Privacy Policy of YELASAI GmbH

1. What is this Privacy Policy about? 

2. Who is responsible for processing your data? 

3. What data do we process? 

4. For what purposes do we process your data? 

5. On what basis do we process your data? 

6. What applies to profiling and automated individual decisions? 

7. To whom do we disclose your data? 

8. Is your personal data also transferred abroad? 

9. How long do we process your data? 

10. How do we protect your data? 

11. What rights do you have? 

12. Do we use online tracking and online advertising techniques? 

13. What data do we process on our social media pages? 

14. What data do we process in connection with sending our newsletter? 

15. What other third-party plugins and tools do we use? 

16. What data is transmitted to payment providers? 

17. Can this Privacy Policy be amended? 

18. Vision AI System ai-yelasai.com

1. What is this privacy policy about?

YELASAI GmbH (hereinafter also "we", "us") collects and processes personal data concerning you or other persons (so-called "third parties"). We use the term "data" here synonymously with "personal data".

In this privacy policy, we describe what we do with your data when you use our website (https://yelasai.com) (hereinafter "Website"), obtain our services or products, are otherwise connected with us in the context of a contract, communicate with us or otherwise have dealings with us. Where applicable, we will inform you by means of a timely written notice about additional processing activities not mentioned in this privacy policy. Additionally, we may inform you separately about the processing of your data, e.g. in consent declarations, contractual terms, additional privacy policies, forms and notices.

If you transmit or disclose to us data about other persons, we assume that you are authorised to do so and that this data is correct. By transmitting data about third parties, you confirm this. Please also ensure that these third parties have been informed about this privacy policy.

This privacy policy is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR"), the Swiss Federal Act on Data Protection ("FADP") and the revised Swiss Federal Act on Data Protection ("revFADP"). However, whether and to what extent these laws are applicable depends on the individual case.

2. Who is responsible for processing your data?

YELASAI GmbH, based in Heiden (Switzerland) (the "YELASAI GmbH"), is responsible under data protection law for the data processing by YELASAI GMBH described in this privacy policy, unless otherwise communicated in individual cases, e.g. in further privacy policies, on forms or in contracts.

You can contact us regarding your data protection concerns and the exercise of your rights in accordance with Section 11 as follows:

YELASAI GmbH
Hinterbissaustrasse 64a 
CH-9410 Heiden AR
dataprotection@yelasai.com

 

Representative in the European Union

As a company based in Switzerland, we have appointed the following representative in the Union in accordance with Art. 27 GDPR:

Alois Scherrer AG
Rasis Bündt 10
6890 Lustenau
Österreich

You may contact both us and our representative in the Union with any questions regarding the processing of your personal data.

3. What data do we process?

We process various categories of data about you. The most important categories are as follows:

• Technical data: When you use our website or other electronic services (e.g. free Wi-Fi), we collect the IP address of your device and other technical data to ensure the functionality and security of these services. This data also includes logs in which the use of our systems is recorded. We generally retain technical data for 6 months. To ensure the functionality of these services, we may also assign an individual code to you or your device (e.g. in the form of a cookie, see section 12). The technical data in itself does not generally allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, it may be linked to other data categories (and thus possibly to your person).

• Registration data: Certain services and offerings (e.g. login areas of our website, newsletter dispatch, free Wi-Fi access, etc.) can only be used with a user account or registration, which can be carried out directly with us or via our external login service providers. In doing so, you must provide us with certain data, and we collect data about the use of the service or offering. If you redeem a voucher from one of our contractual partners (e.g. hair growth specialists) with us, we may require certain data from you upon redemption and may transmit certain of your registration data or data concerning the products and/or services obtained with the voucher to the respective [contractual partner/hair growth specialist]. If we issue you with a voucher for one of our contractual partners, we may transmit certain of your registration data to the respective contractual partner or receive such data (see section 7). Access controls to certain facilities may generate registration data; depending on the control system, biometric data may also be collected. We generally retain registration data for 12 months after the end of use of the service or the dissolution of the user account.

• Communication data: When you are in contact with us via the contact form, by email, telephone or chat, by post or via other means of communication, we record the data exchanged between you and us, including your contact details and the metadata of the communication. If we wish or need to establish your identity, we collect data to identify you (e.g. a copy of an identity document). We generally retain this data for 12 months from the last exchange with you. This period may be longer if this is necessary for evidential reasons or to comply with legal or contractual requirements or is technically necessary. Emails in personal mailboxes and written correspondence are generally retained for at least 10 years. Chats are generally retained for 2 years.

