” no information about users is stored on the website unless they watch the embedded video.
If the user wants to prevent Google from directly assigning the collected information to their user account, the user must log out of YouTube before visiting the website. It is also possible to configure the user account accordingly.
Google also uses permanent cookies for functionality and analysis.
If the user does not agree to this processing, it is possible to prevent the installation of cookies by setting the browser accordingly. For more information, see “Cookies” above.
Further information on the collection and use of data by Google as well as the related rights and options for protecting the user's privacy can be found in Google's data protection information:
https://policies.google.com/privacy
The provider uses a link to the social networks listed below on the website.
The plugins are integrated via a linked graphic. Only by clicking on the corresponding graphic will the user be redirected to the service of the respective social network.
After the customer has been forwarded, information about the user is collected by the respective network. First of all, this is data such as IP address, date, time and page visited. If the user is logged into their user account of the respective network, the network operator may be able to assign the collected information from the user's specific visit to the user's personal account. If the user interacts via a “share” button on the respective network, this information can be saved in the user’s personal user account and, if necessary, published. If the user wants to prevent the collected information from being directly assigned to his user account, the user must log out before clicking on the graphic. It is also possible to configure the respective user account accordingly.
The following social networks are linked by the provider:
Facebook – Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.
Data protection: https://www.facebook.com/policy.php
Instagram – Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.
Data protection: https://help.instagram.com/519522125107875
We use so-called social media platforms to advertise our products and services and to communicate with interested parties or customers.
The following information will inform you in particular about the type, scope, purpose, duration and legal basis of the processing of personal data when you visit one of our company presentations on a social media platform or contact us via it.
“Processing” refers to the collection, use, disclosure and/or storage. According to the General Data Protection Regulation (hereinafter “GDPR”), “personal data” is basically all data that can be used to identify a natural person. The exact definitions of the terms are set out in Article 4 GDPR.
I. Information about the joint controllers
II. User rights
III. Information on data processing
For all social media platforms mentioned below
Scheller Cosmetics GmbH
Hinterer Holzweg 36
73733 Esslingen a.N.
Mobile phone: +49/ (0)160/ 99400488
E-mail: hello@ecoelio.com
– hereinafter referred to as “provider” –
jointly responsible with the platform operator named below within the meaning of Art. 26 GDPR.
The provider is on the social media platform “facebook” and “Instagram” together with
Meta Platforms Ireland Limited
4 Grand Canal Square
Grand Canal Harbor
Dublin 2 Ireland
responsible.
The data protection officer of Meta Platforms Ireland Limited can be reached via a contact form. More information about this and general data protection regulations:
https://www.facebook.com/privacy/explanation
The jointly responsible parties have regulated the respective obligations under the GDPR in an agreement. This agreement is available at the following link:
https://www.facebook.com/legal/controller_addendum
Regardless of the details of the agreement, you can assert your rights under the GDPR with and against each of the data controllers.
With regard to the processing of their personal data by those responsible as set out below, the user has the right to
1. to request confirmation as to whether the data concerning him is being processed and for precise information about this data as well as further information and copies of the data in accordance with Art. 15 GDPR;
2. to demand the immediate correction of incorrect data concerning him or the completion of this data in accordance with Art. 16 GDPR;
3. to demand that the data concerning him be deleted immediately in accordance with Article 17 GDPR, alternatively, if, for example, further processing is necessary in accordance with Article 17 Paragraph 3 GDPR, a restriction on the processing of the data in accordance with Article 18 GDPR to demand;
4. that he receives the data concerning him and provided by him in accordance with Art. 20 GDPR and the further right to request that they be transmitted to other responsible parties;
5. to file a complaint with the supervisory authority in accordance with Art. 77 GDPR if the user is of the opinion that the processing of their data by a controller violates the GDPR.
6. In principle, the user can object to the future processing of data concerning him, which is carried out by a person responsible on the basis of Art. 6 Para. 1 lit. f GDPR, at any time in accordance with Art. 21 GDPR. The objection can in particular be made against processing for direct advertising purposes.
7. The controller is also obliged to communicate any correction or deletion of personal data or a restriction of processing that occurs on the basis of Article 16 GDPR, Article 17 paragraph 1 GDPR and Article 18 GDPR to all recipients of the data to whom the data has been disclosed . The obligation does not apply if this notification proves to be impossible or involves disproportionate effort. The user has the right to information regarding these recipients.
In order to promote its products and services as well as to communicate with interested parties or customers, the provider maintains a company presence on the following platform(s).
The legal basis for the resulting processing of personal data, which is described below for each platform, is Article 6 Paragraph 1 Letter f of the GDPR. The provider's legitimate interest lies in the analysis, communication, sales and promotion of its products and services.
The legal basis can also be the user's consent to the platform operator in accordance with Article 6 Paragraph 1 Letter a of the GDPR. The user can revoke his consent to this at any time in the future in accordance with Art. 7 Para. 3 GDPR by notifying the platform operator.
When you access the provider's online presence on the "Facebook" and "Instagram" platforms, Meta Platforms Ireland Limited, as the operator of both platforms in the EU, processes user data (e.g. personal information, IP address, etc.). This user data provides the provider with statistical information about the use of its company presence on “Facebook” and “Instagram”.
Meta Platforms Ireland Limited uses this data in particular for market research and advertising purposes and to create user profiles. Using these profiles, Meta Platforms Ireland Limited is able, for example, to advertise to users within and outside of “Facebook” and “Instagram” based on their interests. If the user is logged into their “Facebook” or “Instagram” account at the time of access, Meta Platforms Ireland Limited can also link the data to the respective user account.
If the user contacts the provider via “Facebook” or “Instagram”, the user’s personal data entered on this occasion will be used to process the request. The user's data will be deleted by the provider if the user's request has been answered conclusively and there are no legal retention obligations, such as in the event of subsequent contract processing.
To process the data, Meta Platforms Ireland Limited may also set cookies.
If the user does not agree to this processing, it is possible to prevent the installation of cookies by setting the browser accordingly. Cookies that have already been saved can also be deleted at any time. The settings for this depend on the respective browser. With Flash cookies, processing cannot be prevented via the browser settings, but rather by setting the Flash player accordingly. If the user prevents or restricts the installation of cookies, this may result in not all of Facebook's functions being fully usable.
Further information on the processing activities, their prevention and the deletion of the data processed by Meta Platforms Ireland Limited can be found in the data policy of “facebook” and “Instagram”:
https://www.facebook.com/privacy/explanation
https://help.instagram.com/519522125107875
It cannot be ruled out that processing by Meta Platforms Ireland Limited will also take place via Meta Platforms Inc., 1601 Willow Road, Menlo Park, California 94025 in the USA.
You are currently viewing a placeholder content from Klaviyo. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More information