The point of contact and the so-called controller for the processing of your personal data when you visit this website within the meaning of the General Data Protection Regulation (GDPR) is

Lillydoo GmbH Hanauer Landstraße 147-149 60314 Frankfurt am Main

Telephone: +49 (0) 69 643 57 420

Email: service@lillydoo.de

If you have any questions about data protection in connection with the use of our website, you can also contact our data protection officer at any time. She can be reached at the above address and at the email address: privacy@lillydoo.com (subject line: "For the attention of the data protection officer"). We would like to expressly point out that if you use this email address, the contents will not be viewed exclusively by our data protection officer. If you wish to exchange confidential information, we kindly request that you first contact us directly via this email address.

2.1 Accessing Our Website/Connectivity Data

Every time you use our website, we collect connection data that your browser automatically transmits to enable you to visit the website. This connection data includes the so-called http header information, including the user agent, and includes in particular:

• IP address of the requesting device,
  method (e.g. GET, POST), date and time of the request,
• address of the requested website and path of the requested file,
• if applicable, the previously accessed website/file (HTTP referrer),
• information about the browser and operating system used,
• HTTP protocol version, HTTP status code, size of the file delivered,
• request information such as language, type of content, content encoding, character sets,
• if applicable, the username used in the case of authentication with directory password protection.

The processing of this connection data is absolutely necessary to enable you to visit the website, to ensure the long-term functionality and security of our systems and for general administrative maintenance of our website. The connection data is also stored in internal log files for a limited time and only to the extent necessary for the purposes described above in order to find the cause and take action against it.

The legal basis for this is Art. 6 (1) (b) GDPR, insofar as the page view occurs in the course of the initiation or execution of a contract, and otherwise Art. 6 (1) (f) GDPR based on our legitimate interest in enabling the website to be accessed and the long-term functionality and security of our systems. However, the automatic transmission of the connection data and the log files developed from it does not constitute access to the information in the end device within the meaning of the implementing laws of the ePrivacy Directive of the EU member states; in Germany, § 25 of the German Teleservices Data Protection Act (TDDDG). However, it would be absolutely necessary in any case.

The log files are stored for 10 days and then anonymized.

2.2 Contact and Customer Service

You have various options to get in touch with us. These include the contact form, live chat, event registration, callback service, or as part of appointment scheduling. In this context, we process your data exclusively for the purpose of communicating with you.

The legal basis for this is Art. 6 (1) (b) of the GDPR, insofar as your information is required to respond to your inquiry or to initiate or execute a contract. Otherwise, processing is based on our legitimate interest pursuant to Art. 6 (1) (f) of the GDPR, enabling you to contact us and allowing us to respond to your inquiry efficiently.

The data collected during contact will be automatically deleted after your inquiry has been fully processed, unless we still need your inquiry to fulfill contractual or legal obligations.

2.2.1 Dixa

We use the service Dixa, provided by Dixa ApS, Vimmelskaftet 41A, 1 Sal., 1161 Copenhagen, Denmark, for customer management. Dixa particularly supports us in optimally serving existing customers through features like live chat and community software, as well as optimizing sales processes.

In this context, Dixa processes contact information (e.g., name, address, phone number, email), content data (e.g., photographs), and the data you have entered.

The processing of personal data through Dixa is based on Article 6(1)(b) GDPR where necessary for the performance of a contract or pre-contractual measures, and on Article 6(1)(f) GDPR based on our legitimate interest in providing efficient customer support and managing customer relationships.

For more detailed information about data processing by Dixa, please refer to Dixa's privacy policy.

2.2.2 Use of Claude in customer service

As part of our customer service, we use the Claude language model. For customers in the European Economic Area, the provider is generally Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland.

Claude processes customer enquiries and the associated ticket data in order to analyse, translate and categorise enquiries, to draft suggested replies and to tag and assign tickets. In addition, summary evaluations are carried out to improve our customer communication and support processes. Suggested replies are reviewed by our employees before they are sent; no individual assessment of customers or employees takes place.

In this context, contact, communication, contract and ticket data in particular are processed. The legal basis is Art. 6(1)(b) GDPR insofar as this is necessary to handle your enquiry or to perform the contract, and otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in efficient customer service. Anthropic processes the data on our behalf. Further information can be found at https://www.anthropic.com/legal/privacy.

2.2.3 Aircall

For conducting phone appointments as part of our customer support, we use the cloud telephony service Aircall, provided by Aircall SAS, 11 Rue Saint-Georges, 75009 Paris, France.

Aircall processes your phone number for the purpose of providing the telephone software.

The processing of personal data through Aircall is based on Article 6(1)(b) GDPR where necessary for the provision of customer support and the handling of customer inquiries.

For more information on Aircall's data privacy practices, please visit: https://aircall.io/privacy/

2.2.4 ChatGPT

To enable quick and efficient processing of customer inquiries, we use the AI-based application ChatGPT, which is integrated with the systems Shopify, Recharge, and 7Senders. ChatGPT is a service provided by OpenAI OpCo, L.L.C., 1960 Bryant Street, San Francisco, California 94110, USA.

When you submit an inquiry, it is manually entered into ChatGPT by one of our employees. ChatGPT then analyzes the inquiry using Natural Language Processing (NLP), automatically retrieves relevant information from the connected systems, and generates a response proposal based on this data. Access is made through systematic API calls, and only the data required to answer your specific inquiry is retrieved. Specifically, the following personal data may be involved:

• Shopify: Information about orders, products, or customer data
• Recharge: Information about subscriptions and payment details
• 7Senders: Shipping status and tracking information

The response generated by ChatGPT is always reviewed and, if necessary, adjusted by an employee before it is sent to you. This ensures that our employees maintain full control over customer communication at all times.

The processing of personal data through ChatGPT is based on Article 6(1)(f) GDPR and our legitimate interest in efficiently handling and responding to customer inquiries.

For more information about data processing by ChatGPT, please visit https://openai.com/policies/privacy-policy/.

2.2.5 AI Agents for Customer Support (Zowie)

You can contact us with questions or concerns via our website chatbot, email, or WhatsApp. In this context, we use the functionalities of the automated AI agent provided by Zowie, Inc., 8 The Green, Dover, DE 19901, USA ("Zowie"). At any time, you can request a human representative via any communication channel, call us directly, or request a callback.

When interacting with our AI agents, the following data may be processed by our service provider Zowie, depending on your usage and requests:

• Device data: e.g. information about your (mobile) device, operating system, app and browser, device ID
• Communication data: e.g. messages and emails sent, customer inquiries and requests
• Contact data: e.g. email address, phone number
• Usage data: e.g. chatbot interactions, pages visited, time and duration of access
• Master data: e.g. first name, last name, address
• Connection data: e.g. HTTP header information, user agent
• Contract data: e.g. customer number, orders, deliveries
• Payment data: e.g. payment method

Access to your account-related data only occurs if you have been sufficiently authenticated.

Data processing takes place for the receipt, review, fulfillment, and response to customer inquiries, in particular for the following purposes:

• Reviewing the request, identifying its intent, and potentially forwarding it to a human agent
• Generating responses using your request and, where applicable, information from your customer account
• Adjusting, postponing, or cancelling orders or subscriptions
• Analyzing conversation history to assess response quality, identify and fix errors, and optimize the AI agent
• Aggregated analysis of frequently occurring topics to improve help content and FAQs
• Aggregated evaluation of metadata such as message delivery, read, or send metrics
• Analysis of user behavior and chatbot interactions

The legal basis is Art. 6(1)(b) GDPR (contract performance and pre-contractual measures, potentially in conjunction with Art. 22(2)(a) GDPR), Art. 6(1)(f) GDPR (legitimate interest in improving the AI agent, enhancing information quality, and analyzing aggregated metadata), and Art. 6(1)(a) GDPR (consent for website usage analysis and storage/access of information on your device).

Our legitimate interest is to improve the quality of the AI agent's responses, adapt public information to customer needs, and understand usage levels of the AI agent. You may contact us at any time if you believe the AI agent has not correctly understood or implemented your request.

If you contact our AI agent via WhatsApp, your data is also processed by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, which facilitates communication between you and us as a telecommunications service provider. WhatsApp uses end-to-end encryption between you and 360dialog GmbH, Torstraße 61, 10119 Berlin, Germany, so that neither WhatsApp nor third parties can access message content in plain text. 360dialog decrypts messages so the AI agent can process them. WhatsApp Ireland Limited also acts as a processor for additional data such as your name, phone number, and usage metadata (e.g. number of messages sent, delivered, or read).

Where data is transferred to WhatsApp LLC, 1 Meta Way, Menlo Park, CA 94025, USA, this is covered by the EU–US Data Privacy Framework adequacy decision.

Zowie is also certified under the EU–US Data Privacy Framework, allowing data transfers to the USA based on an adequacy decision.

