Privacy policy

Privacy Policy

Last updated: September 2026

Contents

  1. General information

1.1 Controller

1.2 Data protection officer

1.3 Legal bases for processing

1.4 Transfers to third countries

1.5 Storage period

1.6 Obligation to provide data

1.7 No automated decision-making

1.8 SSL/TLS encryption

  1. Your rights

  2. Contacting us

  3. Newsletter

  4. Data processing on our website

5.1 Storing and accessing information on your device (Section 25 TDDDG)

5.2 Informational use of the website (server log files)

5.3 Hosting and shop system (Shopify)

5.4 Consent management (Cookiebot)

5.5 Contact form

5.6 Customer account

5.7 Sign-in with Shop and Google (single sign-on)

5.8 Orders and contract processing

5.9 Shipping (DHL)

5.10 Payment service providers

5.11 Subscriptions (Appstle)

5.12 Strictly necessary cookies

5.13 Translation (Shopify Translate & Adapt)

5.14 Product reviews (Judge.me)

5.15 Post-purchase surveys (Zigpoll)

5.16 Email marketing and sign-up forms (Klaviyo)

5.17 Google Ads conversion tracking and remarketing

5.18 Google & YouTube app and Google Merchant Center

5.19 Meta Pixel and Conversions API

5.20 Website analytics (Microsoft Clarity)

  1. Social media profiles

6.1 Instagram and Facebook

6.2 TikTok

6.3 LinkedIn

  1. Changes to this privacy policy

  2. Questions about data protection


1. General information

This privacy policy explains how we process personal data when you use our website https://carebyfrey.com, place orders in our online shop, and interact with our social media profiles.

Personal data is any information relating to an identified or identifiable natural person, such as a name, email address or IP address.

1.1 Controller

The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) is:

BYFREY Beauty GmbH Friedrichstraße 21 80801 Munich Germany Email: info@carebyfrey.com

Represented by its managing director, Freya Kondel.

1.2 Data protection officer

We are not legally required to appoint a data protection officer. If you have any questions about data protection, please contact us directly using the details above.

1.3 Legal bases for processing

We process personal data on the following legal bases:

  • Art. 6(1)(a) GDPR (consent): where you have given us your consent, e.g. for our newsletter or for analytics and marketing cookies.

  • Art. 6(1)(b) GDPR (contract): where processing is necessary to perform a contract or to take steps prior to entering into a contract, e.g. when you place an order or ask about our products.

  • Art. 6(1)(c) GDPR (legal obligation): where we must comply with a legal obligation, e.g. retention obligations under commercial and tax law.

  • Art. 6(1)(f) GDPR (legitimate interests): where processing is necessary for our legitimate interests or those of a third party and your interests do not override them, e.g. to operate our website securely.

1.4 Transfers to third countries

Some of our service providers process data outside the European Economic Area (EEA), in particular in the USA and Canada.

  • For certain third countries, the European Commission has decided that they ensure an adequate level of data protection (adequacy decision under Art. 45(3) GDPR), e.g. Canada and the United Kingdom.

  • For the USA, an adequacy decision applies to companies certified under the EU-US Data Privacy Framework. You can check whether a company is certified at https://www.dataprivacyframework.gov/list.

  • Where no adequacy decision applies, we transfer data on the basis of the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR), which we have agreed with the respective provider.

We indicate any transfer to a third country in the section on each service.

1.5 Storage period

Unless a more specific storage period is stated in this privacy policy, we delete personal data as soon as it is no longer needed for the purpose for which it was processed and no statutory retention obligations apply. Where such obligations exist, we restrict processing: the data is blocked and stored only to comply with the retention obligation. This applies in particular to data we must retain under German commercial and tax law (Section 257 HGB, Section 147 AO) for up to ten years, depending on the type of record.

1.6 Obligation to provide data

You are not legally or contractually required to provide us with personal data. However, without the data required for an order (marked as mandatory fields), we cannot conclude or perform a contract with you.

1.7 No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

1.8 SSL/TLS encryption

For security reasons, our website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar.


2. Your rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)

  • Right to rectification (Art. 16 GDPR)

  • Right to erasure (Art. 17 GDPR)

  • Right to restriction of processing (Art. 18 GDPR)

  • Right to data portability (Art. 20 GDPR)

  • Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Where your data is processed for direct marketing purposes, you may object to this processing at any time without giving reasons.

