Privacy policy
With this privacy policy, we inform you about the scope of processing your personal data (hereinafter referred to as "data").
1. Responsible party for data processing
The party responsible for data processing in accordance with the provisions of the General Data Protection Regulation (GDPR) is:
IQ brand, design & production GmbH
Dorfstraße 11
6262 Schlitters
Email: office@gloryfy.com
2. General Information on Data Processing
As part of our business operations and website management, we process data.
This also includes disclosure by transmission to third parties and, if applicable, to so-called third countries outside the European Union ("EU") and the European Economic Area ("EEA"). If we transfer data outside the EU or EEA, this is indicated accordingly below.
4. Data Processing
a) Log Files When Visiting the Website
We log your website visit. In doing so, we process:
Name(s) of the web page(s) accessed,
Date and time of access,
Amount of data transferred,
Browser type and version,
Operating system you use,
Referrer URL (the previously visited website),
Your IP address,
The requesting provider.
The legal basis for data processing is our overriding legitimate interest in the continuous provision and security of our website, pursuant to Art. 6 (1) f) GDPR.
The log file is deleted after seven days, unless it is needed to prove or clarify specific legal violations that become known within the retention period.
b) Hosting via Shopify
To provide our online presence, we use services from web hosting providers who process the above-mentioned data and all data processed in connection with the operation of this website (log files when visiting the website) on our behalf.
The legal basis for data processing is our overriding legitimate interest in providing our website, pursuant to Art. 6 (1) f) GDPR.
Data Transfer to Third Countries
For our hosting, we use Shopify Inc., 150 Elgin St., 8th Fl., Ottawa, ON K2P 1L4, Canada ("Shopify"). It is possible that data may also be transferred to Shopify Inc. servers in Canada.
There is an adequacy decision by the EU Commission for data transfers to Canada.
c) Customer Account
In connection with the creation and use of a customer account, we process your master data (name, address, email address, bank details, skin type) as well as your usage data (username, password). This enables you to manage your orders and transactions, and allows us to identify you as a customer. The legal basis for this data processing is your consent in accordance with Art. 6 (1) a) GDPR.
d) Virtual Try-On (VTO) by VARAI
By using such VTO solutions, you agree to grant access to your webcam in order to conduct a virtual try-on (VTO), and you release VARAI from any liability under applicable data protection laws and regulations, the European Regulation 2016/676 of April 27, 2016 (GDPR), the EU-U.S. and Swiss-U.S. Privacy Shield, the US Health Insurance Portability and Accountability Act of 1996, the US Health Information Technology for Economic and Clinical Health Act of 2009, the US CCPA of 2020, and Illinois' Biometric Information Privacy Act of 2008, where applicable, as well as any similar laws.
e) Trustpilot
To provide product reviews on our website, we use the Trustpilot service from Trustpilot A/S, Pilestræde 58, 5, 1112 Copenhagen, Denmark. In this process, your email address and the content of your review are transmitted to Trustpilot.
Trustpilot also uses servers in the United States of America. Therefore, data transfers to the USA cannot be ruled out. There is no adequacy decision by the EU Commission for the USA. Trustpilot ensures an adequate level of data protection through standard contractual clauses. A copy of the relevant EU standard contractual clauses is available upon request. Please contact office@gloryfy.com for this purpose.
The legal basis for processing is our legitimate interest pursuant to Art. 6 (1) f) GDPR in communicating with our customers in order to improve our products.
f) Shop system and customer data management using Shopify and HGI system IT OG
To provide our shop system and manage our customer data, we use systems from Shopify Inc., 150 Elgin St., 8th Fl., Ottawa, ON K2P 1L4, Canada (“Shopify”) and Microsoft Dynamics 365 Business Central from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”). The data we process when setting up your customer account and handling your purchase is therefore processed in Shopify and Microsoft systems.
As part of data processing with Shopify, data may be transferred to Canada. The EU Commission has issued an adequacy decision for data transfers to Canada.
Using systems from Microsoft Corporation results in data transfers to the USA. Microsoft is certified under the Data Privacy Framework and is therefore covered by the EU Commission’s adequacy decision. Additionally, Microsoft ensures data transfers via standard contractual clauses.
g) Shipping status notifications
If you would like to be informed by the shipping provider (post.at, post.de) about the status of your shipment, we will forward your email address and phone number to the selected shipping company.
The legal basis for this data processing is your consent in accordance with Art. 6(1)(a) GDPR.
h) Credit check via Klarna
If this is required for the payment method you have chosen, we will conduct a credit check via Klarna. For this purpose, we transmit your name and address to a credit agency, which compares this data with its own database to check your creditworthiness. The credit agency then sends us the relevant credit information.
i) Newsletter
To provide you with regular information about our company and offers, we offer an email newsletter. When you sign up for the newsletter, we process the data you enter during registration (email address and any other voluntary information). To prevent misuse, we will send you an email after you sign up, asking you to confirm your subscription (double opt-in process). To legally document the registration process, your registration is logged. This includes the date and time of registration and confirmation as well as your IP address.