Further information on data processing by Zowie can be found at: https://getzowie.com/privacy-policy

2.3 Registration

You have the option to register for our login area in order to be able to use the full range of functions on our website. We have highlighted the data that you are required to provide by labeling the fields as mandatory. It is not possible to register without this data. The legal basis for the processing of the data required for registration is Art. 6 (1)(b) GDPR. For all other data, the legal basis is our legitimate interest pursuant to Art. 6 (1)(f) GDPR in order to enable you to personalize, adjust, and modify your account.

2.4 Orders

During the ordering process, we collect the mandatory information necessary for the contract:

• title,
• first and last name,
• date of birth,
• email address,
• password,
• billing and shipping address.

You can optionally provide your phone number so that we can contact you if we have any questions. The legal basis for the processing is Art. 6 (1)(b) GDPR; for optional data, Art. 6 (1)(f) GDPR, in order to enable you to provide additional information to facilitate faster contact.

2.5 Newsletter

You have the option to subscribe to our newsletter, in which we regularly inform you about new developments regarding our products and promotions.

We use the so-called double opt-in procedure for newsletter orders, i.e. we will only send you the newsletter by email if you confirm in our notification email by clicking on a link that you are the owner of the email address provided. If you confirm your email address, we store your email address, the time of registration and the used IP address until you unsubscribe from the newsletter. The storage serves the sole purpose of sending you the newsletter and to be able to prove your registration. You can unsubscribe from the newsletter at any time. A corresponding unsubscribe link can be found in each newsletter. A message to the contact details given above or in the newsletter (e.g. by e-mail or letter) is of course also sufficient. The legal basis for the processing is your consent in accordance with Art. 6 (1)(a) GDPR.

For certain newsletters (e.g. the #momlife newsletter), we store further data about you (e.g. for the #momlife newsletter, your calculated due date and your pregnancy week), which can be seen in the respective input fields of the registration and which we need to send you this newsletter. The legal basis for this data processing is Art. 6 (1)(a) GDPR. Art. 9 (2)(a) GDPR as those data are considered health data according to Art. 9 (1) GDPR.

So that we can provide you with our print magazine the #momlife pregnancy guide, we need your address in addition to the information from the #momlife newsletter. The legal basis for this data processing is Art. 6 (1) (b) GDPR.

For sending our newsletters, we work with service providers to whom we transmit, among other things, your e-mail address and your newsletter registration in order to be able to send you the newsletters. The legal basis for this data processing is Art. 6 (1) (a) GDPR.

We use standard technologies in our newsletters to measure interactions with the newsletters (e.g. opening the email, clicking on links). We use this data in pseudonymous form for general statistical evaluations and to optimize and further develop our content and customer communication. This is done, on the one hand, with the help of small graphics embedded in the newsletter (so-called pixels) that connect to the image server when the email is opened. On the other hand, we use links that initially register the click and then forward you to the desired target page. In addition, we measure whether our newsletter could be delivered at all.

The legal basis for this is your consent in accordance with Art. 6 (1) (a) GDPR. Access to the information in the terminal device is then based on the implementing laws of the ePrivacy Directive of the EU member states, in Germany according to § 25 (1) TDDDG. We want to use our newsletter to share content that is as relevant as possible to our customers and to better understand what you are actually interested in. If you do not want your usage behavior to be analyzed, you can unsubscribe from the newsletter. You can prevent the opening of an email from being measured by disabling graphics or the output of HTML content in your email program by default.

2.6 Existing Customer Advertising by E-Mail

If you register with us or make a purchase from us, we will also use your contact information to send you further information about our products that may be relevant to you ("existing customer advertising"). This may include, in particular, new products, promotions and offers, as well as feedback and other surveys.

The legal basis for this data processing is Art. 6 (1)(f) GDPR in conjunction with § 7 (3) of the German Act Against Unfair Competition (UWG), according to which data processing is permissible for the purpose of safeguarding legitimate interests, insofar as this concerns the storage and further use of the data for advertising purposes. You can object to the promotional use of your data at any time by means of a corresponding link in the e-mails or by notifying us at the contact details given above (e.g. by e-mail or letter), without incurring any costs other than the transmission costs according to the basic rates.

2.6.1 Product Reviews via Judge.me

We use the review app Judge.me on our website. This service is provided by JUDGE.ME LTD, 1-3 Worship Street, London, England, EC2A 2AB. Judge.me allows our customers to submit product reviews and enables us to display them in our online shop.

As part of using Judge.me, the following personal data in particular is processed:

• Name and email address
• Content of submitted reviews
• Order and shipping information
• Email performance and tracking data
• IP address for geolocation purposes.

The legal basis for processing your personal data in connection with the sending and publication of product reviews is your consent pursuant to Art. 6(1)(a) GDPR.

The transfer of data to Judge.me in the United Kingdom is based on the adequacy decision of the European Commission in accordance with Art. 45 GDPR.

For more information on how Judge.me processes personal data, please refer to Judge.me's privacy policy.

2.7 Surveys

You have the opportunity to participate in one of our surveys via email, web and direct links. We use the results of these surveys to improve our services. For conducting and analyzing customer satisfaction surveys (e.g., Net Promoter Score), we use the service provider Grapevine, Union Works Limited, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.

Grapevine processes survey-related data on our behalf, including your name, email address, survey responses, NPS score and comments. The survey results may be transferred to our marketing tool Klaviyo and assigned to the corresponding customer profiles in order to measure customer satisfaction and improve our services.

The legal basis for processing your data in connection with your participation in the survey, including the responses you provide, is your consent in accordance with Art. 6 (1) (a) GDPR. The sending of survey invitations by email is based on your consent in accordance with Art. 6 (1) (a) GDPR. For sending surveys via email, we use a double opt-in procedure: You will first receive an email asking you to confirm that you would like to receive survey invitations. Your registration is only activated after clicking the confirmation link. This ensures that you are indeed the owner of the email address provided. Once confirmed, we store the following data:

• Your email address
• The date and time of registration
• The IP address used at the time of registration

You may withdraw your consent at any time. Each survey email includes an unsubscribe link. Alternatively, you may send an informal request to the contact details provided in the imprint or the respective email.

In cases where personal data is transferred to the USA or other third countries, such transfer is carried out on the basis of Art. 44 et seq. GDPR, applying appropriate safeguards (e.g., standard contractual clauses). For more information on how Grapevine processes personal data, please refer to Grapevine's privacy policy.

2.8 Data Processing in Connection with Raffles

You have the opportunity to take part in competitions that we advertise.

By taking part in competitions that we advertise, participants expressly agree that we may use and store the personal data required for the competition until the competition has ended. For this purpose, your contact details, such as your name, address and email address, will be processed by our marketing department.

The legal basis for this is Art. 6 (1) (a) GDPR. Participants can revoke their consent at any time by contacting us. After the competition has ended, your data will be deleted after 7 days.

2.9 Applications

You can apply for vacancies with us by email or via our careers portal. The purpose of collecting this data is to select applicants for possible employment. To process your application, we collect the data you provide (usually: first and last name; email address; application documents such as certificates and CV; date of earliest possible job entry; telephone number if applicable, salary expectations). We would like to point out that if applications are sent unencrypted by email, confidentiality cannot be guaranteed. As a rule, you can also apply for our jobs by post.

We use the Recruitee software from Recruitee B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands, to provide our careers portal at https://we.are.lillydoo.com and to manage applications ("Recruitee"). We have concluded a data processing agreement with Recruitee. The legal basis for the processing of your application documents is Art. 6 (1) (b) and Art. 88 (1) GDPR in conjunction with § 26 (1) sentence 1 BDSG.

When visiting the careers portal, log files (server logs, error logs) are also created (see section 2.1). For more information, please refer to Recruitee's explanations at the end of the privacy policy on the career portal. The legal basis for this is Recruitee's legitimate interest in providing the career portal, Art. 6 (1) (f) GDPR. Insofar as information is read out or stored on your end device when you access our careers portal (e.g. storing the language in a cookie), this is absolutely necessary to provide the careers portal and is carried out on the basis of the implementing laws of the ePrivacy Directive of the EU member states, in Germany according to § 25 (2) TDDDG.

We store your personal data upon receipt of your application. If we accept your application and you are employed, we store your application data for as long as it is required for the employment relationship and to the extent that statutory provisions require its retention.

If we reject your application, we will store your application data for a maximum of six months after your application has been rejected, unless you give us your consent to store it for longer. If you have given us your separate consent, we will store the data you provided as part of your application in our pool of applicants for a further twelve months after the application process has ended in order to identify any other interesting positions for you and to contact you again if necessary. After this period has expired, the data will be deleted. You can revoke this consent at any time for the future by sending us an e-mail to career@lillydoo.com.