• Master data: We refer to master data as the basic data that we require, in addition to contract data (see below), for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information, for example, about your role and function, your bank account details, your date of birth, customer history, powers of attorney, signing authorities and declarations of consent. We process your master data if you are a customer or other business contact or work for such a person (e.g. as a contact person for a business partner), or because we wish to approach you for our own purposes or the purposes of a contractual partner (e.g. in the context of marketing and advertising, with invitations to events, with vouchers, with newsletters, etc.). We receive master data from you yourself (e.g. when making a purchase or as part of a registration), from organisations for which you work, or from third parties such as our contractual partners, associations and address dealers and from publicly accessible sources such as public registers or the internet (websites, social media, etc.). In the context of master data, we may also process health data and information about third parties. We generally retain this data for 10 years from the last exchange with you, but at least from the end of the contract. This period may be longer if this is necessary for evidential reasons or to comply with legal or contractual requirements or is technically necessary. For purely marketing and advertising contacts, the period is normally considerably shorter, usually no more than 2 years since the last contact.

• Contract data: This is data that arises in connection with the conclusion of a contract or the processing of a contract, e.g. information about contracts and the services to be provided or provided, as well as data from the preliminary stages of a contract conclusion, the information required or used for processing and information about responses (e.g. complaints or information about satisfaction, etc.). This also includes health data and information about third parties, e.g. about hereditary diseases in the family. We generally collect this data from you, from contractual partners and from third parties involved in the processing of the contract, but also from third-party sources (e.g. providers of credit data) and from publicly accessible sources. We generally retain this data for [10] years from the last contract activity, but at least from the end of the contract. This period may be longer if this is necessary for evidential reasons or to comply with legal or contractual requirements or is technically necessary.

• Behavioural and preference data: Depending on the relationship we have with you, we try to get to know you and better align our products, services and offerings with you. To this end, we collect and use data about your behaviour and preferences. We do this by evaluating information about your behaviour in our area, and we may also supplement this information with information from third parties – including from publicly accessible sources. Based on this, we can, for example, calculate the probability that you will use certain services or behave in a certain way. The data processed for this purpose is partly already known to us (e.g. if you use our services), or we obtain this data by recording your behaviour (e.g. how you navigate on our website). We anonymise or delete this data when it is no longer meaningful for the purposes pursued, which may be the case between 2-3 weeks and 24 months (for product and service preferences), depending on the type of data. This period may be longer if this is necessary for evidential reasons or to comply with legal or contractual requirements or is technically necessary. We describe how tracking works on our website in section 12.

• Other data: We also collect data from you in other situations. In connection with official or court proceedings, for example, data arises (such as files, evidence, etc.) that may also relate to you. For reasons of health protection, we may also collect data (e.g. as part of protection concepts). We may receive or produce photographs, videos and sound recordings in which you may be recognisable (e.g. at events, through security cameras, etc.). We may also collect data about who enters certain buildings when or has corresponding access rights (including access controls, based on registration data or visitor lists, etc.), who participates in events or campaigns when, or who uses our infrastructure and systems when. The retention period for this data depends on the purpose and is limited to what is necessary. This ranges from a few days for many of the security cameras and generally a few weeks for data for contact tracing, to visitor data, which is generally retained for 3 months, to reports on events with images, which may be retained for several years or longer.

You disclose much of the data mentioned in this section 3 to us yourself (e.g. via forms, in the context of communication with us, in connection with contracts, when using the website, etc.). You are not obliged to do so, subject to individual cases, e.g. in the context of binding protection concepts (legal obligations). If you wish to conclude contracts with us or claim services, you must also provide us with data as part of your contractual obligation in accordance with the relevant contract, in particular master data, contract data and registration data. When using our website, the processing of technical data is unavoidable. If you wish to gain access to certain systems or buildings, you must provide us with registration data. However, with regard to behavioural and preference data, you generally have the option to object or not to give consent.

To the extent that this is not unlawful, we also obtain data from publicly accessible sources (e.g. debt enforcement registers, land registers, commercial registers, media or the internet including social media) or receive data from authorities and from other third parties (such as credit agencies, contractual partners, etc.).

4. For what purposes do we process your data?

We process your data for the purposes explained below. Further information for the online area can be found in sections 12 and 13. These purposes and the objectives underlying them represent legitimate interests of ours and, where applicable, of third parties. You will find further information on the legal bases of our processing in section 5.

We process your data for purposes related to communication with you, in particular to answer enquiries and to assert your rights (section 11) and to contact you if we have any queries. For this purpose, we use in particular communication data and master data and, in connection with offers and services used by you, also registration data. We retain this data to document our communication with you, for training purposes, for quality assurance and for follow-up enquiries.

We process data for the establishment, management and performance of contractual relationships.

We process data for marketing purposes and for relationship management, e.g. to send our customers and other contractual partners personalised advertising for products and services from us and from third parties (e.g. from advertising partners). This may take place, for example, in the form of newsletters and other regular contacts (electronically, by post, by telephone), via other channels for which we have contact information from you, but also in the context of individual marketing campaigns (e.g. events, competitions, etc.) and may also include complimentary services (e.g. invitations, vouchers, etc.). You can refuse such contacts at any time (see at the end of this section 4) or refuse or withdraw consent to being contacted for advertising purposes. With your consent, we can target our online advertising on the internet more specifically to you (see section 12). Finally, we also want to enable our contractual partners to approach our customers and other contractual partners for advertising purposes (see section 7).

