Privacy policy

This privacy policy informs you about our handling of your data. So that the processing of your data is comprehensible to you, we would like to give you an overview of this processing with the following information. To ensure fair processing, this privacy statement contains general information about our handling of your data as well as information about your rights under the European Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

We also inform you in detail about:

The data controller is iAmHealth Distribution UG (hereinafter referred to as "we" or "us").

I. general information

1. CONTACT

If you have any questions or comments about this information or would like to contact us about exercising your rights, please direct your inquiry to

2. LEGAL BASIS

The term "personal data" under data protection law refers to any information relating to an identified or identifiable individual.

We process personal data in compliance with the relevant data protection regulations, in particular the DSGVO and the BDSG. Data processing by us only takes place on the basis of a legal permission. We process personal data

• only with their consent (Art. 6 para. 1 letter a) DSGVO),
• for the performance of a contract to which you are a party,
• on their request for the performance of pre-contractual measures (Art. 6 (1) (b) DSGVO),
• to comply with a legal obligation (Art. 6 para.1 letter c) DSGVO)
• or where processing is necessary for the purposes of protecting our legitimate interests or the legitimate interests of a third party, except where such interests are overridden by their interests or fundamental rights or freedoms which require the protection of personal data (Art. 6 (1) (f) DSGVO)

3. DURATION OF STORAGE

Unless otherwise stated in the following notes, we store personal data only as long as it is necessary to achieve the purpose of processing or to fulfill our contractual or legal obligations. Such legal obligations to retain data may arise in particular from commercial or tax law regulations.

4. CATEGORIES OF RECEIVERS

We use order processors as part of the processing of their data. These include, for example, shipping service providers in the context of package notifications and updates on shipment status, hosting, maintenance and support of IT systems, the provision of certain service and functions on our website, order processing, marketing measures or file and data carrier destruction. A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller. Processors do not use the data for their own purposes, but carry out data processing exclusively for the data controller and are contractually obligated to ensure appropriate technical and organizational measures for data protection.

In addition, we transmit their personal data, if necessary, to bodies such as postal and delivery services, house bank, tax advisor/auditor or the tax authorities.

If their data are transmitted to other recipients, we inform you under the respective processing process.

5. PROCESSING IN THE EXERCISE OF YOUR RIGHTS GEM. ART. 15 TO 22 GDPR

When you exercise your rights under Articles 15 to 22 of the GDPR, we process the personal data provided for the purpose of implementing those rights by us and to be able to provide evidence thereof. We will process data stored for the purpose of providing information and its preparation only for this purpose and for the purpose of data protection control and otherwise restrict processing in accordance with Art. 18 DSGVO.

These processing operations are based on the legal basis of Art. 6 para. 1 lit. c) DSGVO in conjunction with. Art. 15 to 22 DSGVO and Section 34 (2) BDSG.

6. YOUR RIGHTS

As a data subject, you have the right to assert your data subject rights against us. In particular, you have the following rights:

• You have the right, in accordance with Art. 15 DSGVO and § 34 BDSG, to request information about whether and, if so, to what extent we are processing personal data relating to your person or not.
• You have the right to request that we correct your data in accordance with Art. 16 DSGVO.
• You have the right, in accordance with Art. 17 DSGVO and § 35 BDSG from us to request the deletion of their personal data.
• You have the right to restrict the processing of their personal data in accordance with Art. 18 DSGVO.
• You have the right, in accordance with Art. 20 DSGVO, to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to have this data transferred to another controller.
• If you have given us separate consent to data processing, you may revoke this consent at any time in accordance with Article 7 (3) DSGVO. Such a revocation will not affect the lawfulness of the processing that took place until the revocation based on the consent.
• If you believe that a processing of personal data concerning you violates the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.

7. right of appeal

In accordance with Art. 21 (1) DSGVO, you have the right to object to processing based on the legal basis of Art. 6 (1) (e) or (f) DSGVO on grounds relating to your particular situation. If personal data about you are processed by us for the purpose of direct marketing, you may object to such processing pursuant to Article 21 (2) and (3) DSGVO.

8. DATA PROTECTION OFFICER

You can reach our data protection officer at the following contact details: Nina Wlodarczyk, wlodarczyk@iam.health, +49 721 986 157-80

II. DATA PROCESSING ON OUR WEB SITE

When you use the Website, we collect information that you provide yourself. In addition, during their visit to the website, certain information about their use of the website is automatically collected by us. In data protection law, the IP address is also generally considered a personal data. An IP address is assigned to any device connected to the Internet by the Internet provider so that it can send and receive data.