2.10 Payment Options and Payment Service Providers

For orders in our online store, we offer you the most common online payment methods: credit card, PayPal, SEPA direct debit or invoice. Depending on the payment method selected in the ordering process, we provide your specified data (e.g. Bank details or credit card details) for payment processing to the bank/credit institution commissioned with the payment or to the commissioned payment service provider. Without this transmission of the payment data to the payment service provider or the bank/credit institution, the payment and contract processing is not possible. The legal basis for this data processing is Art. 6 (1) (b) GDPR. In:

• Unzer GmbH, Vangerowstraße 18, 69115 Heidelberg. Further information about Unzer can be found in Unzer's privacy policy: https://www.unzer.com/de/datenschutz/
• PayOne GmbH, Loyner Straße 9, 60528 Frankfurt a.M. Further information about PayOne can be found in the PayOne data protection guidelines: https://www.payone.com/DE-en/data-protection-regulations
• PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. For more information about PayPal, please see the PayPal privacy policy: https://www.paypal.com/de/legalhub/paypal/privacy-full

If you choose the payment option Purchase on Invoice or SEPA, our payment service providers will use Unzer (Unzer GmbH, Avangerowstraße 18, 69115 Heidelberg) to check your creditworthiness. Further information about Unzer can be found in Unzer's privacy policy.

2.11 Loqate

To ensure that no incorrect address data is stored in our system, we use the "Global Address" service provided by GB Group PLC, The Foundation, Herons Way, Chester Business Park, Chester, CH4 9GB, United Kingdom ("Loqate") for appropriate data validation. We have concluded a data processing agreement with Loqate. Your address (no other personal data is processed) is checked for validity as it is entered via an online interface and is not stored by Loqate. If an error is detected in the address you enter, an alternative address or the correct spelling of your address will be suggested. Your data is compared with the Loqate database, which is located in the United Kingdom, via the interface. The Commission has issued a corresponding adequacy decision for the United Kingdom in accordance with Art. 45 (1) GDPR, which legitimizes the transfer and processing of your data in the United Kingdom.

The processing of your data itself is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in ensuring that valid data is stored so that we can guarantee a smooth processing of customer enquiries and orders can be guaranteed.

Further information on data protection at Loqate can be found at: https://www.loqate.com/de/datenschutzerklärung-für-produkte-und-dienstleistungen/.

2.12 Security Service Providers

2.12.1 Link11

For IT security purposes (e.g. to increase the security of our website against fraud attacks, to ensure DDoS protection and to protect your customer experience from the consequences of malicious bots), we use the services of the Germany-based IT service provider Link11 GmbH, Lindleystraße 12, 60314 Frankfurt am Main. When you, as a user, access our website, several requests are sent to us for the respective page to be visited and we send back the content to be displayed. The request contains all the information we need to display the appropriate content to you: browser information, which page to call up, any forms that have been sent (e.g. in the checkout), passwords when logging in, etc. The requests are encrypted. Link11 can only access these requests to analyze them for bots. In addition, the following data is transmitted: IP address, access time, access date, requested URL, user agent, referrer.

The legal basis is our legitimate interest (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement with Link11.

The functionality of the website cannot be guaranteed without the processing by the IT security service provider. Your personal data will be stored by the provider for as long as is necessary for the purposes described. IP addresses are generally stored for 96 hours.

Further information on objection and removal options vis-à-vis the provider can be found at the provider's website.

2.12.2 Cloudflare

On our website, we also use content delivery network services provided by Cloudflare Inc., 701 Townsend St., San Francisco, CA 94107 (USA).

With the help of a content delivery network, the contents of our website are stored on the service provider's server. The service provider's server distributes this content to you or your browser when you access our website. Cloudflare processes, for example, your IP address and DNS log data.

We use Cloudflare to defend against attacks such as DDoS or bot attacks on our website. Furthermore, the aim of the data processing is to shorten the loading times of our website in order to provide you with the content of our pages as quickly as possible.

Personal data may be transferred to third countries. In order to ensure the comprehensive protection of your data in this case as well, there are sufficient guarantees or other instruments in place to ensure compliance with European data protection principles.

The legal basis for the use of Cloudflare is Art. 6 (1) (f) GDPR, which is based on our legitimate interest in increasing the security and speed of delivery of our website. We have concluded with Cloudflare a data processing agreement.

For more information, please refer to Cloudflare's privacy policy.

2.13 Additional Information About the Trusted Shop Trust Badge

We are a member of Trusted Shops and use the Trusted Shop trustmark and reviews. We are required by Trusted Shops to provide the following information:

To display our Trusted Shops trustmark and any collected reviews and to offer Trusted Shops products to buyers after an order, the Trusted Shops Trustbadge is integrated on this website. This serves to safeguard our legitimate interests in the optimal marketing of our offer. The legal basis for this data processing is Art. 6 (1) (f) GDPR. The Trustbadge and the services advertised with it are an offer from Trusted Shops (Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne).

When the Trustbadge is accessed, the web server automatically stores a so-called server log file, which contains, for example, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data) and documents the retrieval. These access data are not analyzed and are automatically overwritten no later than seven days after the end of your visit to the site. Further personal data are only transmitted to Trusted Shops if you decide to use Trusted Shops products after completing an order or have already registered to use them. In this case, the contractual agreement between you and Trusted Shops applies.

2.14 WhatsApp Newsletter

We offer you the opportunity to subscribe to our WhatsApp newsletter so that you can regularly receive updates about our products and promotions, and as a new customer, benefit from a discount. By analyzing the usage of chat interactions, we can take your interests into account and tailor our content more effectively to you.

For this purpose, we use the WhatsApp marketing tool provided by chatarmin.com GmbH, Kaiserstraße 89/3/2, 1070 Vienna, Austria.

Your personal data (master and contact data such as your telephone number and WhatsApp profile name, communication within chats, and engagement data such as participation in surveys, delivery and open rates) will be processed by Chatarmin in the course of using the messenger service.

The legal basis for this data processing is your consent pursuant to Art. 6 (1) (a) GDPR.

To subscribe to our newsletter, we use the so-called double opt-in procedure. This means that we will only send you messages via WhatsApp once you have explicitly confirmed, after being redirected to WhatsApp, that you wish to receive messages. By sending the initial start message and subsequently clicking the "Confirm" button, you request to receive the newsletter.

To use the messenger service, an active WhatsApp account is required.

Providing your preferences as part of our WhatsApp newsletter may include special categories of personal data within the meaning of Art. 9 (1) GDPR and will only be processed with your explicit consent pursuant to Art. 9 (2) (a) GDPR. This information helps us to send you personalized offers tailored to your interests. Providing such preferences is voluntary, and you always have the option to select "No information."

To cancel the process or unsubscribe from the newsletter, you can send a message containing the word "Stop." After that, you will no longer receive WhatsApp messages from us. If you wish to continue receiving messages and re-subscribe to the newsletter later, you can simply send a new message in the chat.

For more information on the collection and use of personal data, please refer to the Chatarmin Privacy Policy at https://chatarmin.com/privacy-policy.

2.15 Product Recall

In the event of a product recall, we will contact you via email to inform you about the recall of the affected product and, if necessary, to arrange the return or replacement. In doing so, we process your customer number, name, and email address, as well as the allocation to the recalled product.

The processing of your personal data is based on Art. 6(1)(c) GDPR in conjunction with Section 6(2) of the Product Safety Act, in order to fulfill our legal obligations.

3.1 Technologies Used

This website uses various services and applications (collectively "tools") that are either offered by us or by third parties. These include, in particular, tools that use technologies to store or access information in the end device:

• Cookies: information stored on the end device, consisting in particular of a cookie name, a value, the storing domain and an expiry date. So-called session cookies (e.g. PHPSESSID) are deleted after the session, while so-called persistent cookies are deleted after the specified expiry date. Cookies can also be removed manually.
• Web Storage (Local Storage / Session Storage): information stored on the end device, consisting of a name and a value. Information in the session storage is deleted after the session, while information in the local storage has no expiry date and generally remains stored unless a deletion mechanism has been set up (e.g. storage of a local storage with a time entry). Information in local and session storage can also be removed manually.
• JavaScript: programming codes embedded in or called up by the website that, for example, set cookies and web storage or actively collect information from the end device or about the user's behavior. JavaScript can be used for "active fingerprinting" and to create user profiles. JavaScript can be blocked by a setting in the browser, although most services will then no longer work.
• Pixel: a tiny graphic automatically loaded by a service, which can make it possible to recognize visitors through the automatic transmission of the usual connection data (in particular IP address, information about browser, operating system, language, fonts, address accessed and time of access) and, for example, to determine the opening of an e-mail or a visit to a website. With the help of pixels, "passive fingerprinting" and the creation of user profiles can be carried out. The use of pixels can be prevented, for example, by blocking images, such as in e-mails, although this will severely restrict the display.

With the help of these technologies and also by simply establishing a connection on a page, so-called "fingerprints" can be created, i.e. user profiles that do not require the use of cookies or web storage and can still recognize visitors. Fingerprints due to the establishment of a connection cannot be completely prevented manually.