We further process your data for market research, for improving our services and our operations and for product development.

We may also process your data for security purposes and for access control.

We process personal data to comply with laws, instructions and recommendations from authorities and internal regulations ('compliance').

We also process data for the purposes of our risk management and as part of prudent corporate governance, including operational organisation and corporate development.

We may process your data for further purposes, e.g. in the context of our internal processes and administration or for training and quality assurance purposes.

 

5. On what basis do we process your data?

Where we ask for your consent for certain processing activities (e.g. for the processing of particularly sensitive personal data, for marketing mailings, for the creation of personalised movement profiles and for advertising control and behavioural analysis on the website), we will inform you separately about the relevant purposes of the processing. You may revoke your consent at any time with effect for the future by written notification (by post) or, unless otherwise stated or agreed, by email to us; our contact details can be found in Section 2. For the revocation of your consent to online tracking, please refer to Section 12. Where you have a user account, revocation or contact with us may also be carried out via the relevant website or other service. Once we have received notification of the revocation of your consent, we will no longer process your data for the purposes to which you originally consented, unless we have another legal basis for doing so. The revocation of your consent does not affect the lawfulness of processing carried out on the basis of consent prior to revocation.

Where we do not ask for your consent for processing, we base the processing of your personal data on the fact that the processing is necessary for the initiation or performance of a contract with you (or with the entity you represent) or that we or third parties have a legitimate interest in doing so, in particular in order to pursue the purposes and associated objectives described above in Section 4 and to be able to implement corresponding measures. Our legitimate interests also include compliance with legal provisions, insofar as these are not already recognised as a legal basis by the applicable data protection law (e.g. in the case of the GDPR, the law in the EEA and in Switzerland). This also includes the marketing of our products and services, the interest in better understanding our markets and in managing and developing our company, including operational activities, in a secure and efficient manner.

If we receive sensitive data (e.g. health data, information on political, religious or philosophical views or biometric data for identification purposes), we may also process your data on the basis of other legal grounds, e.g. in the event of disputes due to the necessity of processing for potential litigation or the establishment or defence of legal claims. In individual cases, other legal grounds may apply, which we will communicate to you separately where necessary.

 

6. What applies to profiling and automated individual decisions?

We may automatically evaluate certain of your personal characteristics for the purposes stated in Section 4 based on your data (Section 3) ('profiling'), if we wish to determine preference data, but also to identify abuse and security risks, carry out statistical evaluations or for operational planning purposes. For the same purposes, we may also create profiles, i.e. we may combine behavioural and preference data, as well as master and contract data and technical data assigned to you, in order to better understand you as a person with your different interests and other characteristics. Anonymous movement profiles are created.

In both cases, we ensure the proportionality and reliability of the results and take measures against misuse of these profiles or profiling. If these may have legal effects or significant disadvantages for you, we generally provide for a manual review.

 

7. To whom do we disclose your data?

In connection with our contracts, the website, our services and products, our legal obligations or otherwise to protect our legitimate interests and the other purposes listed in Section 4, we also transmit your personal data to third parties, in particular to the following categories of recipients:

• Service providers: We work with service providers in Switzerland and abroad who process data about you on our behalf or in joint responsibility with us, or who receive data about you from us under their own responsibility (e.g. IT providers, shipping companies, banks, insurance companies, debt collection agencies, credit reference agencies, hairdressers, hair growth specialists, Hair Active experts, therapists). In order to establish personalised interaction with you through marketing activities, we may pass on personal data to advertising service providers in encrypted form. This enables us to provide relevant offers for you and to inform you about them. You can request the deletion of your data at any time. Please send us an email to do so.
  

• Contractual partners including customers: This primarily refers to customers (e.g. service recipients) and other contractual partners of ours, because this data transmission results from these contracts. For example, they receive registration data on issued and redeemed vouchers, invitations, etc. If you are working for such a contractual partner yourself, we may also transmit data about you to them in this context. This may also include health data. Recipients also include contractual partners with whom we cooperate or who advertise for us and to whom we therefore transmit data about you for analysis and marketing purposes (these may in turn be service recipients, but also, for example, sponsors and providers of online advertising). We require these partners to only send you advertising or display it based on your data if you have consented to this (for the online area, see Section 12). Our online advertising contractual partners are listed in Section 12.

• Authorities: We may pass on personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or entitled to do so or if this appears necessary to protect our interests. This may also include health data. The authorities process data about you that they receive from us under their own responsibility.

• Other persons: This refers to other cases where the involvement of third parties results from the purposes according to Section 4, e.g. service recipients, media or if you are part of one of our publications.

All these categories of recipients may in turn involve third parties, so that your data may also become accessible to them. We can restrict the processing by certain third parties (e.g. IT providers), but not that of other third parties (e.g. authorities, banks, etc.).