The legal basis for sending the newsletter is your consent in accordance with Art. 6(1)(a) GDPR. Data processing related to sending the confirmation email for your registration and the associated data logging is carried out under Art. 6(1)(f) GDPR based on our legitimate interest in documenting your proper registration.
If you give your consent, we also evaluate in the newsletters whether you have opened the newsletter as well as your scrolling and clicking behavior within the newsletter. This is done to tailor our newsletter to your interests and improve its content. The legal basis for analyzing the newsletter is your consent in accordance with Art. 6(1)(a) GDPR.
We use a service provider to send the newsletter, to whom we transmit the aforementioned data.
The data is transmitted to the servers of the following service provider in the USA: Klaviyo Inc., 60 South Street, Suite 910, Boston Massachusetts, USA (“Klaviyo”). There is no adequacy decision from the EU Commission for data transfers to the USA. Klaviyo ensures an adequate level of data protection via the EU Standard Contractual Clauses. A copy of the relevant EU Standard Contractual Clauses will be provided upon request. Please contact office@gloryfy.com for this purpose.
j) Direct email marketing to existing customers
If you have placed an order with us, we will use the email address you provided at registration to recommend products that complement those you have purchased.
The legal basis for sending such communications following the sale of goods or services is our legitimate interest in direct marketing to our existing customers in accordance with Art. 6(1)(f) GDPR.
You can object to direct email marketing at any time without incurring any costs other than the transmission costs at basic rates.
We also use a service provider to send direct marketing emails, to whom we transmit the aforementioned data.
The data is transmitted to the servers of the following service provider in the USA: Klaviyo Inc., 60 South Street, Suite 910, Boston Massachusetts, USA (“Klaviyo”). There is no adequacy decision from the EU Commission for data transfers to the USA. Klaviyo ensures an adequate level of data protection via the EU Standard Contractual Clauses. A copy of the relevant EU Standard Contractual Clauses will be provided upon request. Please contact office@gloryfy.com for this purpose.
k) Direct mail marketing to existing customers
If you have placed an order with us, we will use the name and address you provided at registration to recommend products that complement those you have purchased.
The legal basis for sending such communications following the sale of goods or services is our legitimate interest in direct marketing to our existing customers in accordance with Art. 6(1)(f) GDPR.
We use Österreichische Post as a service provider to send direct mail marketing, to whom we transmit the aforementioned data.
We also use a service provider to manage address data, to whom we transmit the aforementioned data.
The data is transmitted to the servers of the following service provider in the USA: Klaviyo Inc., 60 South Street, Suite 910, Boston Massachusetts, USA (“Klaviyo”). Klaviyo ensures an adequate level of data protection via the European Commission’s Standard Contractual Clauses. A
Copy of the relevant EU Standard Contractual Clauses will be provided upon request. Please contact office@gloryfy.com for this purpose.
l) Customer reviews after purchase
To manage customer surveys after your purchase, we use the Trustpilot service from Trustpilot A/S, Pilestraede 58, 5th floor, DK-1112 Copenhagen K. In this process, we process your email address provided at the time of purchase and the products you ordered from us.
The legal basis for this data processing is your consent in accordance with Art. 6(1)(a) GDPR.
m) Use of Cookies
We use so-called cookies on our website. Cookies are small text files that are placed on your device (PC, smartphone, tablet, etc.) and stored by your browser.
You can find detailed information about the specific cookies we use, their providers, and their purposes in our consent banner (see footer: "Change cookie settings"). There, you can give your consent to individual services, withdraw it, or adjust your settings at any time.
Our Consent Banner
To document your choices regarding certain data processing activities and to fulfill our legal obligations under data protection laws, we use a consent banner. When you visit our website, your cookie preferences are requested via a banner. We then set a cookie that stores data about the consents you have given or withdrawn. This data processing is carried out to fulfill our legal obligations pursuant to Art. 6(1)(c) GDPR.
n) Analytics / Marketing
na) Google Services
We use various services from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google") on our website. This may also involve the transfer of data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Google is certified under the EU-US Data Privacy Framework and falls under the EU's adequacy decision for the USA.
nb) Meta Custom Audience (Pixel/Cookies)
We use a so-called tracking pixel from Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Meta Platforms Inc., 1601 Willow Road, Menlo Park, CA 94025, USA, on our website. We use the Meta Pixel to track the success of our own ad campaigns on Meta platforms and to optimize the delivery of Meta ads to interested target groups.
After clicking on a Meta ad or when visiting our website, a cookie is stored on your device via the pixel on our website. The cookie processes data about whether you arrived at our website via a Meta ad and allows us to
analyze user behavior up to the point of purchase. This enables us to track the success rate of our Meta ad campaigns. Additionally, the pixel processes data about your visit to our website and allows us to tailor the ads shown to you on Meta platforms to your interests.