1. DATA TRANSMISSION TO THIRD COUNTRIES

Visiting our website may involve the transfer of certain personal data to third countries, that is, countries where the GDPR is not applicable law. Such transfer will take place in a permissible manner if the European Commission has determined that an adequate level of data protection is warranted in such third country.

If such an adequacy decision of the European Commission does not exist, a transfer of personal data to a third country shall only take place in the presence of appropriate safeguards pursuant to Article 46 of the GDPR or if one of the conditions of Article 49 of the GDPR is met.

Unless otherwise stated below, we use the EU standard contractual clauses for the transfer of personal data to processors in third countries as appropriate safeguards: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32010D0087

2. HOSTING BY SHOPIFY

We use the store system Shopify for the purpose of hosting and displaying our website. Shopify is offered by the service provider Shopify International Limited (Ireland). Unless otherwise stated in the following notices, all data collected on our website is processed on our behalf on the servers of Shopify International Limited.

As part of the aforementioned services, data may be transferred to Canada to the company Shopify Inc. For the data transfer to Canada as a third country, i.e. a country in which the GDPR is not applicable law, an adequacy decision of the European Commission is available. The European Commission has thus decided that an adequate level of protection exists in Canada and that the transfer can take place in a permissible manner.

For more information about Shopify's privacy practices, please visit: https://www.shopify.de/legal/datenschutz.

3. PROCESSING OF SERVER LOG FILES

When you use our website for purely informational purposes, general information that your browser transmits to our server is initially stored automatically (i.e. not via registration). This includes by default: browser type / version, operating system used, requested page, the previously visited page (referrer URL), IP address, date and time of the server request and HTTP status code. The processing is carried out to protect our legitimate interests and is based on the legal basis of Art. 6 (1) f) DSGVO. This processing serves the technical administration and security of the website.

The stored data will be deleted after 30 days, unless there is a justified suspicion of unlawful use based on concrete evidence and further examination and processing of the information is necessary for this reason. We are not able to identify you as a data subject on the basis of the stored information. Articles 15 to 22 of the GDPR therefore do not apply pursuant to Article 11(2) of the GDPR, unless you provide additional information that enables us to identify you in order to exercise your rights set out in those articles.

4. CONTACT OPPORTUNITIES AND REQUESTS

A. LEGAL BASIS

If your request is directed towards the conclusion or performance of a contract with us, Article 6 (1) (b) DSGVO is the legal basis for data processing. Otherwise, we process the data on the basis of our legitimate interest in contacting inquiring persons. The legal basis for data processing is then Art. 6 para. 1 lit. f) DSGVO.

5. SHOP DATA PROCESSING FOR PURCHASE DEVELOPMENT

A. DATA PROCESSING FOR PURCHASE DEVELOPMENT

If you order a product via our website, we process personal data for the purpose of processing the contract or to provide them with the ordered product. We process in the booking or ordering process only the data that you yourself have provided in the input mask. In order to be able to deliver the ordered products to them, we transmit their data required for delivery to one of our shipping service providers as specified in the order.

Legal basis for the processing is in each case Art. 6 para 1 letter b) DSGVO. All data fields marked as mandatory are required for processing their booking or order. Failure to provide this data will result in us not being able to process your booking or order. The provision of further data is voluntary.

B. PAYMENT BY CREDIT CARD

We offer you the possibility to pay by credit card. Please note that the respective payment information is collected and processed by the respective payment service providers on their own responsibility. For this purpose, we use the payment service provider Pinwheel Pay:

Pinwheel Pay
196E Campden Hill Road
London
England
W8 7TH
https://pinwheelpay.com/privacy.php

Payment data provided by you during the order process will be transmitted to Pinwheel Payment, insofar as this transmission is necessary for the execution of the payment process. The legal basis for this transmission is Art. 6 para. 1 letter b) DSGVO. Pinwheel Payment cooperates with Trust Payments for the processing of payment data in the course of the subsequent payment transaction:

Trust Payments Ltd.
No.1 Royal Exchange
London
England
EC3V 3DG
https://www.trustpayments.com/privacy/

Trust Payments is committed to protecting the personal data we process about you in accordance with the data protection principles set out in the European Union (EU) General Data Protection Regulation 2016/679 (GDPR).
The controller of personal data is Trust Payments Ltd of European Operations Centre, Parc Menai, Bangor, Gwynedd, UK LL57 4BL. You can send requests regarding the processing of your data by email to gdpr@trustpayments.com.