Most browsers are set by default to accept cookies, run scripts and display graphics. However, you can usually adjust your browser settings to reject all or certain cookies or to block scripts and graphics. If you completely block the storage of cookies, the display of graphics and the execution of scripts, our services are likely to not work or to not work properly.

The tools we use are listed below by category, where we provide you with information in particular about the providers of the tools, the storage period of the cookies or information in local storage and session storage, and the disclosure of data to third parties. It also explains in which cases we obtain your voluntary consent to use the tools and how you can revoke it.

3.2 Legal Basis and Revocation

3.2.1 Legal Basis

We use tools necessary for the operation of the website on the basis of our legitimate interest in accordance with Art. 6 (1) (f) GDPR to provide the basic functions of our website. In certain cases, these tools may also be necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract; in such cases, the processing is carried out in accordance with Art. 6 (1) (b) GDPR. In these cases, access to and storage of information in the terminal device is absolutely necessary and is carried out on the basis of the implementing laws of the ePrivacy Directive of the EU member states, in Germany according to § 25 (2) TDDDG.

All other non-essential (optional) tools that provide additional functions we use them based on your consent in accordance with Art. 6 (1) (a) GDPR. Access to and storage of information in the terminal device is then carried out on the basis of the implementing laws of the ePrivacy Directive of the EU member states, in Germany in accordance with § 25 (1) TDDDG. Data processing with the help of these tools only takes place if we have received your consent in advance.

If personal data is transferred to third countries, we refer you to Section 6 ("Data transfer to third countries"), also with regard to the risks that may be associated with this. We will inform you if standard contractual clauses or other guarantees have been concluded for the use of certain tools. If you have given your consent to the use of certain tools, we will transfer the data processed when using the tools (also) on the basis of this consent in accordance with Art. 49 (1) (a) GDPR to third countries.

3.2.2 Obtaining Your Consent

We use the tool consent-manager.de Cookiebot from Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark ("Cookiebot") to obtain and manage your consent. This tool generates a banner that informs you about the data processing on our website and gives you the opportunity to consent to all, some or none of the data processing through optional tools. This banner appears the first time you visit our website and when you access the selection of your settings again to change them or revoke consent. The banner also appears on subsequent visits to our website if you have disabled the storage of cookies or the cookies or information in the local storage of Cookiebot have been deleted or have expired.

During your visit to our website, Cookiebot is provided with your consents or revocations, your IP address, information about your browser, your end device and the time of your visit. Cookiebot also stores necessary information on your end device to store your consents and revocations:

• CookieConsent (storage period: 1 year)

The data processing by Cookiebot is necessary to provide you with the legally required consent management and to fulfill our documentation obligations. The legal basis for the use of Cookiebot is Art. 6 (1) (f) GDPR, justified by our interest in fulfilling the legal requirements for consent management. Accessing and storing information in the end device is absolutely necessary in these cases and is carried out on the basis of the implementing laws of the ePrivacy Directive of the EU member states, in Germany according to § 25 (2) TDDDG.

3.2.3 Revocation of Your Consent or Change of Your Selection

You can revoke your consent for certain tools at any time. To do so, click on the following link/button: https://lillydoo.com/en/pages/cookie-declaration. There you can also change the selection of tools that you wish to consent to use, as well as obtain additional information about the tools used. Alternatively, you can assert your revocation of certain tools directly with the provider.

3.3 Necessary Tools

We use certain tools to enable the basic functions of our website ("necessary tools"). Without these tools, we would not be able to provide our service. Therefore, necessary tools are used without consent. The legal basis for necessary tools is the necessity to fulfill our legitimate interests in accordance with Art. 6 (1) (f) GDPR or to fulfill a contract or to carry out pre-contractual measures in accordance with Art. 6 (1) (b) GDPR. In these cases, access to and storage of information in the end device is absolutely necessary and is carried out on the basis of the implementing laws of the ePrivacy Directive of the EU member states, in Germany according to § 25 (2) TDDDG.

In the event that personal data is transferred to the USA or other third countries, we refer in addition to the following information provided below, please refer to section 6 ("Data transfer to third countries").

3.3.1 Own Tools

We use our own necessary tools that access information on the end device or store information on the end device, in particular

• for login authentication,
• for load distribution,
• to store your language settings,
• to note that you have been shown a piece of information placed on our website so that it is not shown again the next time you visit the website.

3.3.2 hCaptcha

Our website uses the hCaptcha security service, which is offered by Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA (collectively "hCaptcha").

It ensures website's security and prevents automated software (so-called bots) from carrying out abusive activities on the website, i.e. it checks whether the entries made actually come from a human by analyzing the user's behavior on the service. To do this, hCaptcha uses JavaScript and stores cookies on your device. In particular, the following data is processed:

• Referrer URL (address of the page from which the visitor came);
• IP address;
• Behavior of the user (e.g. visited pages, visit duration, keypress events, touch events, scroll position, mouse movement, number of mouse clicks);
• Technical information (e.g. browser type, browser plug-ins, browser size and resolution, date, language settings, display instructions (CSS) and scripts (Javascript)).

The following cookies from hCaptcha may be used for this: "__cf_bm" (30 minutes).

hCaptcha's evaluation decides in which form the captcha is displayed on the page. The legal basis is the necessity to fulfill a contract or to carry out pre-contractual measures according to Art. 6 (1) (b) GDPR, for example in the context of registering a user account, using a contact form or subscribing to a newsletter. Additionally, our legal basis is the necessity for fulfilling our legitimate interests according to Art. 6 (1)(f) GDPR as hCaptcha is used to protect IT security, ensure the stability of our website and prevent misuse.

The data may also be processed on servers in the USA. In the event that personal data is transferred to the USA, this is done on the basis of the adequacy decision for the USA according to Art. 45 GDPR as hCaptcha is certified for the EU-US Data Privacy Framework.

You can find more information about this in hCaptcha's privacy policy: https://www.hcaptcha.com/privacy.

3.4 Functional Tools

We also use optional tools to improve the user experience on our website and to offer you more functions ("functional tools"). Although these are not absolutely necessary for the basic functions of the website, they can provide visitors with significant advantages, particularly in terms of user-friendliness and the provision of additional communication, display or payment channels.

The legal basis for the functional tools is your consent in accordance with Art. 6 (1)(a) GDPR. Access to and storage of information in the terminal device is then carried out on the basis of the implementing laws of the ePrivacy Directive of the EU member states, in Germany in accordance with § 25 (1) TDDDG. For the revocation of your consent, see 3.2.3: "Revocation of your consent or change of your selection".

In the event that personal data is transferred to the USA or other third countries, your consent expressly also extends to the transfer of data (Art. 49 (1) (a) GDPR). Please refer to section 6 ("Data transfer to third countries") for the associated risks.

3.4.1 Make.com

To improve and automate internal processes, we use the service Make provided by Celonis SE, Theresienstr. 6, 80333 Munich, Germany. Make allows us to link various applications and data sources and automatically transfer data between them in order to create more efficient workflows.

As part of optimizing our offering, we integrate Make with the systems Recharge, Adtribute, and Innkeepr. Relevant data regarding subscription cancellations is extracted from Recharge, transferred into a Google Sheet via Make, and subsequently retrieved by the attribution tool for analysis and reporting purposes (Recharge), as well as by the web analytics service (Innkeepr). The data collected serves the ongoing optimization of our offering and more targeted audience communication.

The following personal data is processed:

1. event_id (e.g., Subscription ID)
2. Time of subscription cancellation
3. Email address (only if required for analysis)

The processing of this data is based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR, in order to analyze and optimize business processes.

3.5 Analysis Tools

In order to improve our website, we use optional tools for statistical recording and analysis of general usage behavior based on access data ("analysis tools"). We also use analysis services to evaluate the use of our various marketing channels.

The legal basis for the analysis tools is your consent in accordance with Art. 6 (1) (a) GDPR. Access to and storage of information in the terminal device is then carried out on the basis of the implementing laws of the ePrivacy Directive of the EU member states, in Germany according to § 25 (1) TDDDG. For the revocation of your consent, see 3.2.3: "Revocation of your consent or change of your selection".

In the event that personal data is transferred to the USA or other third countries, your consent also expressly extends to the transfer of data (Art. 49 (1) (a) GDPR). The associated risks can be found in section 6 ("Data transfer to third countries").

3.5.1 Google Analytics

Our website uses the Google Analytics service, which is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland for individuals from Europe, the Middle East and Africa (EMEA) and by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (collectively "Google") for all other individuals.

Google Analytics uses JavaScript and pixels to read information on your device and cookies to store information on your device. This is used to analyze your usage behavior and improve our website. We will process the information obtained to evaluate your use of the website and to compile reports on website activity for the website operators. The data collected in this context may be transmitted by Google to a server in the US for evaluation and stored there.

We also use the Google Analytics integration in Meta. Google Analytics transmits the information obtained to Meta in order to optimise and personalise our advertising on Meta. You can find more information about data processing by Meta in section 3.6.4 of our privacy policy and in the Meta Platforms privacy policy: https://www.facebook.com/about/privacy/.