When you visit our website, the Meta Pixel integrated on our site establishes a direct connection to Meta's servers. The information generated by the cookie about your use of this website (including your IP address) is transmitted to Meta in the USA.
The collected data is anonymous to us and does not allow us to identify users. If you are registered on a Meta platform, Meta may associate the collected information with your account. Even if you do not have an account or are not logged in when visiting our website, Meta may still process and store your IP address and other identifying data.
The use of cookies or similar technologies is based on your consent in accordance with Section 25(1) Sentence 1 TDDDG. The legal basis for data processing is your consent pursuant to Art. 6(1)(a) GDPR.
You can withdraw your consent to data processing by Meta Pixel for our web domain at any time with effect for the future by adjusting your preferences in our consent banner (see footer: "Change cookie settings").
Meta is certified under the EU-US Data Privacy Framework and is therefore covered by the EU's adequacy decision for the USA.
nc) Microsoft Advertising (formerly Bing Ads)
We use Microsoft Advertising on our website, an advertising service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. This involves so-called conversion tracking. If you click on an ad placed by
Microsoft, a cookie is set. If the user visits certain pages of this website and the cookie has not yet expired, Microsoft and we can recognize that the user clicked on the ad and was redirected to that page. This cookie is not used to personally identify users.
The data collected using the conversion cookie is used to create statistics for advertising customers who have opted for conversion tracking.
The use of cookies or similar technologies set by Microsoft is based on your consent in accordance with Section 25(1) Sentence 1 TDDDG. The legal basis for data processing is your consent pursuant to Art. 6(1)(a) GDPR.
You can withdraw your consent at any time with effect for the future by disabling the cookie in your browser's user settings or by adjusting your preferences in our consent banner (see footer: "Change cookie settings").
Microsoft Ireland Operations Limited is a subsidiary of the Microsoft Corporation, which is headquartered in the USA. Therefore, data may be transferred to and processed by Microsoft Online Inc. in the USA.
Microsoft is certified under the EU-US Data Privacy Framework and falls under the EU's adequacy decision for the USA.
nd) Meta Ads
We use Meta Ads on our website, an advertising service provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Meta Platforms Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. This involves what is known as conversion tracking. If you click on an ad placed by Meta, a cookie is set. If the user visits certain pages on this website and the cookie has not yet expired, Meta and we can recognize that the user clicked on the ad and was redirected to this page. This cookie is not used for personal identification of users.
The data collected using the conversion cookie is used to create statistics for advertising customers who have opted for conversion tracking.
The use of cookies or similar technologies set by Meta is based on your consent in accordance with Section 25 (1) Sentence 1 of the TDDDG. The legal basis for data processing is your consent pursuant to Art. 6 (1) a) GDPR.
You can revoke your consent at any time with future effect by disabling the cookie through your internet browser under user settings or by adjusting your preferences in our consent banner (see footer: "Change cookie settings").
Meta Platforms Ireland Limited is a subsidiary of the Meta Group, headquartered in the USA. Therefore, data may be transferred to and processed by Meta Platforms Inc. in the USA.
Meta is certified under the EU-US Data Privacy Framework and falls under the EU's adequacy decision for the USA.
5. Duration of Data Storage
We store personal data only as long as necessary for the purposes for which they are processed, or until any consent you have given is revoked. Where statutory retention obligations must be observed, the storage period for certain data may be up to 10 years, regardless of processing purposes.
6. Your Data Subject Rights
a) Access
Upon request, you may receive information at any time, free of charge, about all personal data we have stored about you.
b) Rectification, Deletion, Restriction of Processing (Blocking), Objection
If you no longer agree to the storage of your personal data or if it has become inaccurate, we will, upon your instruction, delete or block your data or make the necessary corrections (as far as this is permitted under applicable law). The same applies if we are to process your data only in a restricted manner in the future. You have the right to object, especially in cases where your data is required for the performance of a task carried out in the public interest or the processing is based on our legitimate interests, including profiling based on those interests. You also have the right to object if your data is processed for direct marketing purposes.
c) Right of Revocation for Consents with Future Effect
You may revoke any consent given at any time with effect for the future. Your revocation does not affect the lawfulness of processing carried out up to the time of revocation.
d) Data Portability
If data processing is based on a contract, pre-contractual negotiations, your consent, or automated procedures, you have the right to data portability. Upon request, we will provide your data in a commonly used, structured, and machine-readable format so that you can transfer the data to another controller if you wish.
f) Exercising Your Rights and Right to Lodge a Complaint
If you have questions about the processing of your personal data, or if you wish to request information, rectification, blocking, objection, deletion, or transfer of data to another company, please contact office@gloryfy.com.
You also have the option to lodge a complaint with a supervisory authority regarding your data subject rights.
e) Restriction of Processing
Data for which we are unable to identify the data subject, for example, if it has been anonymized for analysis purposes, is not covered by the above rights. Access, deletion, blocking, correction, or transfer to another company may be possible for such data if you provide us with additional information that allows us to identify you.