We reserve the right to make these data disclosures even when they concern confidential data (unless we have expressly agreed with you that we will not pass on this data to certain third parties, unless we are legally obliged to do so). Notwithstanding this, your data remains subject to adequate data protection even after disclosure in Switzerland and the rest of Europe. For disclosure to other countries, the provisions of Section 8 apply. If you do not wish certain data to be passed on, please inform us so that we can examine whether and to what extent we can accommodate you (Section 2).

We also enable certain third parties to collect personal data from you on our website and at our events (e.g. media photographers, providers of tools that we have integrated on our website, etc.). Insofar as we are not involved in these data collections in a decisive manner, these third parties are solely responsible for them. For concerns and to assert your data protection rights, please contact these third parties directly. See Section 12 for the website.

 

8. Are your personal data also transferred abroad?

As explained in section 7, we also disclose data to other parties. These are not only located in Switzerland. Your data may therefore be processed both in Europe and in Oman and U.A.E.; in exceptional cases, however, in any country in the world.

If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection requirements (for this purpose we use the revised standard contractual clauses of the European Commission, which are available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?), unless they are already subject to a legally recognised framework for ensuring data protection and we cannot rely on an exception provision. An exception may apply in particular to legal proceedings abroad, but also in cases of overriding public interest or if the performance of a contract requires such disclosure, if you have consented or if the data concerned has been made generally accessible by you and you have not objected to its processing.

Please also note that data exchanged via the Internet is frequently routed through third countries. Your data may therefore be transferred abroad even if the sender and recipient are located in the same country.

 

9. How long do we process your data?

We process your data for as long as our processing purposes, statutory retention periods and our legitimate interests in processing for documentation and evidence purposes require, or for as long as storage is technically necessary. Further information on the respective storage and processing periods can be found under the individual data categories in Section 3 and under the cookie categories in Section 12. If there are no legal or contractual obligations to the contrary, we delete or anonymise your data after the expiry of the storage or processing period as part of our normal procedures.

 

10. How do we protect your data?

We take appropriate security measures to maintain the confidentiality, integrity and availability of your personal data, to protect it against unauthorised or unlawful processing and to counteract the risks of loss, unintentional alteration, unwanted disclosure or unauthorised access.

 

11. What rights do you have?

The applicable data protection law grants you the right, under certain circumstances, to object to the processing of your data, in particular data processed for the purposes of direct marketing, profiling carried out for direct marketing purposes and other legitimate interests in processing.

In order to make it easier for you to control the processing of your personal data, you also have the following rights in connection with our data processing, depending on the applicable data protection law:

• The right to request information from us as to whether and what data we process about you;
• the right to have us correct data if it is inaccurate;
• the right to request the deletion of data;
• the right to request from us the disclosure of certain personal data in a common electronic format or its transfer to another controller;
• the right to withdraw consent, insofar as our processing is based on your consent;
• the right to receive further information upon request that is necessary for the exercise of these rights;
• the right, in the case of automated individual decisions (Section 6), to present your point of view and to request that the decision be reviewed by a natural person.

If you wish to exercise the above-mentioned rights vis-à-vis us, please contact us in writing, at our premises or, where not otherwise stated or agreed, by email; our contact details can be found in Section 2. In order to exclude misuse, we must identify you (e.g. with a copy of your identity document, insofar as this is not otherwise possible).

You also have these rights vis-à-vis other entities that cooperate with us as independent controllers – please contact them directly if you wish to exercise rights in connection with their processing. Information about our important cooperation partners and service providers can be found in Section 7, further information in Section 12.

Please note that these rights are subject to conditions, exceptions or limitations under the applicable data protection law (e.g. for the protection of third parties or trade secrets). We will inform you accordingly if necessary.

If you do not agree with our handling of your rights or with data protection, please let us know (Section 2). In particular, if you are located in the EEA, the United Kingdom or Switzerland, you also have the right to lodge a complaint with the data protection supervisory authority of your country. A list of authorities in the EEA can be found here: https://edpb.europa.eu/about-edpb/board/members_de. The supervisory authority of the United Kingdom can be reached here: https://ico.org.uk/global/contact-us/. The Swiss supervisory authority can be reached here: https://www.edoeb.admin.ch/edoeb/de/home/der-edoeb/kontakt/adresse.html.

 

12. Do we use online tracking and online advertising techniques?

On our website, we use various techniques that enable us and third parties we engage to recognise you during your use and, in some cases, to track you across multiple visits. In this section, we inform you about this.

Cookie Banner and Consent

On your first visit, we ask you via our cookie banner which cookies and similar techniques you allow. We always use necessary cookies for the shopping basket, checkout and security. We only load analysis and marketing services if you have consented. If you decline, these services remain disabled. You can change or withdraw your choice at any time via the cookie settings. The legal basis for necessary cookies is Art. 6(1)(f) GDPR; for all others, it is your consent pursuant to Art. 6(1)(a) GDPR.