To exercise your rights, simply send a message to info@carebyfrey.com.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach, Germany https://www.lda.bayern.de

You may also contact the supervisory authority in your place of residence.


3. Contacting us

When you contact us, e.g. by email or via social media, we process the data you provide (e.g. name, email address, content of your message) in order to respond to your enquiry.

If your enquiry relates to an order or to entering into a contract, the legal basis is Art. 6(1)(b) GDPR. In all other cases, the legal basis is our legitimate interest in responding to enquiries addressed to us (Art. 6(1)(f) GDPR).

We delete the data once your enquiry has been fully dealt with, unless statutory retention obligations apply.


4. Newsletter

You can sign up for our free newsletter on our website. We use a double opt-in procedure: after signing up, you will receive an email with a confirmation link. We only add you to our mailing list once you click this link. We store the time of sign-up and confirmation as well as your IP address so that we can prove your sign-up.

The only mandatory information is your email address. Where we ask for optional information (e.g. your first name), we use it to personalise the newsletter. We also store your language (German or English) so that we can send you the newsletter in the right language.

The legal basis is your consent (Art. 6(1)(a) GDPR). On the basis of this consent, we also analyse whether and when newsletters are opened and which links are clicked, in order to improve our content.

You can withdraw your consent at any time, e.g. via the unsubscribe link at the end of every newsletter or by emailing info@carebyfrey.com. After you unsubscribe, we delete your data from the mailing list. Where applicable, we keep your email address on a suppression list so that you do not receive any further newsletters. The legal basis for this is our legitimate interest in permanently respecting your objection (Art. 6(1)(f) GDPR).

We use Klaviyo to send our newsletter (see Section 5.16).


5. Data processing on our website

5.1 Storing and accessing information on your device (Section 25 TDDDG)

Our website stores information on your device (e.g. cookies) or accesses information already stored there. The following sections describe what information this involves.

  • Where storage or access is strictly necessary to provide a service you have explicitly requested (e.g. shopping cart, login, saving your cookie settings), it is based on Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

  • In all other cases, it only takes place with your consent (Section 25(1) TDDDG).

Any subsequent processing of the data is governed by the GDPR and described in the following sections. You can withdraw or change your consent at any time via the cookie settings on our website.

5.2 Informational use of the website (server log files)

When you simply visit our website, we process the data your browser automatically sends to our server:

  • IP address

  • Date and time of the request

  • Time zone difference to Greenwich Mean Time (GMT)

  • Content of the request (page visited)

  • Access status/HTTP status code

  • Amount of data transferred

  • Website from which the request originates (referrer)

  • Browser, operating system and its interface

  • Language and version of the browser software

This processing is necessary to deliver the website and to ensure its stability and security. This is our legitimate interest (Art. 6(1)(f) GDPR). Log files are deleted as soon as they are no longer needed for these purposes.

5.3 Hosting and shop system (Shopify)

Our website and online shop are operated via Shopify. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Shopify processes all data transmitted via our website and shop, e.g. master, contact, contract, payment, usage and meta/communication data. Shopify also provides a content delivery network (CDN) that delivers our website content faster.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR) where orders are concerned, and otherwise our legitimate interest in a secure, stable and high-performing online shop (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Shopify (Art. 28 GDPR).

Shopify also transfers data to its parent company Shopify Inc. in Canada and to sub-processors, including in the USA. An adequacy decision of the European Commission applies to Canada. In addition, transfers within the Shopify group and to sub-processors are based on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

More information: https://www.shopify.com/legal/privacy

5.4 Consent management (Cookiebot)

To obtain, store and manage your consent to cookies and similar technologies, we use the consent management platform Cookiebot. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen K, Denmark.

When you make a choice in our cookie banner, the following data is processed: your consent status, the date and time of consent, a randomly generated consent ID, the URL on which consent was given, an anonymised IP address and browser information (user agent). Your decision is saved in a cookie ("CookieConsent") in your browser for up to 12 months so that you are not asked again on every visit. Processing takes place in the EU.