6. E-MAIL MARKETING

A. REGISTRATION AND UNSUBSCRIPTION FOR MARKETING E-MAILS

We offer on our website the opportunity to sign up to receive marketing emails such as our newsletter. Once you sign up, we will provide you with regular updates on our offers and events, and may remind you of store items in your shopping cart. A valid email address is required to sign up. To verify the e-mail address, you will first receive a registration e-mail, which you must confirm via a link (double opt-in). If you subscribe to the newsletter on our website, we process personal data such as their email address and name based on the consent they have given.

The processing is based on the legal basis of Art. 6 (1) a) DSGVO. You can revoke the consent given at any time with effect for the future, for example via the "unsubscribe" link in the newsletter or by contacting us via the channels mentioned above. The legality of the use of the data that has already taken place remains unaffected by the revocation. When registering for the newsletter, we also store the IP address and the date and time of registration. The processing of this data is necessary in order to be able to prove that consent has been given. The legal basis arises from our legal obligation to document their consent (Art. 6 para. 1 lit. c) in conjunction with. Art. 7 para. 1 DSGVO).

B. NEWSLETTER ANALYSIS

The newsletters contain a so-called "web-beacon", i.e. a pixel file that is retrieved when the newsletter is opened. When opened, technical information such as their browser and system information, IP address and the time of opening are collected. This data and information is used to technically improve our service based on your reading behavior. This also includes recording when an e-mail or newsletter was opened and whether a link was clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is not our intention to observe individual users. The statistical collection and evaluation of the data serves us to recognize the reading habits of our users and thus to better adapt our content to the users. This also serves to send users different content, according to the interest of our users.

Legal basis for statistical collection and the evaluation is Art. 6 para 1 letter f) DSGVO. Our interest is directed towards the use of a user-friendly as well as secure newsletter system that serves our business interests as well as meets the expectations of the users.

You have the right to opt-out of the statistical collection and analysis.

You can object to the statistical collection and evaluation by unsubscribing from the newsletter. A separate revocation of the statistical analysis is unfortunately not possible.

C. EVALUATION REQUESTS AND PRODUCT EVALUATIONS

We offer them on our website the opportunity to submit reviews about our store and our products. We use the service yotpo of the company Yotpo ltd. for this purpose. If you buy a product through our website, we will send a message to the email address provided and ask you to rate whether you would recommend us. We hereby pursue our legitimate interest in measuring the satisfaction of our customers. The legal basis for this use of the e-mail address provided is Art. 6 para. 1 lit. f) DSGVO in conjunction with. § Section 7 (3) UWG. You can object to this at any time without incurring any costs other than the transmission costs according to the prime rates. To do so, you can notify us of your objection by clicking on the unsubscribe link contained in each mailing, by e-mail to info@iam.health or via another of the contact channels listed above.

The processing of personal data in connection with a product review, and in particular the use of the e-mail address provided, will only take place if you have previously given your consent to receive marketing e-mails. The processing is based on the legal basis of Art.6 para. 1 letter a) DSGVO. You can revoke your consent at any time with effect for the future, for example via the "unsubscribe" link in a marketing email sent or by contacting us via the channels mentioned above.

7. COOKIES

We use cookies and similar technologies on our website. Cookies are small text files that are stored by your browser when you visit a website. This identifies the browser used and can be recognized by our web server. We use so-called "session cookies", which are deleted again when the browser session is closed. Other cookies ("persistent cookies") are automatically deleted after a specified period of time, which may differ depending on the cookie.

The use of cookies is partly technically necessary for the operation of our website. We also use cookies and similar technologies to measure analytics about the reach of our website and to analyze the use of our website.

We also use cookies and similar technologies to track user behavior across websites and devices. In particular, we pursue marketing purposes with this. For example, cookies are placed on your device when you interact with one of our advertisements on another website. When you visit our website, we read this cookie and can thus track the effectiveness of our advertising material. This process is also known as conversion measurement.

Cookies are stored on the user's computer. Therefore, you as a user also have full control over the use of cookies. You can delete the cookies in the security settings of your browser at any time. You can object to the use of cookies through your browser settings in principle or for specific cases. Further information on this is available to them from the Federal Office for Information Security at https://www.bsi-fuer-buerger.de/BSIFB/DE/Empfehlungen/EinrichtungSoftware/EinrichtungBrowser/Sicherheitsmassnahmen/Cookies/cookies_node.html.