Google Tag Manager

We manage the integration of analysis and advertising services using Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The Tag Manager itself does not analyse usage data. It only controls which services are loaded following your consent.

Essentially, this is about enabling us to distinguish your access (via your system) from the access of other users, so that we can ensure the functionality of the website and carry out analyses and personalisations. We do not intend to infer your identity, even though we can do so to the extent that we or third parties we engage can identify you by combining data with registration information. Even without registration data, however, the techniques used are designed so that you are recognised as an individual visitor with each page request, for example by our server (or the servers of third parties) assigning you or your browser a specific identification number (so-called 'cookie').

We use such techniques on our website and allow certain third parties to do so as well. Depending on the purpose of these techniques, however, we ask for your consent before they are used. You can access your current settings here. You can programme your browser to block or simulate certain cookies or alternative techniques, or to delete existing cookies. You can also extend your browser with software that blocks tracking by certain third parties. Further information on this can be found on the help pages of your browser (usually under the keyword 'privacy') or on the websites of the third parties we list below.

The following cookies are distinguished (techniques with comparable functionalities such as fingerprinting are included here):

• Necessary Cookies: Some cookies are necessary for the functioning of the website as such or for certain functions (e.g. shopping basket function). They ensure, for example, that you can switch between pages without losing information entered in a form. They also ensure that you remain logged in. These cookies only exist temporarily ('session cookies'). If you block them, the website may not function. Other cookies are necessary so that the server can save decisions or entries you have made beyond a session (i.e. a visit to the website), if you use this function (e.g. selected language, consent given, the function for automatic login, etc.). These cookies have an expiry date of up to [60] months.
  
  
• Performance Cookies: In order to optimise our website and corresponding offers and to better tailor them to the needs of users, we use cookies to record and analyse the use of our website, in some cases also beyond the session. We do this by using analysis services from third-party providers. We have listed these below. Before we use such cookies, we ask for your consent. You can withdraw this at any time via the cookie settings here [Link]. Performance cookies also have an expiry date of up to [60] months. Details can be found on the websites of the third-party providers.
  
  
• Marketing Cookies: We and our advertising partners have an interest in targeting advertising to specific groups, i.e. displaying it only to those we want to address. We have listed our advertising partners below. For this purpose, we and our advertising partners – if you consent – also use cookies with which the content accessed or contracts concluded can be recorded. This enables us and our advertising partners to display advertising that we can assume is of interest to you, on our website but also on other websites that display advertising from us or our advertising partners. Depending on the situation, these cookies have an expiry period of a few days to [12] months. If you consent to the use of these cookies, corresponding advertising will be displayed to you. If you do not consent to these cookies, you will not see less advertising, but simply some other advertising.

In addition to marketing cookies, we use other techniques to control online advertising on other websites and thereby reduce wastage. For example, we can transmit the email addresses of our users, customers and other persons to whom we want to display advertising to operators of advertising platforms (e.g. social media). If these persons are registered there with the same email address (which the advertising platforms determine by matching), the operators display the advertising we have placed in a targeted manner to these persons. The operators do not receive personal email addresses of persons not already known. In the case of known email addresses, however, they learn that these persons are connected with us and which content they have accessed.

We can also integrate other third-party offers on our website, particularly from social media providers. These offers are disabled by default. As soon as you activate them (e.g. by clicking a button), the respective providers can determine that you are on our website. If you have an account with the provider, particularly with the respective social media provider, they can assign this information to you and thus track your use of online offers. The providers process this data under their own responsibility. We currently use offers from the following service providers and advertising partners (insofar as they use data from you or cookies set with you to control advertising):

• Google Analytics: Google Ireland Limited (based in Ireland) is the provider of the 'Google Analytics' service and acts as our processor. Google Ireland relies on Google LLC (based in the USA) as its processor (both 'Google'). Google uses performance cookies (see above) to track the behaviour of visitors on our website (duration, frequency of pages accessed, geographical origin of access, etc.) and creates reports for us on this basis about the use of our website. We have configured the service so that the IP addresses of visitors are shortened by Google in Europe before being forwarded to the USA and therefore cannot be traced back. We have switched off the 'Data sharing' and 'Signals' settings. Although we can assume that the information we share with Google is not personal data for Google, it is possible that Google may use this data for its own purposes to draw conclusions about the identity of visitors, create personal profiles and link this data with the Google accounts of these individuals. If you consent to the use of Google Analytics, you explicitly consent to such processing, which also includes the transfer of personal data (in particular usage data relating to the website and app, device information and individual IDs) to the USA and other countries. Information on Google Analytics' privacy policy can be found here https://support.google.com/analytics/answer/6004245 and if you have a Google account, you can find further details on processing by Google here https://policies.google.com/technologies/partner-sites?hl=de.
  
