Privacy Information for End Customers (Dropshipment) and Data Subjects pursuant to Art. 14 GDPR

Incase Handelsgesellschaft mbH

Status: 28 May 2024

We appreciate your interest in our company and our products. In order to ensure that your order is processed securely and reliably, our company acts as a third-party provider for order fulfillment. The protection of your personal data is of the utmost priority to us.

As the data protection controller, we attach great importance to ensuring that your data are processed in accordance with applicable German and European data protection regulations. With the following information, we would like to transparently inform you about which personal data we receive from online retailers in the context of order fulfillment, how we process these data, and which rights you are entitled to.

1. Name and Contact Details of the Controller

The controller responsible for processing your personal data in the context of order fulfillment is:

Incase Handelsgesellschaft mbH
Nordsternstr. 25
45329 Essen
Germany

Phone: +49 (0)201 219 611 11
Email: service@incase-gmbh.de
Website: https://www.incaseofbeauty.com/

2. Contact Details of the Data Protection Officer

The appointed data protection officer is:

DataCo GmbH
Sandstrasse 33
80335 Munich
Germany

Phone: +49 89 452459 900
Email: datenschutz@dataguard.de
Website: www.dataguard.de

3. Processing of Your Personal Data

a. Personal data processed by us

Within the scope of order fulfillment, we process the following personal data relating to you:

Last name
First name
Delivery address
Order number
Order date
Customer number
Order contents

b. Purposes of data processing

We process your personal data for the following purposes:

To process and fulfill your order
To process your return

c. Sources from which we receive your personal data

We receive your personal data from the following sources:

QVC Handel S.à r.l. & Co. KG, Rhein Studios, Plockstr. 30, 40221 Düsseldorf
GALERIA S.à r.l. & Co. KG, Theodor-Althoff-Str. 2, 45133 Essen

d. Legal bases for data processing

The legal bases for processing are:

Processing for the performance of a contract – Art. 6(1)(b) GDPR
Personal data are processed insofar as this is necessary for the performance of a contract, including pre-contractual and post-contractual measures.

Processing to comply with a legal obligation – Art. 6(1)(c) GDPR
Legal obligations arise in particular from tax and commercial law retention requirements.

Processing based on legitimate interests – Art. 6(1)(f) GDPR
Our legitimate interests include processing activities related to the assertion, exercise, or defense of legal claims.

4. Recipients or Categories of Recipients of Personal Data

Your personal data may be disclosed to the following recipients where legally permitted:

Processors
Parcel delivery services
Postal service providers
Suppliers / manufacturers delivering directly to end customers under the dropshipping model
Logistics companies carrying out shipping on behalf of the supplier or retailer

5. Transfer of Personal Data to Third Countries

Your personal data will not be transferred to countries outside the European Union or the European Economic Area, nor is such a transfer planned.

6. Duration of Storage of Personal Data

We store your personal data only for as long as necessary for the purposes for which they were collected. Data are deleted or destroyed as soon as they are no longer required.

Appropriate measures are taken to ensure that personal data are processed only under the following conditions:

For the duration necessary to provide services to you
As required by law, contract, or legal obligations
Only for as long as necessary for the purpose of collection, or longer if required by contract or law, with appropriate safeguards

Retention may be required in particular if the data are still needed to fulfill contractual obligations, examine or defend warranty or guarantee claims, or comply with statutory retention periods of up to ten years, including obligations under the German Commercial Code, Fiscal Code, and Anti-Money Laundering Act. Where statutory retention obligations apply, deletion takes place only after expiry of the relevant retention period.

7. Rights of Data Subjects

Under the General Data Protection Regulation, you have the following rights:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure or restriction of processing (Arts. 17 and 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR)
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

These data protection notices were prepared with the support of DataGuard.