The legal basis is our legal obligation to obtain consent and to be able to demonstrate it (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). Storing your consent decision on your device is strictly necessary (Section 25(2) No. 2 TDDDG). We have concluded a data processing agreement with Usercentrics (Art. 28 GDPR). We keep records of consent for as long as we need them as proof.

You can change or withdraw your consent at any time via the cookie settings on our website.

More information: https://www.cookiebot.com/en/privacy-policy/

5.5 Contact form

If you send us a message via the contact form on our website, we process the data requested there (e.g. name, email address) and the content of your message in order to respond to your enquiry. Section 3 applies accordingly with regard to legal basis and storage period.

5.6 Customer account

You can create a customer account in our shop. It stores your contact details, delivery addresses and order history so that you can complete future orders more quickly and view past orders.

The legal basis is the performance of the user agreement for the customer account (Art. 6(1)(b) GDPR). You can have your customer account deleted at any time, e.g. by emailing info@carebyfrey.com. Data we are required to retain for commercial or tax law reasons will be blocked until the retention period expires.

5.7 Sign-in with Shop and Google (single sign-on)

You can also sign in to your customer account using an existing Shop or Google account. This is optional. You can always sign in with your email address instead.

When you use single sign-on, the respective provider informs us that you are signed in with them and shares the data you choose to release (usually your name and email address). The provider learns that you are using its account to sign in with us.

The providers are:

  • Shop: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Signing in with Shop requires a Shop account; once signed in, the details saved in Shop are pre-filled at checkout. Privacy policy: https://www.shopify.com/legal/privacy

  • Google: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy

The legal basis is your consent, given by choosing the sign-in method (Art. 6(1)(a) GDPR), and the performance of the user agreement for the customer account (Art. 6(1)(b) GDPR). Google may transfer data to Google LLC in the USA on the basis of the EU-US Data Privacy Framework (see Section 1.4).

5.8 Orders and contract processing

When you place an order with us, we process the following data:

  • First and last name

  • Delivery address and, if different, billing address

  • Email address

  • Phone number (optional)

  • Chosen payment method

  • Order data (products, prices, time of order)

We process this data to fulfil your order, send you order and shipping confirmations, handle returns and warranty claims, and comply with our legal obligations. The legal basis is Art. 6(1)(b) GDPR and, for retention under commercial and tax law, Art. 6(1)(c) GDPR.

5.9 Shipping (DHL)

We ship our orders ourselves via DHL. The provider is DHL Paket GmbH, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany.

To deliver your parcel, we pass your name and delivery address to DHL (Art. 6(1)(b) GDPR).

More information: https://www.dhl.de/en/toolbar/footer/datenschutz.html

5.10 Payment service providers

To process payments, we pass the necessary data (e.g. name, billing address, order amount, payment details) to the payment service provider you choose. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). Some payment service providers are independent controllers under data protection law and may carry out their own credit and fraud checks. For details, please see their privacy policies.

Credit card, Apple Pay, Google Pay and Shop Pay (Shopify Payments) Payments by credit card (Visa, Mastercard, American Express, Maestro, UnionPay), Apple Pay, Google Pay and Shop Pay are processed via Shopify Payments. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. The actual payment processing is carried out by a payment processor engaged by Shopify, in particular Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe may transfer data to the USA on the basis of the EU-US Data Privacy Framework or Standard Contractual Clauses. Privacy policies: https://www.shopify.com/legal/privacy and https://stripe.com/privacy

  • Apple Pay: additionally processed by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Privacy policy: https://www.apple.com/legal/privacy/

  • Google Pay: additionally processed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy

  • Shop Pay: if you use Shop Pay, Shopify stores your payment and delivery details in your Shop account for future purchases. Privacy policy: https://www.shopify.com/legal/privacy

PayPal The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Privacy policy: https://www.paypal.com/de/legalhub/privacy-full

Klarna The provider is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Depending on the Klarna payment method you choose, Klarna may carry out an identity and credit check. Privacy policy: https://www.klarna.com/de/datenschutz/

5.11 Subscriptions (Appstle)

For subscriptions, we use the Shopify app Appstle Subscriptions. The provider is Appstle Inc., 6258 Sperling Avenue, Burnaby, BC V5E 2T9, Canada. When you take out a subscription, Appstle processes your contact, delivery and order data as well as your subscription settings (e.g. delivery interval) in order to trigger recurring orders and allow you to manage your subscription.