We have made the following data protection settings for Google Analytics:

• IP anonymization (shortening of the IP address before evaluation)
• Automatic deletion of old logs by limiting the storage period to 26 months;
• Disabled cross-device and cross-page tracking.

The following data is processed by Google Analytics:

• IP address;
• referrer URL (previously visited page);
• pages viewed (date, time, URL, title, duration of visit);
• downloaded files;
• links clicked on to other websites;
• if applicable, achievement of certain goals (conversions);
• technical information: operating system;
• browser type, version and language;
• device type, brand, model and resolution;
• approximate location (country and possibly city, based on anonymized IP address).

Google Analytics sets the following cookies for the specified purpose with the respective storage period:

• "_ga" (storage period: 2 years): recognition and differentiation of visitors through a user ID;
• "_gid" (storage period: 24 hours): recognition and differentiation of visitors through a user ID;
• "gat" (storage period: 2 minutes): Reduction of requests to the Google servers;
• "_dc_gtm_UA-[GA-ID]" (storage period: 1 minute): Reduction of requests to the Google servers;
• "IDE" (storage period: 13 months): Recognition and differentiation of visitors by means of a user ID, recording of interaction with advertising, display of personalized advertising.

We have concluded an data processing agreement with Google Ireland Limited for the use of Google Analytics. In the event that personal data is transferred from Google Ireland Limited to the USA, Google Ireland Limited and Google LLC have concluded standard contractual clauses (Implementing Decision (EU) 2021/914, Module 3) in accordance with Art. 46 (2) (c) GDPR.

For more information, please see Google's privacy policy.

3.5.1.1 Google Signals

As an extension to Google Analytics 4, our website may use Google Signals can be used on our website to create reports across devices. If you have activated personalized cookies and your device is linked to your Google account, Google can, subject to your consent to the use of Google Analytics, analyze your usage behavior across devices and create database models, including for cross-device conversions. We do not receive any personal data from Google, only statistics. The legal basis for the data processing is your consent in accordance with Art. 6 (1) (a) GDPR.

If you want to stop cross-device analysis, you can disable the "Personalized Advertising" feature in your Google Account settings. To do this, follow the instructions on the following page: https://support.google.com

For more information about Google Signals, please follow this link: https://support.google.com/analytics/answer/7532985

3.5.1.2 Google Enhanced Conversions

In conjunction with Google Analytics 4, we also use Google Enhanced Conversions from Google Ireland Limited on our website. This involves matching your hashed contact details (such as your email address) from forms with the Google database. This is used to improve conversion measurement, audience targeting and to evaluate and optimise marketing campaigns as part of Google Ads.

We collect your contact information when you enter it into form fields. For example, if you have completed a transaction or come to our site as a result of an advertisement. The contact information is then encrypted before it is sent. The resulting hash value is then sent to Google. Google can only match this hash value if it has the original contact information in clear text in its own databases. If you have a Google Account with the same hashed contact information, Google will use the previously collected advertising information (including conversions) to improve the targeting of that Account and display more personalised advertising.

We have entered into an data processing agreement for the use of Google Enhanced Conversions. The legal basis for the data processing is your consent pursuant to Art. 6 (1) (a) GDPR. If you do not wish to receive personalised advertising, you can access Google's privacy settings here: https://adssettings.google.com/notarget.

To the extent that your personal data is also transferred to Google LLC, this transfer is based on Google LLC's certification to the EU-US Privacy Framework on the basis of an adequacy decision pursuant to Art. 45 GDPR.

3.5.2 Kolsquare

We use Kolsquare (Kolsquare SAS, 124 Rue Réaumur, 75002 Paris, France) to measure the performance of our influencer and e-commerce campaigns. When you access our Shopify store via a tracking link, an attribution parameter is stored on or read from your device in order to assign visits and purchases to a specific campaign. In this context, transaction data, information about the purchase process, as well as tracking and attribution information may be processed and transmitted to Kolsquare. The legal basis for this processing is your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You may withdraw your consent at any time with effect for the future.

3.5.2 TikTok

We use the "TikTok Pixel" service on our website, which is provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02T380, Ireland, and TikTok Information Technologies UK Limited, WeWork, 125 Kingsway, London, WC2B 6NH, United Kingdom (both hereinafter collectively referred to as "TikTok").

We use the TikTok pixel to understand and track the activities of visitors to our website. The TikTok pixel collects and processes information about the visitors to our website or the devices they use (so-called event data). This event data is used to target our ads and improve ad delivery, as well as for personalized advertising. The data collected in this context may be transferred by TikTok to servers located in so-called third countries for evaluation and stored there.

Some of this event data is information stored on the device you are using. In addition, cookies are also used via the TikTok pixel, which store information on the device you are using. Such storage of information by the TikTok pixel or access to information already stored on your device will only take place with your consent.

The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR. Access to and storage of information in the terminal device is then carried out on the basis of the implementing laws of the ePrivacy Directive of the EU member states, in Germany according to § 25 (1) TDDDG. In the event that personal data is transferred to TikTok companies based in third countries, we have concluded corresponding standard contractual clauses of the Commission (Implementing Decision (EU) 2021/914) in accordance with Art. 46 (2) (c) GDPR.

We and TikTok are jointly responsible for the collection and transmission of event data. We have an agreement with TikTok regarding processing as joint controllers, which specifies the distribution of data protection obligations between us and TikTok. In this agreement, we and TikTok have in particular agreed that we are responsible for providing you with all information in accordance with Art. 13, 14 GDPR regarding the joint processing of personal data; that TikTok is responsible for enabling the rights of data subjects under Art. 15 to 20 GDPR with regard to the personal data stored by TikTok after the joint processing.

You can access the agreement concluded between us and TikTok upon request.

TikTok is solely responsible for the processing of the transmitted event data following the transmission. For more information about how TikTok processes personal data, including the legal basis on which TikTok relies and the options for exercising your rights against TikTok, please refer to TikTok's data policy.

3.5.2.1 Matching Hashed Email Addresses with Advertising Partners

We use a feature to match your hashed email address and phone number from forms with our advertising partner TikTok's databases. This is to improve conversion measurement and targeting, as well as to evaluate and optimise marketing campaigns. You can find out more about the specific features from the advertising partner:

TikTok Advanced Matching (https://ads.tiktok.com/help/article/advanced-matching-web): for individuals in the European Economic Area, the United Kingdom and Switzerland, by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, together with TikTok Information Technologies UK Limited, 4 Lindsey Street, London, EC1A 9HP, United Kingdom, and for individuals in the United States of America, by TikTok Inc., 5800 Bristol Parkway, Suite 100, Culver City, CA 90230, USA.

We collect your email address when you enter it into form fields. For example, if you have completed a transaction or come to our site as a result of an advertisement. The email address is then sent in a one-way encrypted form. The resulting hash value is then sent to the above-mentioned advertising partners. They can only match this hash value if they have the original email address in clear text in their own databases. If an account with the same hashed email address exists with the advertising partner, the previously collected advertising-related information (particularly regarding conversions) will be used to improve the targeting of that account and the display of personalised advertising.

We have entered into a data processing agreement with TikTok for the use of this feature.

The legal basis for this data processing is your consent pursuant to Art. 6 (1) (a) GDPR. Access to and storage of the information on the end device is then carried out on the basis of the implementing laws of the ePrivacy Directive of the EU Member States, in Germany on the basis of § 25 (1) TDDDG.

If you do not want personalised advertising to be displayed, you can access the advertising partner's data protection settings.

3.5.3 Innkeepr

As soon as you have given your consent to the use of advertising/tracking cookies, our website uses Innkeepr. Innkeepr is a web analysis service provided by Innkeepr UG, Senefelderstraße 35, 09126 Chemnitz, which makes it possible to assign data, sessions and interactions across multiple devices to a pseudonymous user ID and thus analyze your activities across devices. This enables us to compile statistics that we can use to improve our services for you and make them more interesting. The legal basis for our use of Innkeepr is your consent in accordance with Art. 6 (1) (a) GDPR.

Innkeepr uses cookies that are stored on your computer and enable an analysis of your use of our website. The information collected in this way is stored exclusively on servers within Germany.

Innkeepr sets the following cookies for the specified purpose with the respective storage period. We use Innkeepr without collecting IP addresses, so that the data we collect cannot be directly linked to a particular person.

"tjs_userData" (storage period: 1 year): sets a browser-specific ID to identify a new click in the same browser;
"tjs_sessionData" (storage period: 1 year): sets a browser-specific ID to identify a new session in the same browser.

For more information, please see the Innkeepr privacy policy.

3.6 Marketing Tools

We also use optional tools for advertising purposes ("marketing tools"). Some of the access data collected when you use our website is used to create user profiles that store, in particular, your usage behavior, the advertisements you view or click on, and, based on this, your classification into advertising categories, interests and preferences. By analyzing and evaluating this access data, we are able to display personalized advertising to you on our website and on the websites of other providers, i.e. advertising that matches your actual interests and needs. To do this, we analyze your usage behavior in order to recognize you on other sites and to address you in a personalized way based on your use of our site (retargeting).