  
• Google Analytics Remarketing: Google Ireland Limited (based in Ireland) is the provider of the 'Google Analytics Remarketing' service and acts as our processor. Google Ireland relies on Google LLC (based in the USA) as its processor (both 'Google'). Google Remarketing analyses your user behaviour on our website (e.g. clicking on certain products) in order to categorise you into specific advertising target groups and subsequently display suitable advertising messages to you when you visit other online services (remarketing or retargeting). Furthermore, the advertising target groups created with Google Remarketing can be linked with the cross-device functions of Google AdWords and Google DoubleClick. In this way, interest-based, personalised advertising messages that have been adapted to you depending on your previous usage and browsing behaviour on one device (e.g. mobile phone) can also be displayed on another of your devices (e.g. tablet or PC). If you have given appropriate consent, Google will link your web and app browsing history with your Google account for this purpose. In this way, the same personalised advertising messages can be displayed on every device on which you log in with your Google account. To support this function, Google Analytics collects Google-authenticated IDs of users, which are temporarily linked with our Google Analytics data in order to define and create target groups for cross-device display advertising. You can permanently object to cross-device remarketing/targeting by deactivating personalised advertising in your Google account; please follow this link: https://www.google.com/settings/ads/onweb/. The aggregation of the collected data in your Google account is based exclusively on your consent, which you can give or withdraw from Google. For data collection processes that are not merged in your Google account (e.g. because you do not have a Google account or have objected to the merger), the collection of data is based on the protection of a legitimate interest. The legitimate interest arises from the fact that the website operator has an interest in the anonymised analysis of website visitors for advertising purposes. Further information and the privacy policy can be found in Google's privacy policy at: https://www.google.com/policies/technologies/ads/.
  
  
• Google AdWords and Google Conversion Tracking: Google Ireland Limited (based in Ireland) is the provider of the 'Google Analytics Remarketing' service and acts as our processor. Google Ireland relies on Google LLC (based in the USA) as its processor (both 'Google'). As part of Google AdWords, we use what is known as conversion tracking. When you click on an advert placed by Google, a cookie for conversion tracking is set. Cookies are small text files that the internet browser stores on the user's computer. These cookies expire after 30 days and are not used for the personal identification of users. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the advert and was redirected to this page. Each Google AdWords customer receives a different cookie. The cookies cannot be tracked across the websites of AdWords customers. The information obtained using the conversion cookie is used to create conversion statistics for AdWords customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their advert and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. If you do not wish to participate in tracking, you can object to this use by easily deactivating the Google conversion tracking cookie via your internet browser under user settings. You will then not be included in the conversion tracking statistics. The storage of 'conversion cookies' takes place within the framework of protecting a legitimate interest. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its web offering and its advertising. More information on Google AdWords and Google conversion tracking can be found in Google's privacy policy: https://www.google.de/policies/privacy/. You can set your browser so that you are informed about the setting of cookies and only allow cookies on a case-by-case basis, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be limited.
  
  
• other service providers, advertising contract partners such as Meta (Facebook, Instagram, WhatsApp), Google Ads, Custom Audiences, LinkedIn, and others may follow, some of which make specific requirements as to how users of the website etc. are to be informed

 

13. What data do we process on our social media pages?

We may operate pages and other online presences on social networks and other third-party platforms ('fan pages', 'channels', 'profiles', etc.) and collect the data described in Section 3 and below about you there. We receive this data from you and the platforms when you contact us via our online presence (e.g. when you communicate with us, comment on our content or visit our presence). At the same time, the platforms analyse your use of our online presences and link this data with other data about you known to the platforms (e.g. about your behaviour and preferences). They also process this data for their own purposes under their own responsibility, in particular for marketing and market research purposes (e.g. to personalise advertising) and to manage their platforms (e.g. what content they show you).

We process this data for the purposes described in Section 4, in particular for communication, marketing purposes (including advertising on these platforms, see Section 12) and market research. You will find information on the corresponding legal bases in Section 5. We may further distribute content published by you yourself (e.g. comments on an announcement) (e.g. in our advertising on the platform or elsewhere). We or the platform operators may also delete or restrict content from or about you in accordance with the terms of use (e.g. inappropriate comments).

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, this data collection takes place, for example, via cookies that are stored on your device or by recording your IP address.

For further information on the processing carried out by the platform operators, please refer to the privacy notices of the platforms. There you will also find out in which countries they process their data, what rights of access, deletion and other data subject rights you have and how you can exercise them or obtain further information. We currently use the following platforms:

