10. other processing purposes (in particular marketing, statistics)

We process your data as described above under 2., 4, 5. and 6. described in more detail and lawfully generated personal data also for the following purposes:

• for sending out postal advertising material about our products/services;
• to manage our customer data;
• for our own analyses and statistical purposes;
• for the optimization of our service offering.

This further processing is based on our legitimate interest in advertising our products and services and in improving our advertising presence and our products and services.

The legal basis for this processing is therefore Art. 6 para. 1 p. 1 lit. f GDPR. If you do not consent to this processing, you have the right to withdraw your consent (see section V.2. below).

III. storage period – deletion periods

The data will be deleted as soon as it is no longer required for the purpose of its processing or for the assertion of our claims and we are not obliged to store it for a longer period of time due to legal regulations. Depending on the individual type of processing, the personal data processed is subject to the following storage and erasure periods:

1. calling up the website

If you have visited our website without using the contact form, registering for the newsletter, placing an order or using one of the other functions, your data will be deleted after one month from the end of the session.

2. health check/metabolic check

The data collected as part of the health check will be deleted within 12 months of the health check being created and sent to you, unless a contract is concluded as a result, in particular nutritional coaching.

3. introductory meeting – making an appointment

The data collected during the appointment booking process will be deleted as soon as it is no longer required for the organization of the appointment.

4. booking nutrition coaching (start to life change)

The personal data collected by us as part of the nutritional coaching will initially be stored for the duration of the nutritional coaching for the purpose of the contractual service. The legal basis for this storage is Art. 6 para. 1 p. 1 lit. b GDPR. Otherwise, the data will be stored until the statutory retention period expires and then deleted, unless we are obliged to do so in accordance with Article 6 para. 1 p. 1 lit. c GDPR due to tax and commercial law storage and documentation obligations (from HGB, StGB or AO) or you consent to storage beyond this in accordance with Art. 6 Para. 1 p. 1 lit. a GDPR have consented.

5. booking courses/webinars (I want to be active and healthy)

The personal data collected by us when booking a webinar will be stored for the duration of our service provision for the purpose of the contractual service. The legal basis for this storage is Art. 6 para. 1 p. 1 lit. b GDPR. Otherwise, the data will be stored until the expiry of the statutory retention period and then deleted, unless we are obliged to do so in accordance with Article 6 para. 1 p. 1 lit. c GDPR due to tax and commercial law storage and documentation obligations (from HGB, StGB or AO) or you consent to storage beyond this in accordance with Art. 6 Para. 1 p. 1 lit. a GDPR have consented.

6. customer account – booking page (elopage)

The data stored under your customer account will be deleted as soon as at least 24 months and a maximum of 48 months have elapsed since the last logout or you have deleted your customer account. This applies subject to a longer storage period prescribed by law. If we require the data for the purpose of enforcing claims, the data will be stored for a correspondingly longer period.

The legal basis in this respect is Art. 6 para. 1 p. 1 lit. c GDPR.

7th Newsletter

The information on the storage of your data provided in the context of the newsletter registration can be found above under II.7.

8. cooperation partner link

We do not store any data as part of your use of the cooperation partner link.

9. use of cookies

You can find out the deletion periods for the individual cookies as part of your consent via the cookie banner.

10. other processing purposes (in particular marketing, statistics)

If we process your data for other permissible processing purposes in the context of marketing and statistics, it will be deleted – unless you object to the processing – 24 months after your last contact with us.

IV Disclosure of data
We pass on your personal data to third parties as follows:

1. authorization to transfer

Your personal data will not be transferred to third parties for purposes other than those listed below (sections 2 ff.).

We only pass on your personal data to third parties if:

• this is legally permissible and in accordance with Art. 6 para. 1 p. 1 lit. b GDPR is required for the processing of contractual relationships with you,
• for the disclosure pursuant to Art. 6 para. 1 p. 1 lit. c GDPR a legal obligation exists and/or
• the disclosure pursuant to Art. 6 para. 1 p. 1 lit. f GDPR is necessary for the establishment, exercise or defense of legal claims and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your data.

We will only pass on your personal data for other purposes if you have given your express consent, Art. 6 para. 1 p. 1 lit. a GDPR.

2. Receiver, general

Your personal data will be passed on by us to third parties, primarily to the service partners involved in the processing of the contract, such as the logistics company commissioned with the delivery and the credit institution commissioned with payment matters. We also transmit your data to credit agencies under certain conditions (see section 4.) and debt collection companies (see section 5.). Finally, the contract data is transmitted to our tax advisor and the relevant authorities (in particular the tax authorities). Furthermore, your data may be transferred to the following third parties to the extent permitted by law: Processors to whom we transfer personal data in order to carry out the business relationship with you or to whom we grant access to your data stored by us. In detail: Support/maintenance of IT applications; archiving; call center services; controlling; data destruction; recovery; customer administration; marketing; website management.

However, in cases where your personal data is passed on to third parties, the scope of the data transmitted is limited to the minimum necessary.

The transfer of the data is necessary in the context of contract initiation and/or contract fulfillment and therefore in accordance with. Art. 6 para. 1 p. 1 lit. b GDPR is justified.

3. forwarding to cooperation partners as part of product recommendations

We advertise products from cooperation partners on our website. By activating the respective product recommendation, you will be taken directly to the website of our cooperation partners. If you place an order with the contractual partner on the basis of our recommendation, we will receive remuneration.

