Privacy policy

Privacy policy

Last updated: October 2026

1. Controller

Atout Cosmetics GmbH, Harderweg 2, 22549 Hamburg, Germany
Managing directors: Andreas Bechtolf, Henri Bechtolf
Phone: +49 (0)40 429336 77-0
Email: beautyexperts@very-beauty.com

2. Overview

We process personal data only insofar as this is necessary to provide the online shop, process your orders, communicate with you or – with your consent – for analytics and advertising. Legal bases are Art. 6(1)(a) GDPR (consent), (b) (contract and pre-contractual measures), (c) (legal obligation, e.g. retention duties) and (f) (legitimate interests). Storing information on or accessing information from your device is governed by Section 25 TDDDG: we only use cookies and similar technologies that are not strictly necessary with your consent.

3. Hosting and shop system (Shopify)

Our shop runs on Shopify (Shopify International Limited, 2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, Ireland). When you visit the site, technically necessary data (e.g. IP address, date/time, browser, pages viewed) is processed to deliver the site, ensure security and prevent misuse (Art. 6(1)(f) GDPR). Order and customer data are stored in Shopify (Art. 6(1)(b) GDPR). Shopify is our processor. Data may be transferred to the USA and Canada on the basis of the EU-US Data Privacy Framework or standard contractual clauses and the adequacy decision for Canada.

4. Orders and customer account

To process your order we use your name, delivery and billing address, email address, phone number if provided, order and payment information (Art. 6(1)(b) GDPR). Mandatory fields are marked; without them we cannot conclude the contract. If you create a customer account, we store your details until the account is deleted. Commercial and tax records are retained for 6 or 8–10 years in accordance with Section 257 HGB and Section 147 AO (Art. 6(1)(c) GDPR).

5. Payment providers

Depending on the payment method chosen, we pass on the data required for payment to:

  • Shopify Payments (credit card, Google Pay, Apple Pay): Shopify International Limited, Dublin, Ireland, with the payment processor Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland,
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg,
  • Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may carry out its own identity and credit checks; Klarna's privacy notice applies,
  • for Google Pay or Apple Pay additionally Google Ireland Limited or Apple Distribution International Ltd., Ireland.

Legal basis: Art. 6(1)(b) GDPR. Payment providers may carry out their own fraud prevention checks; their privacy notices also apply.

6. Shipping

For delivery we pass your name, delivery address and, if applicable, email address to the carrier: DHL (Deutsche Post AG, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany) or, for Switzerland, Swiss Post Ltd, Wankdorfallee 4, 3030 Bern (Art. 6(1)(b) GDPR). We only pass on your email address so that you can be notified about delivery (Art. 6(1)(f) GDPR); you can object at any time.

7. Contact, withdrawal form

If you contact us by email, phone, the contact form or the “Withdraw from contract” function, we process your details to handle your request (Art. 6(1)(b) or (c) GDPR). Forms are sent to us by email via Shopify. To protect against spam and abuse, Shopify forms use hCaptcha (Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA); your IP address and technical browser data are processed and may be transferred to the USA (Art. 6(1)(f) GDPR; standard contractual clauses).

8. Newsletter

If you subscribe to our newsletter, we use your email address to send you information on products and offers (Art. 6(1)(a) GDPR). We log the time of sign-up and confirmation and your IP address to be able to prove your consent. The sign-up form is provided via Shopify (Shopify Forms); hCaptcha is used to prevent abuse (see section 7). You can unsubscribe at any time via the link in every email or by contacting us. If a voucher is linked to the sign-up, the conditions stated at the form apply.

9. Cookies and consent management

On your first visit we ask for your consent via a banner. You can accept, decline or choose individually and change or withdraw your choice at any time via “Cookie preferences” in the footer. Strictly necessary cookies (e.g. cart, language, login, storing your cookie choice) are based on Section 25(2) TDDDG and Art. 6(1)(b) or (f) GDPR. All other technologies (analytics, marketing) are only used with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

10. Analytics and advertising (consent only)

Google Ads, Google Merchant Center and Google conversion tracking (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): we measure the success of our ads and may show you advertising based on your use of our shop. We use Google Consent Mode: without your consent, no advertising cookies are set. Transfers to the USA are based on the EU-US Data Privacy Framework.

TikTok Pixel (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland): measuring and optimising advertising campaigns on TikTok. Data may be transferred to third countries (including the USA, Singapore and China); TikTok relies on standard contractual clauses.

BOGOS Free Gift & Bundles (Secomapp): displaying free gifts and bundles in the cart and analysing the use of this function.

11. Affiliate programme

We work with partners (e.g. influencers) who promote our products. If you reach our shop via a partner link, we store which partner referred you in order to calculate the commission. We use the affiliate apps UpPromote (Secomapp) and GoAffPro. Legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

12. Wishlist

For the wishlist we use the “Wishlist” app by XO Builder. Saved products are stored in your browser and – if you are logged in – in your customer account (Art. 6(1)(b) GDPR, Section 25(2)(2) TDDDG, as you actively use the function).

13. Accessibility widget

We use an accessibility app for functions such as font size and contrast. If you use the widget and choose a special font, it may be loaded from an external server, which transmits your IP address (Art. 6(1)(f) GDPR or at your request).

14. Social media links

We link to our profiles on Instagram and TikTok. These are simple links; data is only transferred when you click them.

Instagram feed: on the home page we display posts from our Instagram profile via the app “GSC Instagram Feed” (GetSiteControl). Technical data (e.g. IP address, browser information) may be transmitted to the provider and views of the feed may be recorded statistically (Art. 6(1)(f) GDPR).

15. Storage period

We store personal data only as long as necessary for the respective purpose or as required by statutory retention periods. Consent-based data is deleted after consent is withdrawn unless another legal basis applies.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You may object to processing for direct marketing at any time without giving reasons (Art. 21(2) GDPR).

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

To exercise your rights, simply contact beautyexperts@very-beauty.com.

17. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.