Using our cookie consent tool "GDPR Legal Cookie App" you can consent to the use of cookies and similar technologies on our website In doing so, you have the choice between:

8. ANALYSIS OF OUR WEBSITE

We use programs on our website to measure the reach of our website and analyze user behavior. For this purpose, we use cookies and similar technologies.

A. SHOPIFY STATISTICS

We use the Shopify statistics feature on our website. This allows us to measure the reach of our website and obtain statistical analysis of visitor behavior on our website. The data is processed on servers of Shopify International Limited (Ireland), which we have commissioned with the processing.

The legal basis for the data processing in connection with the Shopify Statistics function is Art. 6 (1) (f) DSGVO and the processing serves our legitimate interest in analyzing user behavior on our website and the design that is thus possible according to needs. You can object to this processing at any time in the cookie settings.

B. GOOGLE ANALYTICS

We use the Google Analytics service of Google Ireland Limited (Ireland/EU) to evaluate our website visits. Google uses cookies that allow an analysis of their use of our website. This involves processing personal data in the form of online identifiers (including cookie identifiers), IP addresses, device identifiers and information about interaction with our website. Google will use this information on our behalf for the purpose of evaluating your use of our website, compiling reports on website activity and providing other services relating to website activity and internet usage. In doing so, pseudonymous usage profiles of the users can be created from the processed data.

We only use Google Analytics with IP anonymization activated. This means that the IP address of users is shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The IP address transmitted by the user's browser is not merged with other data from Google.

We use the Google Universal Analytics variant. This allows us to assign interaction data from different devices and from different sessions to a unique user ID. This allows us to contextualize individual user actions and analyze long-term relationships.

Data about user actions is stored for a period of 14 months and then automatically deleted. In this process, the deletion of data whose storage period has expired occurs automatically once a month.

The setting of cookies and the further processing of personal data described here takes place with their consent. The legal basis for data processing in connection with the Google Analytics service is therefore Art. 6 (1) a) DSGVO. They can revoke their consent at any time under the item "Cookie Settings"

You can also prevent the storage of cookies by Google Analytics via an appropriate setting of your browser software. You can also prevent the collection of information generated by the cookie by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout. If you visit our website via a mobile device, you can deactivate Google Analytics by clicking on this link. Please also note that we document consent given by them in order to comply with our obligation to provide evidence under Article 7 (1) DSGVO. As we are obliged to do so, this storage is based on the legal basis of Art. 6 para. 1 lit. (c) DSGVO).

9. TRACKING & RETARGETING

We use programs and technologies on our website to track the user behavior of our website visitors across websites and devices. For this purpose, we use cookies and similar technologies.

10. INTEGRATED SERVICES AND THIRD PARTY CONTENT

We use services, services and content (hereinafter collectively referred to as "content") provided by third parties on our website. For such integration, a processing of your IP address is technically necessary so that the content can be sent to your browser. Your IP address is therefore transmitted to the respective third-party providers.

These data processing operations are carried out in each case to protect our legitimate interests in the optimization and economic operation of our website and are based on the legal basis of Art. 6 (1) f) DSGVO. You can object to this data processing at any time via the settings of the browser used or certain browser extensions. One such extension is, for example, the Matrix-based firewall uMatrix for the browsers Firefox and Google Chrome. Please note that this may result in functional restrictions on the website.

We have integrated into our website content from the following services provided by third-party providers:

• "Google reCAPTCHA" to check whether form entries are made by a natural person.
• "Google Maps" of Google Ireland Limited (Ireland/EU) for the display of maps.

III. DATA PROCESSING ON OUR SOCIAL MEDIA SITES

We are represented on several social media platforms with a company page. Through this, we would like to offer further opportunities for information about our company and for exchange. Our company has company pages on the following social media platforms:

• Facebook
• Instagram

When you visit or interact with a profile on a social media platform, personal data about you may be processed. The information associated with a social media profile used also regularly constitutes personal data. This also covers messages and statements made while using the profile. In addition, during your visit to a social media profile, certain information about it is often automatically collected, which may also constitute personal data.