The legal basis for the marketing tools is your consent in accordance with Art. 6 (1) (a) GDPR. Access to and storage of information in the terminal device is then carried out on the basis of the implementing laws of the ePrivacy Directive of the EU member states, in Germany in accordance with § 25 (1) TDDDG. For the revocation of your consent, see 3.2.3: "Revocation of your consent or change of your selection".

In the event that personal data is transferred to the US or other third countries, your consent also expressly extends to the data transfer (Art. 49 (1) (a) GDPR). Please refer to section 6 ("Data transfer to third countries") for the associated risks.

In the following section, we would like to explain the tools and the providers used for them in more detail. The data collected may include, in particular:

• the IP address of the device;
• information from cookies and local or session storage;
• device ID of mobile devices (e.g. device ID, advertising ID);
• referrer URL (previously visited page);
• pages viewed (date, time, URL, title, duration of visit);
• downloaded files;
• links clicked on to other websites;
• achievement of certain goals (conversions), if applicable;
• Technical information: operating system; browser type, version and language; device type, brand, model and resolution;
• approximate location (country and possibly city).

However, the data collected is stored exclusively under a pseudonym, so that no direct conclusions can be drawn about the persons.

3.6.1 Sovendus

We cooperate with Sovendus GmbH, Bahnhofplatz 12, 76137 Karlsruhe ("Sovendus") within the framework of the Sovendus partner network in order to provide you with free or discounted special offers after an online purchase. Within the Sovendus network, our product is displayed as a so-called special offer after a purchase is completed at a participating online shop. This offer is embedded in an iFrame provided by Sovendus on the order confirmation page of the advertising partner. Users can select an offer there and are then redirected to the LILLYDOO landing page.

The aim is to provide interested users with targeted offers and to ensure that orders are processed reliably and in compliance with legal requirements. When clicking on a special offer, Sovendus transmits an anonymous technical identifier (SovReq Token) to LILLYDOO. After successfully ordering the offer on our landing page, we transmit the following to Sovendus: the SovReq Token (for the technical allocation of the order), the user's IP address (for fraud prevention), and the User Agent (for technical analysis of the order). This data is used exclusively for verifying the order, ensuring proper processing, and preventing misuse (Art. 6 (1) (f) GDPR).

For further information on data processing by Sovendus, please visit: https://www.sovendus.com/datenschutz.

3.6.2 Adtribute

We use the marketing attribution platform of Adtribute Software GmbH, Im Hart 32, 82110 Germering, Germany ("Adtribute") to analyze the effectiveness of our marketing measures and to enable the attribution of orders and website interactions to specific marketing channels. In particular, the following personal data may be processed in this context:

• IP address;
• device and browser information;
• referrer URLs;
• interaction and usage data;
• conversion and order data;
• technical log data;
• cookie IDs or comparable online identifiers.

The processing is carried out exclusively for the analysis and optimization of our marketing measures and for the statistical evaluation of the use of our website.

Insofar as cookies or comparable technologies are used for the deployment of Adtribute, access to information stored on your terminal device is carried out exclusively on the basis of your consent in accordance with § 25 (1) TDDDG. The subsequent processing of personal data is carried out on the basis of your consent in accordance with Art. 6 (1) (a) GDPR.

We have concluded a data processing agreement with Adtribute in accordance with Art. 28 GDPR. Consent can be withdrawn at any time with effect for the future via our consent settings.

Further information on data processing by Adtribute can be found in Adtribute's privacy policy at: https://www.adtribute.io/privacy-policy

3.6.3 Wisepops

We use the services of Wisepops SAS, 49 rue Jean De La Fontaine, 75016 Paris, France ('Wisepops') on our website. Wisepops helps us to optimise our website and our marketing activities. Wisepops allows us to display targeted pop-ups, banners and other personalised content to improve our offers and user experience.

Technically, Wisepops uses cookies and similar technologies to collect the following information: which pages are visited, how often and in what order, what interactions take place with the campaigns displayed (e.g. clicks) and, if you provide it, certain contact details such as email addresses. The data collected is always pseudonymised and is not merged with other personal data (e.g. name, address).

We have concluded a data processing agreement with Wisepops. Information about Wisepops' privacy policy can be found here.

3.6.4 Meta-Pixel

Our websites use the "Meta-Pixel" service for marketing purposes, which is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland for persons outside the United States and Canada and by Meta Platforms Inc., 1601 Willow Road, Menlo Park, California 94025, USA (collectively, "Meta Platforms") for all other persons.

We use meta pixels to analyze the general use of our websites and to track the effectiveness of advertising ("conversion tracking"). We also use meta pixels to show you individualized advertising messages in the social networks of Meta Platforms (such as Facebook and Instagram) based on your interest in our products ("retargeting"). This also involves target group remarketing through Custom Audience. The data collected in this context may be transferred by Meta Platforms to a server in the United States for analysis and stored there.

Meta Platforms processes data that the service collects via JavaScript, cookies and other technologies on our websites. These include in particular:

• HTTP header information such as information about the browser used (e.g. user agent, language);
• information about events such as "page view", other object properties and buttons clicked by visitors to the website;
• online identifiers such as IP addresses and, if provided, Facebook business-related identifiers or device IDs (such as advertising IDs for mobile operating systems) as well as information on the status of disabling/limiting ad tracking.

The following cookies are set and read by Meta-Pixel for the stated purpose with the respective storage period:

• "_fbc" (storage period: 3 months): usage analysis and retargeting;
• "_fbp" (storage period: 3 months): usage analysis and retargeting;

The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR. Access to and storage of information in the terminal device is then carried out on the basis of the implementing laws of the ePrivacy Directive of the EU member states, in Germany according to § 25 (1) TDDDG. The transfer of your data to the USA and other third countries is based on your explicit consent in accordance with Art. 49 (1) (a) GDPR.

Meta Platforms acts as our processor for matching, measurement and analysis services, in particular for analyzing the use of our website, matching user IDs and creating reports on our advertising campaigns. Therefore, we have concluded a data processing agreement. In the event that personal data is transferred from Meta Platforms Ireland Limited to the USA for these purposes, Meta Platforms Ireland Limited and Meta Platforms Inc. have concluded standard contractual clauses (Implementing Decision (EU) 2021/914, Module 3) in accordance with Art. 46 (2) (c) GDPR.

In addition, we and Meta Platforms are jointly responsible for the processing of event data for targeting advertisements (by creating and selecting target groups), delivering commercial and transactional messages, improving ad delivery, and personalization of features and content as part of the use of Meta Pixel. The mutual obligations have been set out in a joint controller agreement that can be accessed upon request.

In addition, Meta Platforms processes the event data to protect the security and safety of Meta Platforms products, for research and development purposes, to maintain the integrity of the products and to improve them.

If you are a member of Facebook or Instagram and you have allowed Meta Platforms to do so through your account privacy settings, Facebook or Instagram may associate the information collected about your visit to our site with your account and use it to target advertising. You can view and change the privacy settings of your Facebook profile at any time. You can prevent the linking of data collected outside of Instagram for the purpose of displaying personalized advertising in Instagram through your account settings.

If you have not consented to the use of meta pixels, Meta Platforms will only display general advertising that is not selected based on the information collected about you on this website.

Further information, in particular on joint controllership and contact details, can be found in Meta Platforms' data protection information, in particular on the social networks Facebook and Instagram.

3.6.5 Google Ads Conversion Tracking and Ads Remarketing

Our websites use the "Google Ads" service, which is offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland for individuals from the European Economic Area and Switzerland and by Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (collectively "Google") for all other individuals.

With Google Ads, customer actions defined by us (such as clicking on an ad, page views, downloads) are recorded and analyzed using "Google Ads Conversion Tracking." We use "Google Ads Remarketing" to display individualized advertising messages for our products on Google partner websites. Both services use cookies, JavaScript, pixels, and other technologies for this purpose. Google also processes the data to improve and further develop its own products and services, for aggregated statistical analysis of conversions and to improve the quality and accuracy of conversions. The data collected in this context may be transferred by Google to a server in the US for analysis and stored there.

The following cookies are set by Google:

• "_gcl_au" (storage period: 90 days): conversion tracking, storage of ad clicks;
• "_gcl_aw" (storage period: 90 days): conversion tracking, storage of ad clicks
• "gac*" (storage period: 90 days): addition of the Google click identifier in the URL for conversion tracking (auto-tagging).

The legal basis for this data processing is your consent in accordance with Art. 6 (1) (a) GDPR. Access to and storage of information in the terminal device is then carried out on the basis of the implementing laws of the ePrivacy Directive of the EU member states, in Germany according to § 25 (1) TDDDG. The transfer of your data to the USA and other third countries is based on your explicit consent in accordance with Art. 49 (1) (a) GDPR.