We do not pass on your personal data generated on our website to our contractual partner. We also do not store any data in connection with your forwarding to our contractual partner.

4. forwarding to payment service providers

As part of payment processing, we pass on your personal data to the following payment service provider selected by you as follows:

a) for payment by PayPal
The data controller has integrated PayPal components on this website. PayPal is an online payment service provider. Payments are processed via so-called PayPal accounts, which are virtual private or business accounts. PayPal also offers the option of processing virtual payments via credit cards if a user does not have a PayPal account. A PayPal account is managed via an e-mail address, which is why there is no classic account number. PayPal makes it possible to initiate online payments to third parties or to receive payments. PayPal also acts as a trustee and offers buyer protection services. The European operating company of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg. If the data subject selects “PayPal” as the payment option during the ordering process in our online store, the data of the data subject is automatically transmitted to PayPal.

The personal data transmitted to PayPal is usually first name, last name, address, email address, IP address, telephone number, cell phone number or other data required for payment processing. Personal data in connection with the respective order is also required to process the purchase contract. The purpose of transmitting the data is to process payments and prevent fraud. The controller will transfer personal data to PayPal in particular if there is a legitimate interest in the transfer. The personal data exchanged between PayPal and the controller may be transmitted by PayPal to credit reference agencies. The purpose of this transmission is to check identity and creditworthiness. PayPal may pass on the personal data to affiliated companies and service providers or subcontractors if this is necessary to fulfill the contractual obligations or if the data is to be processed on behalf of PayPal.

By selecting this payment option, the data subject consents to the transfer of personal data required for payment processing. The disclosure of the data is therefore permitted in accordance with. Art. 6 para. 1 S.1. lit. a GDPR is justified. The data subject has the option to withdraw consent to the processing of personal data at any time. towards PayPal to revoke. A revocation does not affect personal data that must be processed, used or transmitted for (contractual) payment processing. The processing of this data is permitted under Art. 6 para. 1 p. 1 lit. b GDPR is justified. The applicable data protection provisions of PayPal may be retrieved under https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

b) for payment by credit card
On our website, we offer payment by VISA and Mastercard credit cards, among others. By selecting the relevant credit card, you can enter your details via a secure connection. When the order is placed, the invoice amount is charged to the credit card via the responsible bank.

Payments are processed via BNP Paribas, APAC TDC Val de Marne, TSA 30233, 94729 FONTENAY SOUS BOIS cedex – FRANCE.

Responsible in Germany:

BNP Paribas S.A. German Branch,

Europa-Allee 12, 60327 Frankfurt am Main, info.de@bnpparibas.com.

BNP Paribas processes the data required in connection with the card payment (card number, expiry date and card verification number). This data is not used for commercial advertising. They may, if necessary, be disclosed to us by BNP Paribas for the above-mentioned purpose. The necessary data transfers take place under conditions and guarantees that ensure the protection of your personal data. BNP Paribas is solely responsible for the processing of your payment data by BNP Paribas. Please note the data protection information of BNP Paribas.

https://www.bnpparibas.de/de/datenschutzrichtlinie/

c) for payment by SOFORT
After placing your order, you will be redirected to the website of the online provider Sofort GmbH. In order to be able to pay the invoice amount via Sofort, you must have an online banking account with PIN/TAN procedure activated for participation in Sofort, legitimize yourself accordingly and confirm the payment instruction to us. You will receive further information during the ordering process. The payment transaction will be carried out immediately afterwards by Sofort and your account will be debited.

V. Rights of data subjects
You have the following rights with regard to the processing of your personal data:

1. general rights

You have the right:

• to request information about your personal data processed by us free of charge in accordance with Art. 15 GDPR. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
• in accordance with Art. 16 GDPR, to immediately request the correction of incorrect or incomplete personal data stored by us;
• in accordance with Art. 17 GDPR, to demand the deletion of your personal data stored by us, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;
• in accordance with Art. 18 GDPR, to demand the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful but you refuse to delete it and we no longer need the data, but you need it to assert, exercise or defend legal claims or you have lodged an objection to the processing in accordance with Art. 21 GDPR;
• in accordance with Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller
• pursuant to Art. 7 para. 3 GDPR to revoke your consent once given to us at any time. As a result, we may no longer continue the data processing that was based on this consent in the future and
• to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters.

2. Right of objection

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 para. 1 p. 1 lit. f GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR on grounds relating to your particular situation or if the objection is directed against direct marketing. In the latter case, you have a general right to object, which will be implemented by us without specifying a particular situation.

Please note that if you object to your personal data being passed on as part of a credit check, delivery on account is generally not (or no longer) possible (see section IV.4. above).

If you would like to exercise your right of revocation or objection, simply send an e-mail to
info@
lifechange.rocks

VI. Data security

We use the widespread SSL (Secure Socket Layer) method in conjunction with the highest level of encryption supported by your browser when you visit our website. As a rule, this involves 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.

If SSL encryption is activated, the data you transmit to us cannot be read by third parties.

We also use suitable technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

VII Up-to-dateness and amendment of this privacy policy

This privacy policy is currently valid and was last updated in December 2021.

Due to the further development of our website and offers on it or due to changed legal or official requirements, it may become necessary to change this data protection declaration. The current privacy policy can be viewed at any time on the website at
https://www.lifechange.rocks/datenschutz
can be retrieved and printed by you.