The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). An adequacy decision of the European Commission applies to Canada. Appstle may also process data in the USA. Such transfers are based on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

More information: https://appstle.com/privacy-policy/

5.12 Strictly necessary cookies

Our website uses strictly necessary cookies without which the shop cannot function, in particular for:

  • the shopping cart

  • signing in to your customer account

  • checkout and payment processing

  • language and country settings

  • saving your cookie settings

The legal basis for accessing your device is Section 25(2) No. 2 TDDDG. The legal basis for further processing is our legitimate interest in a functioning online shop (Art. 6(1)(f) GDPR) or the performance of a contract (Art. 6(1)(b) GDPR).

5.13 Translation (Shopify Translate & Adapt)

Our website is available in German and English. We maintain the translations of our content with the Shopify app Translate & Adapt by Shopify International Limited (address in Section 5.3). No personal data of website visitors is processed in this process. Your chosen language is stored in a strictly necessary cookie (see Section 5.12).

5.14 Product reviews (Judge.me)

We use Judge.me for product reviews. The provider is Judge.me Ltd, c/o Buckworths, 1-3 Worship Street, London EC2A 2AB, United Kingdom.

When you submit a review, we process your name or chosen pseudonym, your email address, the review itself and any photos you upload. Your name or pseudonym and the review are published on our website. Your email address is not published. It is used to verify that the review comes from an actual buyer (labelled as a "verified purchase").

The legal basis is your consent, given by submitting the review (Art. 6(1)(a) GDPR). Verifying the authenticity of reviews is also based on our legal obligation to disclose whether and how we ensure that reviews come from actual buyers (Art. 6(1)(c) GDPR in conjunction with Section 5b(3) of the German Act against Unfair Competition, UWG).

We only send you emails asking for a review if you have consented to this (Art. 6(1)(a) GDPR).

An adequacy decision of the European Commission applies to the United Kingdom (Art. 45 GDPR). Judge.me also uses sub-processors that store data mainly in the USA. These transfers are based on Standard Contractual Clauses. More information: https://judge.me/privacy

5.15 Post-purchase surveys (Zigpoll)

After you complete an order, we ask you to take part in a short, optional survey. We use Zigpoll for this. The provider is Argonautic Labs LLC, 400 E 67th Street, New York, NY 10065, USA.

We process your answers, the associated order and technical data such as IP address, device and browser information and time of participation. The legal basis is our legitimate interest in improving our products and marketing (Art. 6(1)(f) GDPR). Participation is voluntary. Where Zigpoll uses cookies or similar technologies that are not strictly necessary, this only happens with your consent (Section 25(1) TDDDG).

Zigpoll processes data in the USA. Such transfers are based on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

More information: https://www.zigpoll.com/terms-and-policies

5.16 Email marketing and sign-up forms (Klaviyo)

We use Klaviyo to send our newsletter, for sign-up forms on our website and for automated emails. The provider is Klaviyo, Inc., 125 Summer Street, 6th Floor, Boston, MA 02110, USA.

Klaviyo processes your contact data (e.g. email address, first name), your language setting, usage data (e.g. email opens and clicks, products viewed on our website) and meta/communication data (e.g. IP address, device information).

  • Newsletter and sign-up forms: the legal basis is your consent (Art. 6(1)(a) GDPR, see Section 4).

  • Tracking your activity on our website (e.g. products viewed, so that we can send you relevant content): this only takes place with your consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

  • Automated reminder emails (e.g. about an abandoned cart): we only send these if you have consented to receive our newsletter.

Transfers to the USA are based on the EU-US Data Privacy Framework or Standard Contractual Clauses (see Section 1.4). We have concluded a data processing agreement with Klaviyo.

More information: https://www.klaviyo.com/legal/privacy/privacy-notice

5.17 Google Ads conversion tracking and remarketing

With your consent, we use Google Ads to place ads on Google and in the Google advertising network, to measure the success of these ads (conversion tracking) and to show relevant ads to visitors of our website (remarketing). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We process usage data (e.g. pages visited, purchases), meta/communication data (e.g. IP address, device information) and cookie identifiers.

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings. Google may transfer data to Google LLC in the USA on the basis of the EU-US Data Privacy Framework.