If you use a Google account, Google may link your web and app browsing history to your Google account and use information from your Google account to personalize ads, depending on the settings stored in your Google account. If you do not want this information to be linked to your Google account, you must log out of Google before accessing our website.

If you have not consented to the use of Google Ads, Google will only display general advertising that has not been selected based on the information collected about you on this website. In addition to withdrawing your consent, you also have the option of disabling personalized advertising in the Google advertising settings.

We also use the Google Ads Customer Match service. For individuals in the European Economic Area and Switzerland, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for all other individuals, it is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (together "Google"). In this process, we upload email addresses that we have previously received from you to Google in hashed form (SHA-256). Google compares these hash values with its own user data and, where a match exists, assigns them to specific target groups ("Customer Match Audiences"). We can then use these target groups to deliver personalized advertising to you within Google Ads and on Google partner sites. The uploaded data is deleted by Google after no more than 48 hours and is used solely for matching purposes. The legal basis for this processing is your consent pursuant to Art. 6 (1) (a) GDPR; access to and storage of information on your device is additionally based on ePrivacy regulations, in Germany pursuant to § 25(1) TDDDG. Your personal data may also be transferred to Google LLC in the USA in this context. Google has joined the EU-U.S. Data Privacy Framework, so the transfer is based on the European Commission's adequacy decision under Art. 45 GDPR. You may withdraw your consent at any time with effect for the future. In addition, you can also deactivate personalized advertising directly with Google.

3.6.6 Klaviyo

We use the tool "KLAVIYO", 125 Summer St Floor 6, Boston, MA 02111, United States, for marketing purposes (e.g. for sending our newsletter and information emails) and for analysis purposes.

The purpose of using KLAVIYO is to tailor our offer and our services to your interests and to improve our communication measures for you. KLAVIYO enables the electronic processing of personal data, such as the collection, recording, storage, use and deletion of data, in order to manage business relationships, carry out direct marketing and enable transactional communication.

The processed data includes contact persons/recipients (e.g. newsletter subscribers): identification and contact details (e.g. name, email address, telephone number), IT information (e.g. IP addresses, open and click rate) and other information provided by the user.

Your personal data may also be transferred by KLAVIYO to the USA and processed there. KLAVIYO has joined the EU-US Data Privacy Framework, which is why the transfer in this case is based on the adequacy decision for the USA in accordance with Art. 45 GDPR. In addition, we have concluded standard contractual clauses with KLAVIYO (Implementing Decision (EU) 2021/914, Module 2) in accordance with Art. 46 (2) (c) GDPR.

The legal basis for the processing of your data is your consent in accordance with Art. 6 (1) (a) GDPR. Further information on data protection at KLAVIYO can be found at https://www.klaviyo.com/legal.

3.6.7 Unbounce

We use the service of Unbounce Marketing Solutions Inc., 400-401 West Georgia Street, Vancouver BC, Canada, V6B 5A1, ("Unbounce"), which provides us with so-called "landing pages" that we create for certain promotions. On these campaign pages of our website, we offer interested parties and customers coupon codes, discounts or other benefits and enable immediate redirection to our website.

The promotion page is hosted by Unbounce and, when you visit it, it records your IP address, the website you come from, the browser you use, user agent, date and time of your visit, which device and cookie data (see also section 2.1 of this privacy policy). Unbounce uses cookies to measure the success of our promotion page. If you fill out a contact form on a promotion page, your contact data will also be collected by Unbounce.

The processing of personal data necessary for the provision and operation of the landing pages is based on Article 6(1)(f) GDPR. Where cookies or similar technologies are used for analytics or measuring the performance of our campaigns, such processing is based on your consent pursuant to Article 6(1)(a) GDPR. Access to information stored on your device is subject to the applicable ePrivacy rules, including Section 25 TDDDG where applicable.

For more information about data processing, please see the Unbounce privacy policy.

We have concluded a data processing agreement with Typeform. The legal basis for data processing is our legitimate interest in accordance with Art. 6 (1) (f) GDPR in improving our products, services, and customer experience. For more information about data processing by Typeform, please refer to the Typeform privacy policy.

3.6.8 MIDA

We use the analytics and optimization software MIDA by BSS Commerce, Viwaseen Tower, Nam Tu Liem Dist., Hanoi, Vietnam, on our Shopify store to enhance your shopping experience. MIDA collects information about how you use our shop, such as which pages you click on, how you scroll, and which features you interact with. The use of MIDA is based on your consent in accordance with Art. 6 (1) (a) GDPR. You may withdraw this consent at any time. Further information on data processing by MIDA can be found in MIDA's privacy policy: https://mida-app.io/privacy-policy

3.6.9 Shopify Analytics

We use Shopify Analytics, which are provided to individuals in the European Economic Area by Shopify International Limited, Ireland. Shopify Analytics enables us to statistically evaluate the use of our online shop, create reports on shop and product performance, and optimise our offering. In this context, your IP address, information about your browser, operating system and device, pages and products viewed, search queries, referrer URL, date and duration of your visit, cookie and device identifiers, your approximate location, and information about shopping carts, orders and conversions may be processed. Shopify uses cookies, pixels and similar technologies for this purpose. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR; access to or storage of information on your device is based on Section 25(1) TDDDG. Shopify generally stores the data for as long as necessary for the respective processing purposes and to comply with legal obligations.

Data may also be transferred to Canada, the USA and other locations. Shopify relies in particular on approved Binding Corporate Rules for intra-group transfers from the European Economic Area; the European Commission's adequacy decision may also apply to Canada. Further information can be found in Shopify's Privacy Policy.

3.6.10 Google Tag Manager

Our website uses the Google Tag Manager service, which is provided to individuals in the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and to all other individuals by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (collectively "Google").

Google Tag Manager is used exclusively to manage website tools by integrating so-called website tags. A tag is an element embedded in the source code of our website in order to execute a tool, for example by means of scripts. Where optional tools are concerned, these are only integrated by Google Tag Manager with your consent. Google Tag Manager uses JavaScript and generally does not use cookies.

The legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in integrating and managing multiple tags on our website in a straightforward manner.

For the purposes of ensuring stability and functionality, Google collects information about which tags are integrated by our website when Google Tag Manager is used. However, Google Tag Manager generally does not store any personal data beyond the data required to establish the connection, and in particular does not store any data about usage behaviour or the pages visited.

We have concluded a data processing agreement with Google Ireland Limited. Where personal data is transferred by Google Ireland Limited to Google LLC in the USA, Google LLC is certified under the EU-U.S. Data Privacy Framework, which means that the transfer is based on the European Commission's adequacy decision for the USA pursuant to Art. 45 GDPR. In addition, Google Ireland Limited and Google LLC have concluded Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3) pursuant to Art. 46(2)(c) GDPR.

Further information on the processing of personal data by Google can be found at Google's business safety privacy page.

3.6.11 GroPulse GTM & Data Layer

We use the Shopify app "GroPulse GTM & Data Layer" provided by Muhek Digital Innovations LLC ("GroPulse"). The tool is used for the technical integration and configuration of Google Tag Manager and assists us in managing our conversion tracking. In particular, user and measurement IDs, timestamps, custom conversion events, and settings relating to Google Tag Manager, the tracking pixel and server-side tracking are stored in the HTML local storage of your device. Most of this information is deleted at the end of your session; the user ID and timestamp stored under gropulse_gtm_sse remain stored beyond the end of the session.

The legal basis for the processing is your consent pursuant to Art. 6(1)(a) GDPR; access to and storage of information on your device is based on Section 25(1) TDDDG.

Further information can be found in GroPulse's Privacy Policy.

3.6.12 Merchant Center Analytics

We use the analytics and conversion features of Google Merchant Center ("Merchant Center Analytics"), which are provided to individuals in the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and to all other individuals by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (collectively "Google"). The service enables us to evaluate the performance of our product listings on Google and to determine whether interactions with our product listings result in purchases or other actions defined by us. In this context, your IP address, cookie and device identifiers, browser and device information, product listings clicked on, click and campaign identifiers, pages viewed, and information about purchases and other conversion events may be processed. Automatic URL tagging, Google tags, cookies and comparable technologies may be used for this purpose. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR; access to or storage of information on your device is based on Section 25(1) TDDDG. Data may also be processed by Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, meaning that the transfer may be based on the European Commission's adequacy decision. Further information can be found in Google's Privacy Policy.

3.7 Social Media Plugins

Our website uses social media plugins in the form of buttons and links that redirect you to our presence on external social networks, such as Facebook, Instagram, TikTok, Spotify and Pinterest.

These plugins are implemented as simple outbound links. When you click on such a button, you will be redirected to the respective social media platform. Only at the moment of redirection may data be transmitted to the respective provider, including your IP address and the information that you have accessed our website via the corresponding link.