1. DATA PROCESSING WHEN YOU VISIT A SOCIAL MEDIA SITE

A. FACEBOOK AND INSTAGRAM PAGE

When you visit our Facebook or Instagram page, through which we present our company or individual products from our range, certain information about you is processed. The sole controller of this processing of personal data is Facebook Ireland Ltd (Ireland/EU - "Facebook"). For further information about the processing of personal data by Facebook, please visit https://www.facebook.com/privacy/explanation.

Facebook offers the possibility to object to certain data processing; related notices and opt-out options can be found at https://www.facebook.com/settings?tab=ads.

Facebook provides us with anonymized statistics and insights for our Facebook and Instagram pages that help us gain insights into the types of actions people take on our page (known as "page insights"). These page insights are created based on certain information about individuals who have visited our page. This processing of personal data is carried out by Facebook and us as joint controllers. The processing serves our legitimate interest in evaluating the types of actions taken on our site and improving our site based on these insights. The legal basis for this processing is Art. 6 (1) (f) DSGVO. We cannot associate the information obtained via Page Insights with individual Facebook profiles that interact with our Facebook page. We have entered into a joint controller agreement with Facebook, which sets out the distribution of data protection obligations between us and Facebook. For details about the processing of personal data to create Page Insights and the agreement entered into between us and Facebook, please visit https://www.facebook.com/legal/terms/information_about_page_insights_data. In relation to these data processing operations, you have the option of asserting your data subject rights (see "Your rights" in this regard) also against Facebook. Further information on this can be found in Facebook's privacy policy at https://www.facebook.com/privacy/explanation.

Please note that, in accordance with Facebook's privacy policy, user data is also processed in the USA or other third countries. Facebook transfers user data only to countries for which an adequacy decision has been issued by the European Commission in accordance with Article 45 of the GDPR or on the basis of appropriate safeguards in accordance with Article 46 of the GDPR.

2. PROCESSING OF DATA COMMUNICATED TO US THROUGH OUR SOCIAL MEDIA SITES

We also process information that you have provided to us via our company page on the relevant social media platform. Such information may be the username used, contact details or a message to us. We regularly process this personal data only if we have previously expressly requested you to provide us with this data, for example as part of a survey. These processing operations by us are carried out as the sole responsible party.

We process this data based on our legitimate interest in contacting inquiring persons. The legal basis for the data processing is Article 6 (1) (f) DSGVO.

In addition, we may process such communicated data for evaluation and marketing purposes. These processing operations are carried out on the legal basis of Art. 6 (1) (f) DSGVO and serve our interest in further developing our offer and informing you specifically about our offers. Further data processing may take place if you have consented (Art. 6 para 1 letter a) DSGVO) or if this serves the fulfillment of a legal obligation (Art. 6 para 1 letter c) DSGVO).

IV. FURTHER DATA PROCESSING

1. CONTRACTUAL RELATIONSHIP

For the establishment or implementation of the contractual relationship with our customers, the processing of personal master data, contract data and payment data provided to us is regularly required. The legal basis for this processing is Art. 6 (1) b) DSGVO. We also process customer and prospective customer data for evaluation and marketing purposes. These processing operations are carried out on the legal basis of Art. 6 (1) (f) DSGVO and serve our interest to further develop our offer and to inform you specifically about offers of iAmHealth Distribution UG. Further data processing may take place if you have consented (Art. 6 para 1 letter a) DSGVO) or if this serves the fulfillment of a legal obligation (Art. 6 para 1 letter c) DSGVO).

2. USE OF E-MAIL ADDRESS

We may use your email address provided during registration or ordering to inform you about iAmHealth Distribution UG's own similar products and services. The legal basis is Art. 6 para. 1 lit. f) DSGVO in conjunction with. § Section 7 (3) UWG. You can object to this at any time without incurring transmission costs other than those according to the prime rates. To do so, you can unsubscribe by clicking on the unsubscribe link contained in each mailing or by sending an e-mail to info@iam.health.

3. OFFLINE ORDERS

If you order a product by e-mail or by telephone, we process personal data for the purpose of processing the contract or to provide them with the ordered product. We process within the ordering process only the data that you yourself have provided. In order to be able to deliver the ordered products to you, we transmit your data required for the delivery to one of our shipping service providers as specified in the order. The legal basis for the processing is in each case Art. 6 para. 1 letter b) DSGVO. All data fields marked as mandatory are required for processing your order. Failure to provide this data will result in us not being able to process your order. The provision of further data is voluntary.

Date: June 2021