Privacy Policy

1. Controller

Dr. BILDIR Medical GmbH
Managing Director: Dr. Ayse Bildir
Glücksteinallee 69
68163 Mannheim
Germany
Telephone: +49 621 8455 308
E-mail: info@drbildirmedical.com

Privacy contact: Dr. Ayse Bildir, info@drbildirmedical.com.

2. Principles, purposes and legal bases

We process personal data only where necessary for the secure operation of the website, responding to enquiries, providing accounts and learning functions, initiating and managing partner relationships, processing orders, complying with legal obligations or where you have consented.

Legal bases include Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract and pre-contractual steps), Article 6(1)(c) GDPR (legal obligations) and Article 6(1)(f) GDPR (legitimate interests). Section 25(1) and (2) TDDDG additionally applies to access to information on your device.

Our legitimate interests include secure and reliable operation, prevention of misuse and fraud, troubleshooting, responding to enquiries and protecting legal claims. We delete data when the relevant purpose no longer applies and there is no statutory retention duty or legitimate reason for further storage.

3. Website operation, hosting and security

The website is hosted by IONOS SE in Germany. When you access it, technically necessary data are processed, including IP address, time, page accessed, referrer, browser/device and status information. This supports secure and stable delivery and misuse detection (Article 6(1)(f) GDPR).

Technically necessary cookies and comparable storage access support the cart, language, login, security and consent management. They are based on section 25(2) TDDDG and, depending on the function, Article 6(1)(b), (c) or (f) GDPR.

4. Consent management

We use CookieYes to collect and document your choice. Consent status, time and technically necessary assignment data are processed on the basis of Article 6(1)(c) and (f) GDPR and section 25(2) TDDDG. CookieYes may process data in the United Kingdom.

Storage access requiring consent and extended statistical analysis are used only after consent (Article 6(1)(a) GDPR and section 25(1) TDDDG). You can change or withdraw your choice at any time through the cookie settings. The Basic Consent Mode described in section 11 blocks Google tags until you consent.

5. Contact and e-mail communication

When you contact us, we process your contact details, message and, where relevant, order information to respond. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries and otherwise Article 6(1)(f) GDPR.

Website e-mails are sent using IONOS SMTP. Outgoing messages and technical delivery data are logged with restricted access for troubleshooting and automatically deleted after 28 days (Article 6(1)(f) GDPR).

6. Newsletter and email updates

If you voluntarily subscribe to product news, skincare tips or offers by email, we process your email address, the time and wording of your consent and cryptographically hashed technical verification data. We use a double opt-in process: the subscription becomes active only after you click the confirmation link in our confirmation email. The confirmation link expires after seven days. The legal basis is your consent under Article 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future, in particular by using the unsubscribe link included in marketing emails. The lawfulness of processing before withdrawal remains unaffected. We retain evidence of consent and withdrawal as necessary to meet our legal accountability obligations.

7. Orders, guest orders and customer accounts

For orders, we process in particular master, contact, billing, delivery, order, payment-status and communication data (Article 6(1)(b) and (c) GDPR).

Guest orders are available. A customer account may also be created without placing an order, in particular for Skin Lab and Academy and partner functions. We process the data required for registration, login, account administration and the requested functions. Account data are deleted when the account is no longer needed or at your request, unless statutory or legitimate grounds require retention.

8. Skin Lab, Academy and partner relationships

When you use Skin Lab or Academy functions, we may process account assignment, learning and mission progress, answers, assessment results, points, status, certificate data and required security logs. This supports provision of the functions, progress storage, certificate creation and prevention of misuse (Article 6(1)(b) and (f) GDPR).

For partner enquiries and approved partners, we process required contact, company, evidence, approval, terms, order and communication data (Article 6(1)(b), (c) and (f) GDPR). Partner records are stored with restricted access and retained only for as long as the relationship, legal duties or legal claims require.

10. Payment and shipping

To carry out the selected payment, we provide the necessary data to the provider selected at checkout. Current providers include Stripe Payments Europe for cards and supported wallet/Klarna payments and PayPal (Europe) for PayPal. Payment providers may also act as independent controllers for payment processing, fraud prevention and legal compliance (Article 6(1)(b) and (c) GDPR).