We do not transmit any personal data to the providers of these social networks unless you actively interact with the respective plugin by clicking on it. In this case, data processing is carried out under the responsibility of the respective social media provider in accordance with their privacy policies.

For more information on data processing by the respective social networks, please refer to their privacy policies:

Facebook: https://www.facebook.com/privacy/policy/
Instagram: https://www.facebook.com/privacy/policy/
TikTok: https://www.tiktok.com/legal/page/us/privacy-policy/en
Pinterest: https://policy.pinterest.com/en/privacy-policy
Spotify: https://www.spotify.com/de/legal/privacy-policy/

3.7.1 Google Maps

Our website uses the mapping service Google Maps, which is offered for persons from the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and for all other persons by Google LLC 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (together "Google").

In order for the Google map material we use to be integrated and displayed in your web browser, your web browser must connect to a Google server when you visit our website, which may also be located in the USA. In addition, Google Maps uses JavaScript to provide the functionality of the mapping service, which accesses information stored on your device.

The legal basis for this data processing is your consent pursuant to Article 6(1)(a) GDPR. Access to and storage of information on your device are carried out on the basis of the national laws implementing the EU ePrivacy Directive in the respective Member States; in Germany, this is governed by § 25 (1) TDDDG.

Your personal data may also be transferred by Google Ireland Limited to Google LLC in the United States. Google LLC has joined the EU–U.S. Data Privacy Framework; therefore, such transfers are based on the European Commission's adequacy decision for the United States pursuant to Article 45 GDPR.

By integrating the map material, Google receives the information that a page of our website has been accessed from the IP address of your device. If you access the Google Maps service on our website while logged into your Google profile, Google may also link this event to your Google profile. If you do not wish to be associated with your Google profile, you must log out of Google before accessing our contact page. Google stores your data and uses it for advertising and market research purposes and to personalize the display of Google Maps.

For more information, please refer to the Google privacy policy and the additional terms of service for Google Maps.

We maintain an online presence on social networks in order to communicate with customers and prospects and to provide information about our products. The data of the users are processed by the relevant social networks, usually for market research and advertising purposes. This allows user profiles to be created based on the interests of the users. For this purpose, cookies and other identifiers are stored on the computers of the data subjects. Based on these user profiles, advertisements are then placed within the social networks, but also on third-party websites.

As part of the operation of our online presences, we may have access to information such as statistics on the use of our online presences provided by the social networks. These statistics are aggregated and may include demographic information (e.g. age, gender, region) as well as data on interaction with our online presences (e.g. likes) and the posts and content shared through them. These may also provide information about the interests of users and what content and topics are particularly relevant to them. We may also use this information to customize the design and our activities and content on the online presence and to optimize it for our audience. Details and links to the social network data that we as the operator of the online presence can access can be found in the list below. The collection and use of these statistics are generally subject to a shared controllership.

The legal basis for the data processing is Art. 6 (1) (f) GDPR based on our legitimate interest in effective information and communication with users, or Art. 6 (1) (b) GDPR, in order to stay in contact with our customers and to inform them, as well as to carry out pre-contractual measures with interested parties.

If you have an account with the social network, it is possible that we will be able to see your publicly available information and media when we view your profile. In addition, the social network may allow us to contact you. This can be done via direct messages or posted posts. Communication via the social network is the responsibility of the social network as a messenger and platform service.

Please refer to the data protection notices of the respective social network for the legal basis of the data processing carried out by the social networks on their own responsibility. You can also find further information on the respective data processing and the options for objecting to it at the following links.

We would like to point out that data protection queries can be most efficiently addressed to the respective social network provider, as only these providers have access to the data and can take appropriate action directly. If you contact us with your concern, we will forward your request to the social network provider. Below is a list of social networks on which we operate online presences:

• Facebook (USA and Canada: Facebook Inc., 1601 Willow Road, Menlo Park, California 94025, USA; all other countries: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland)
• Instagram (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland)
• Google/YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)
• X (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland)
• LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland)
  Xing/Kununu (XING SE, Dammtorstraße 30, 20354 Hamburg)
• Pinterest. Privacy Policy / Opt-Out: https://policy.pinterest.com/de/privacy-policy
• TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland und TikTok Information Technologies UK Limited, 4 Lindsey Street, London, EC1A 9HP, United Kingdom)

We will only transfer the data we have collected if

• you have given your express consent to do so in accordance with Art. 6 (1) (a) GDPR,
• the transfer is necessary in accordance with Art. 6 (1) (f) GDPR for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding legitimate interest in not disclosing your data,
• we are legally obliged to pass on your data in accordance with Art. 6 (1) (c) GDPR or
• this is legally permissible and necessary for the performance of a contract with you or for the implementation of pre-contractual measures, which take place upon your request, in accordance with Art. 6 (1) (b) GDPR.

Some of the data processing may be carried out by our service providers. In addition to the service providers mentioned in this data protection declaration, this may include, in particular, data centers that store our website and databases, software providers, IT service providers that maintain our systems, agencies, market research companies, group companies and consulting firms. If we pass on data to our service providers, they may use the data exclusively to fulfill their tasks. We have carefully selected and commissioned the service providers. They are contractually bound by our instructions, have appropriate technical and organizational measures in place to protect the rights of the data subjects, and are regularly monitored by us.

In addition, data may be disclosed in connection with official inquiries, court orders, and legal proceedings if it is necessary for legal prosecution or enforcement.

As explained in this data protection declaration, we use services whose providers are sometimes based in so-called third countries (outside the European Union or the European Economic Area) or process personal data there, i.e. countries whose level of data protection does not correspond to that of the European Union. Insofar as this is the case and the European Commission has not issued an adequacy decision (Art. 45 GDPR) for these countries, we have taken appropriate precautions to ensure an adequate level of data protection for any data transfers. These include, among other things, the standard contractual clauses of the European Union or binding internal data protection regulations.

Where this is not possible, we base the data transfer on exceptions under Art. 49 GDPR, in particular your express consent or the necessity of the transfer for the performance of a contract or for the implementation of pre-contractual measures.

If a transfer to a third country is planned and no adequacy decision or appropriate safeguards are in place, it is possible and there is a risk that authorities in the third country (e.g. security and intelligence services) may access the transferred data for surveillance and control purposes without you being informed of this and without effective legal remedies being available to you.

In principle, we only store personal data for as long as is necessary to fulfill the purposes for which we collected the data. After that, we delete the data immediately, unless we still need the data until the expiry of the statutory limitation period for evidence purposes for civil claims or due to statutory retention requirements.

For evidence purposes, we must keep contract data for three years from the end of the year in which the business relationship with you ends. Any claims become time-barred in accordance with the statutory limitation period, but no earlier than this point in time.

Even after that, we still need to store some of your data for accounting reasons. We are obliged to do so due to statutory documentation requirements that may arise from the German Commercial Code, the German Fiscal Code, the German Banking Act, the German Money Laundering Act and the German Securities Trading Act. The periods for storing documents specified in these laws range from two to ten years.

You have the rights of data subjects formulated in Art. 15 – 21, Art. 77 GDPR at all times:

• Right to revoke your consent;
• Right to object to the processing of your personal data (Art. 21 GDPR);
• Right to information about your personal data processed by us (Art. 15 GDPR);
• Right to correction of your personal data stored incorrectly by us (Art. 16 GDPR);
• Right to erasure of your personal data (Art. 17 GDPR);
• Right to restriction of processing of your personal data (Art. 18 GDPR);
• Right to data portability of your personal data (Art. 20 GDPR);
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

To exercise your rights as described here, you can contact us at any time using the contact details provided above. This also applies if you wish to receive copies of guarantees to prove an adequate level of data protection. Provided that the respective legal requirements are met, we will comply with your data protection request.

Your requests to assert data protection rights and our responses to them will be stored for documentation purposes for a period of up to three years and, in individual cases, for a longer period if necessary to assert, exercise or defend legal claims. The legal basis is Art. 6 (1) (f) GDPR, based on our interest in defending against any civil claims under Art. 82 GDPR, avoiding fines under Art. 83 GDPR, and fulfilling our accountability obligations under Art. 5 (2) GDPR.

You have the right to revoke consent you have given us at any time. As a result, we will no longer continue the data processing based on this consent in the future. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.

If we process your data on the basis of legitimate interests, you have the right to object to the processing of your data at any time for reasons arising from your particular situation. If you object to data processing for direct marketing purposes, you have a general right of objection, which we will implement without you having to state reasons.

If you wish to exercise your right of revocation or objection, simply send an informal message to the contact details given above.

Finally, you have the right to complain to a data protection supervisory authority. For example, you can assert this right before a supervisory authority in the member state of your residence, your workplace or the location of the alleged infringement. In Frankfurt am Main, where we are based, the competent supervisory authority is the Hessian Commissioner for Data Protection and Freedom of Information, Gustav Stresemann-Ring 1, 65189 Wiesbaden.

We occasionally update this data protection declaration, for example when we adapt our website or when legal or official requirements change.