• Facebook and Instagram: We have a Facebook profile (www.facebook.com/yelasai) and an Instagram profile (www.instagram.com/yelasai). The controller responsible for operating these two social media platforms for users in Europe is Meta Platforms Ireland Ltd., Dublin, Ireland. Their privacy notices can be accessed at https://www.facebook.com/privacy/policy and https://privacycenter.instagram.com/policy respectively. Some of your data is transferred to the USA. You can object to advertising here: https://www.facebook.com/adpreferences/ad_settings/?entry_product=account_settings_menu. With regard to the data collected and processed when visiting our Facebook profile for the creation of 'Page Insights' or when visiting our Instagram profile for the creation of 'Instagram Insights', we are jointly responsible with Meta Platforms Ireland Ltd., Dublin, Ireland. Within the framework of Page Insights, statistics are created about what visitors do on our page (comment on posts, forward content, etc.). This is described at https://www.facebook.com/legal/terms/information_about_page_insights_data. Within the framework of Instagram Insights, statistics are created that provide us with insights into the visitors to our Instagram page and their interactions with our Instagram page and its content. This is described at https://www.facebook.com/business/help/441651653251838?id=419087378825961. The Page Insights and Instagram Insights help us to understand how our page is used and how we can improve it. We only receive anonymous, aggregated data. We have regulated our data protection responsibilities in accordance with the information at www.facebook.com/legal/terms/page_controller_addendum  .
  
  
• LinkedIn: We are represented on the social network of the company 'LinkedIn' through an official company profile as well as through profiles of our employees who use them for professional purposes. The controller responsible for operating the platform for users in Europe is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, a subsidiary of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA. In this respect, we point out that there is a possibility that users' data may be processed outside the European Union, the European Economic Area and Switzerland, in particular in the USA. The privacy notices of 'LinkedIn' can be accessed at https://www.linkedin.com/legal/privacy-policy. With regard to the data collected and processed when visiting our page for the creation of 'Page Insights', we may be jointly responsible with LinkedIn Ireland Unlimited Company. Within the framework of Page Insights, statistics are created about what visitors do on our page (comment on posts, forward content, etc.). This is described at https://legal.linkedin.com/pages-joint-controller-addendum. It helps us to understand how our page is used and how we can improve it. We only receive anonymous, aggregated data. We have regulated our data protection responsibilities in accordance with the information at https://legal.linkedin.com/pages-joint-controller-addendum.
  
  
• Twitter: We use the short message service 'Twitter' of Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA (see also https://twitter.com/yelasai). The controller responsible for operating the platform for users in Europe is Twitter International Unlimited Company, Dublin, Ireland. We would like to point out that the use of our Twitter page and its functions or the use of the short message service Twitter and its functions is at your own responsibility. This applies in particular to the use of interactive functions (e.g. tweeting, retweeting, liking, etc.). When you visit our Twitter profile or profiles within the Twitter platform, Twitter collects usage data. We have no influence over what data Twitter processes, to what extent and how, and whether Twitter transfers this data to third parties, in particular also to countries outside the European Union, the European Economic Area and Switzerland, in particular to the USA. Information about what data is processed by Twitter and for what purposes it is used can be found in Twitter's privacy policy, which can be accessed at https://twitter.com/de/privacy . Twitter also uses certain data that it has collected from users of the Twitter platform (e.g. re-tweets) to create aggregated usage statistics and make them available to the respective operators of the Twitter profile ('Twitter Analytics'). YELASAI GmbH also receives such aggregated usage statistics. The information that YELASAI GmbH receives through Twitter Analytics does not allow any conclusions to be drawn about individual users. Only user interactions with our tweets are visible to us. YELASAI GmbH itself has no access to personal data that Twitter processes for Twitter Analytics. Twitter alone determines what data is processed in what way for Twitter Analytics. YELASAI GmbH can neither legally nor actually influence the data processing by Twitter. You can change your privacy settings on Twitter in the account settings at https://twitter.com/settings/account.
  
  
• YouTube: We use the video platform 'YouTube' (see also www.youtube.com/user/YELASAI). The controller responsible for operating the platform for users in Europe is Google Ireland Limited, Dublin, Ireland. Further information on data processing and information on data protection by YouTube (Google) can be accessed at https://policies.google.com/privacy. We use YouTube for playing videos. When you visit our YouTube profiles, YouTube may process your personal data, with YouTube acting as an independent controller. Via 'YouTube Analytics', we have the option of accessing anonymised statistics on the use of our YouTube channels, but without being able to determine who these users are.

 

14. What data do we process in connection with sending our newsletter?

If you wish to receive the newsletter offered on the website, we require an email address from you as well as information which allows us to verify that you are the owner of the specified email address and that you agree to receive the newsletter. No further data is collected or is only collected on a voluntary basis. We use this data exclusively for sending the requested information and do not pass it on to third parties.

The processing of the data entered into the newsletter registration form is carried out exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You may revoke your consent to the storage of the data, the email address and their use for sending the newsletter at any time, for example via the "unsubscribe" link in the newsletter. The lawfulness of the data processing operations already carried out remains unaffected by the revocation.

The data you have deposited with us for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted after the cancellation of the newsletter. Data that has been stored by us for other purposes (e.g. email addresses for the members' area) remains unaffected by this.