For delivery, we provide the necessary recipient and shipment data to DHL and any shipping providers involved (Article 6(1)(b) GDPR).

11. Google Analytics 4 and Consent Mode

We use Google Analytics 4 through Google Site Kit for statistical analysis. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use Basic Consent Mode: the Google tag is loaded only if you allow the Statistics category in the cookie settings. Before this consent, this tag neither sets or reads Analytics cookies nor sends measurement signals to Google. After consent, Analytics cookies or a client ID may be used; processing is then based on Article 6(1)(a) GDPR and section 25(1) TDDDG. The IP address is used for broad location determination and discarded before storage. Google Signals are not enabled. Event data are currently retained for 2 months and user data for 14 months. You may withdraw consent at any time through the cookie settings with future effect.

12. Google Ads – measuring purchases from ads

We use Google Ads through Google for WooCommerce to measure the effectiveness of our advertising and attribute orders to previous ad interactions. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google Ads tag is loaded only if you allow the Marketing category in the cookie settings. Before this consent, this tag sends no cookieless measurement signals to Google. After consent, order ID, order value, currency, product identifiers and quantities may be transmitted, and Google cookies or advertising identifiers may be used for attribution (Article 6(1)(a) GDPR and section 25(1) TDDDG). You may withdraw your choice at any time through the cookie settings; an order can also be placed without consent.

The click conversion window is 30 days. This is the period for attributing a purchase to an ad click, not Google’s general retention period. Further information is available in the Google Ads Data Processing Terms and the Google Privacy Policy. Google LLC in the United States may be a recipient; international transfers are subject to the safeguards described in section 16. Enhanced conversions matching hashed customer contact data are currently not enabled.

13. Meta Pixel (Facebook / Instagram)

With your marketing consent, we also use the Meta Pixel for Facebook and Instagram advertising. Meta receives page views, product views, checkout initiation and, for paid orders, purchase value, currency and a pseudonymous event identifier. The page URL, IP address and browser information are also transmitted. Names, email addresses and telephone numbers are not sent for advanced matching. The server-side Conversions API is disabled. Without consent, the Meta Pixel is not loaded. You can withdraw your choice in Cookie Settings. Further information is available in Meta’s Privacy Policy.

Where you have consented and we use Meta Business Tools (for example the Meta Pixel), we and Meta Platforms Ireland Limited are joint controllers for the processing covered by the agreement (Article 26 GDPR). This particularly concerns the collection and transmission of event data and, depending on the function used, matching, campaign delivery and measurement. The allocation of responsibilities and the essential terms are set out in the Controller Addendum. Meta also processes data for its own purposes under its own responsibility.

Meta Privacy Policy

14. Podcasts and external links

Podcast files are delivered from our own web server. Sharing uses the local function on your device; data are sent to a social network only if you choose to open an external service.

LinkedIn and Instagram links are ordinary external links. The relevant provider processes data under its own responsibility only after you click the link.

15. Recipients

Where required for the relevant purpose, recipients may include hosting, IT, security, consent, analytics, payment, shipping, professional advisory and public-authority recipients. Essential current providers are identified above. We do not disclose data for advertising without a legal basis.

16. International transfers

Some providers or subprocessors may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision by the European Commission – including the EU-US Data Privacy Framework or the UK adequacy decision – or on appropriate safeguards such as the EU Standard Contractual Clauses.

17. Provision of data and automated decisions

Providing data is generally voluntary. Without information required for contract, payment or delivery, we cannot process an order. Consent to statistics or advertising measurement is not required to use the shop.

We do not make solely automated decisions that have legal or similarly significant effects. Individual payment providers, particularly Klarna, may perform risk or credit checks under their own responsibility.

18. Your rights

Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20), objection (Article 21) and withdrawal of consent for the future (Article 7(3)).

To exercise your rights, e-mail info@drbildirmedical.com or write to our postal address.

19. Right to lodge a complaint

You may lodge a complaint with a data protection authority. Our competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.