Privacy Policy
This is a translation for your convenience. Only the German version is legally binding.
As of: October 2026
1. Controller
bcb Beauty Cosmetics Berlin UG (haftungsbeschränkt)
Wexstraße 39, 10715 Berlin
Represented by the Managing Director Siegfried Tollkühn
Phone: +49 30 854 67 79 · Email: kontakt@beauty-cosmetics.de
We are not required to appoint a Data Protection Officer. If you have questions regarding data protection, please contact us at the email address provided above.
2. Your Rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to object to processing based on legitimate interests (Art. 21 GDPR). You may revoke consent granted at any time with effect for the future (Art. 7 (3) GDPR) — consents for cookies and similar technologies at any time via the "Cookie Settings" link in the footer of every page.
You also have the right to lodge a complaint with a data protection supervisory authority, for example with the supervisory authority competent for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.
3. Provision of the Online Shop (Hosting, Server Log Files)
Our online shop runs on a server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in a data center located in Berlin. We have entered into a data processing agreement with IONOS (Art. 28 GDPR). When accessing a web page, the server automatically processes technically necessary data: your IP address, date and time of access, page requested, browser type, and the previously visited page. This is necessary to deliver the page and ensure system security (Art. 6 (1) (f) GDPR). Server log files are deleted after 14 days at the latest, unless required to clarify a security incident.
The connection is encrypted via TLS.
4. Cookies and Consent Management
We use technically necessary cookies without which the shop cannot function: session management (shopping cart, user login, language, and currency) and the storage of your cookie preferences (§ 25 (2) TDDDG, Art. 6 (1) (b) and (f) GDPR). Your visual display settings (e.g. dark design, high contrast, reduced motion) are stored in a cookie because you expressly requested them.
All other services (category "Statistics") are only loaded if you give your consent in our consent banner (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). To document your choice, we store a random identifier, the selected categories, the banner version, and timestamp — without storing your IP address and without linkage to your customer account. Your selection remains valid for 12 months; afterwards, we request consent again. You can modify your choices at any time via the "Cookie Settings" link in the footer. We operate the consent banner and consent log ourselves, without third-party providers.
5. Customer Account and Orders
For order processing, we process the data you provide during checkout: name, address, email address, optional phone number and company, ordered items, payment and shipping method (Art. 6 (1) (b) GDPR). You may order as a guest or create a customer account; in your account, we additionally store your password (encrypted only) and order history.
We retain order and invoice data for as long as required by commercial and tax retention regulations (up to 8 or 10 years, Art. 6 (1) (c) GDPR in conjunction with § 257 HGB, § 147 AO). Your customer account is deleted upon request; data subject to statutory retention obligations will be restricted until the retention period expires.
If you had a customer account in our previous shop, it was migrated along with your order history to our new shop system so that you can continue using it smoothly (Art. 6 (1) (b) and (f) GDPR).
6. Payment Processing
Mollie: Payments by credit or debit card, PayPal, Klarna, and Apple Pay are processed by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. For this purpose, we transmit the order amount, order number, your name, email and billing address, and for Klarna the ordered items to Mollie (Art. 6 (1) (b) GDPR). Card details are entered into form fields loaded directly by Mollie; we do not receive them. When paying by card, the website therefore loads scripts from Mollie (js.mollie.com, api.mollie.com). Depending on the selected payment method, Mollie passes data to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, Klarna Bank AB (publ), Stockholm, or Apple Distribution International Ltd., Cork, and the card-issuing institutions; these providers may act partly as independent controllers. Klarna may perform an identity and credit check for purchase on invoice and installment plans; Klarna informs you about this during the payment step. Privacy policy of Mollie: https://www.mollie.com/de/privacy
Advance payment, purchase on invoice, cash payment: These payments are processed directly by us. For purchase on invoice, no third-party credit check is carried out; we offer it only to customers whom we have activated for this purpose.
7. Shipping
For delivery, we transmit your name and shipping address to the carrier you selected (Art. 6 (1) (b) GDPR): Deutsche Post DHL Group or DHL Paket GmbH, Bonn; Hermes Germany GmbH, Hamburg; United Parcel Service Deutschland S.à r.l. & Co. OHG, Neuss. For deliveries to Switzerland and Norway, the carriers additionally receive the details required for customs declaration (items, value). We only share your email address or phone number if you have explicitly consented.
8. Email Delivery and Contact
Order and account emails are sent via the mail server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur (data processor). When you contact us via the contact form or email, we process your information to handle your inquiry (Art. 6 (1) (b) or (f) GDPR) and delete it once the matter is resolved and no statutory retention obligations apply.
To protect against automated abuse, we verify forms (contact, registration, reviews, newsletter) using an in-house, invisible procedure without third-party services and without CAPTCHAs. For this purpose, we generate an encrypted identifier from your IP address (hash value with a key that changes daily) in order to detect excessive requests in a short period of time (Art. 6 (1) (f) GDPR). We do not store the IP address itself for this purpose; the identifier is deleted after 2 hours at the latest.
9. Newsletter
When you subscribe to our newsletter, we use your email address to send the newsletter (Art. 6 (1) (a) GDPR). You will first receive a confirmation email (double opt-in). You can unsubscribe from the newsletter at any time via the link in each email or in your customer account. We record your registration (timestamp, confirmation) as proof of consent.
10. Product Reviews and Notifications
If you submit a product review, we publish it displaying the name you provided (Art. 6 (1) (a) GDPR). If you request a back-in-stock notification for a product, we use your email address exclusively for this purpose and delete it after sending the notification.
11. Web Analytics with Google Analytics (Only with Consent)
If you consent to the "Statistics" category, we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies (_ga, _ga_*; storage duration up to 2 years) and records how you use our shop: pages viewed, referrer, device and browser, approximate region, and e-commerce events (viewed products, cart, checkout, purchase with order number and amount). We do not transmit names, email addresses, or postal addresses. The purpose is statistical analysis and optimization of our offering (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Google Analytics is not loaded without your consent.
Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (Adequacy Decision of the EU Commission, Art. 45 GDPR). Google processes data on our behalf; we have entered into a data processing terms with Google. Analytics data is deleted after 14 months. Further information: https://policies.google.com/privacy
12. Services of Our Payment Provider (PrestaShop Account)
For connecting Mollie to our shop system, we use modules from PrestaShop SA, 4 rue Jules Lefebvre, 75009 Paris, France ("PrestaShop Account", "PrestaShop EventBus"). Through these modules, technical details about our shop (shop address, shop identifier, version, installed modules) are transmitted to PrestaShop so that payment services can be set up and operated (Art. 6 (1) (f) GDPR). These modules only transmit personal data of customers if we activate a service from PrestaShop that requires it; we currently do not use any such service.
13. Fonts and Embedded Content
Fonts and symbols are hosted on our own server; no data is transmitted to third parties in this process. We currently do not use embedded third-party content (such as external videos or maps).
14. Changes
We update this privacy policy when our data processing practices or legal requirements change. The version published here applies in each case.