More information: https://business.safety.google/privacy/

5.18 Google & YouTube app and Google Merchant Center

Via the Shopify app "Google & YouTube", we transmit our product data (e.g. product name, price, availability) to Google Merchant Center so that our products can be displayed in Google Search, Google Shopping and on YouTube. No personal data about you is transmitted in this process. Where Google tags are embedded on our website via this app, Section 5.17 applies; these tags are only activated with your consent.

5.19 Meta Pixel and Conversions API

With your consent, we use the Meta Pixel and the Meta Conversions API. The provider is Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland.

We use them to measure the success of our ads on Facebook and Instagram, to show relevant ads to visitors of our website (Custom Audiences) and to optimise our campaigns.

  • The Meta Pixel sets cookies in your browser and transmits usage data (e.g. pages visited, products added to cart, purchases) and meta/communication data (e.g. IP address, browser information) to Meta.

  • Via the Conversions API, we additionally transmit the same events directly from our server to Meta. This may include hashed (encrypted) contact data such as your email address or phone number, so that Meta can match the events to a user account.

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Without your consent, the Pixel is not loaded and no data is transmitted via the Conversions API. You can withdraw your consent at any time via the cookie settings.

We are joint controllers with Meta for the collection and transmission of data to Meta (Art. 26 GDPR). The agreement is available at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing. Meta may transfer data to Meta Platforms, Inc. in the USA on the basis of the EU-US Data Privacy Framework.

More information: https://www.facebook.com/privacy/policy

5.20 Website analytics (Microsoft Clarity)

With your consent, we use Microsoft Clarity to understand how visitors use our website and to improve its usability. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.

Clarity records how you interact with our website, e.g. mouse movements, clicks, scrolling and pages visited, and creates aggregated heatmaps and session recordings from this. In addition, technical data is processed, such as your IP address, device and browser information, screen resolution and approximate location. Text you enter in input fields is masked and not recorded. Clarity sets cookies (e.g. "_clck", "_clsk") for up to 12 months to recognise your browser across visits.

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Without your consent, Clarity is not loaded. You can withdraw your consent at any time via the cookie settings.

Microsoft may transfer data to Microsoft Corporation in the USA on the basis of the EU-US Data Privacy Framework (see Section 1.4).

More information: https://privacy.microsoft.com/privacystatement and https://clarity.microsoft.com/terms


6. Social media profiles

We maintain profiles on social networks to present our brand and products and to connect with you. The operators of these networks generally process their users' data for advertising purposes. Among other things, they create profiles based on usage behaviour in order to show you interest-based ads both inside and outside the networks. To do this, they store information in cookies on your device, sometimes even if you are not logged in or registered. The operators may also process data outside the EU, which can make it harder for you to enforce your rights.

If you contact us via our profiles, we process the data you provide in order to respond to your enquiry. The legal basis is our legitimate interest in communicating with you (Art. 6(1)(f) GDPR).

The operators are responsible for their own processing of your data. For more information and ways to object, please see their privacy policies.

6.1 Instagram and Facebook

The operator is Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland.

We are joint controllers with Meta for processing data to create statistics on the use of our profiles (Page Insights) (Art. 26 GDPR). Meta explains which data is processed at https://www.facebook.com/legal/terms/information_about_page_insights_data. The joint controller agreement is available at https://www.facebook.com/legal/terms/page_controller_addendum. You can exercise your rights against both us and Meta. Under this agreement, however, Meta is responsible for handling data subject requests, so you will usually receive a faster response if you contact Meta directly.

  • Instagram: https://privacycenter.instagram.com/policy

  • Facebook: https://www.facebook.com/privacy/policy

  • Ad settings: https://accountscenter.facebook.com/ads

6.2 TikTok

The operator is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Privacy policy: https://www.tiktok.com/legal/privacy-policy-eea

6.3 LinkedIn

The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy policy: https://www.linkedin.com/legal/privacy-policy Opt out of ad tracking: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out


7. Changes to this privacy policy

We update this privacy policy when our data processing or the legal situation changes. The current version published on our website applies.

8. Questions about data protection

If you have any questions about data protection, please contact us at info@carebyfrey.com or at the address given in Section 1.1.

In the event of any discrepancy, the German version of this privacy policy prevails.