We currently use the following services for sending newsletters:

• MailChimp/Intuit: This website uses the services of MailChimp for sending newsletters. The provider is Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA, a subsidiary of Intuit Inc., USA. MailChimp is a service with which, among other things, the sending of newsletters can be organised and analysed. If you enter data for the purpose of receiving the newsletter (e.g. email address), this data will be stored on MailChimp's servers in the USA. With the help of MailChimp, we can analyse our newsletter campaigns. When you open an email sent with MailChimp, a file contained in the email (so-called web beacon) connects to MailChimp's servers in the USA. This allows us to determine whether a newsletter message has been opened and which links may have been clicked. In addition, technical information is collected (e.g. time of retrieval, IP address, browser type and operating system). This information cannot be assigned to the respective newsletter recipient. It is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better adapt future newsletters to the interests of the recipients. If you do not want analysis by MailChimp, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message. The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://mailchimp.com/eu-us-data-transfer-statement/ and https://mailchimp.com/legal/data-processing-addendum/#Annex_C_-_Standard_Contractual_Clauses. After you unsubscribe from the newsletter distribution list, your email address may be stored by us or the newsletter service provider in a blacklist in order to prevent future mailings. The data from the blacklist is only used for this purpose and is not merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). The storage in the blacklist is not limited in time. You may object to the storage provided that your interests outweigh our legitimate interest. You can find out more about the use of cookies at MailChimp at https://mailchimp.com/legal/cookies, and you can read more detailed information about data protection at MailChimp (Privacy) at https://www.intuit.com/privacy/statement/.
  
  
• Klaviyo: This website uses the services of Klaviyo for sending newsletters. The provider is Klaviyo Inc., 225 Franklin St., Boston, Massachusetts 02110, USA. Klaviyo is a service with which, among other things, the sending of newsletters can be organised and analysed. If you enter data for the purpose of receiving the newsletter (e.g. email address), this data will be stored on Klaviyo's servers in the USA. The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Through these clauses, Klaviyo undertakes to comply with the European data protection level when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses, among other places, here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. The data processing agreement (Data Processing Agreement, which corresponds to the standard contractual clauses) can be found at: https://www.klaviyo.com/legal/dpa. With the help of Klaviyo, we can analyse our newsletter campaigns. When you open an email sent with Klaviyo, a file contained in the email (so-called web beacon) connects to Klaviyo's servers in the USA. This allows us to determine whether a newsletter message has been opened and which links may have been clicked. In addition, technical information is collected (e.g. time of retrieval, IP address, browser type and operating system). This information cannot be assigned to the respective newsletter recipient. It is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better adapt future newsletters to the interests of the recipients. If you do not want analysis by Klaviyo, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message. Furthermore, you can also unsubscribe from the newsletter directly on the website. The data processing is carried out on the basis of your consent (Art. 6(1)(a) GDPR). You may revoke this consent at any time by unsubscribing from the newsletter. The lawfulness of the data processing operations already carried out remains unaffected by the revocation. The data you have deposited with us for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted after the cancellation of the newsletter from both our servers and from Klaviyo's servers. Data that has been stored by us for other purposes (e.g. email addresses for the members' area) remains unaffected by this. For more detailed information about data protection at Klaviyo, please refer to Klaviyo's privacy policy at: https://www.klaviyo.com/legal/privacy/privacy-notice .

 

15. Which other third-party plugins and tools do we use?

We currently use the following additional third-party plugins and tools:

• Vimeo: Our website uses plugins from the video portal Vimeo. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA. When you visit one of our pages equipped with a Vimeo plugin, a connection to Vimeo's servers is established. This results in a data transfer. This data is collected, stored and processed on Vimeo's servers. Regardless of whether you have a Vimeo account or not, Vimeo collects data about you. This includes your IP address, technical information about your browser type, your operating system or very basic device information. Furthermore, Vimeo stores information about which website you use the Vimeo service on and which actions (web activities) you perform on our website. These web activities include, for example, session duration, bounce rate or which button you clicked on our website with an integrated Vimeo function. Vimeo can track and store these actions using cookies and similar technologies. If you are logged in as a registered member of Vimeo, more data can usually be collected, as more cookies may already have been set in your browser. In addition, your actions on our website are linked directly to your Vimeo account. To prevent this, you must log out of Vimeo whilst 'surfing' on our website. If you have consented to data about you being processed and stored by integrated Vimeo elements, this consent serves as the legal basis for the corresponding data processing (Art. 6(1)(a) GDPR). In principle, your data is also stored and processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in fast and effective communication with you or other customers and business partners. However, we only use the integrated Vimeo elements to the extent that you have given your consent. Vimeo also processes data about you in the USA, among other places. The data transfer to the USA is based on the standard contractual clauses of the European Commission. These clauses oblige Vimeo to comply with the EU data protection level when processing relevant data outside the EU as well. These clauses are based on an implementing decision of the European Commission. You can find the decision and the clauses here, among other places: https://ec.europa.eu/germany/news/20210604-datentransfers-eu_de. More information about the standard contractual clauses at Vimeo can be found at https://vimeo.com/privacy#international_data_transfers_and_certain_user_rights. You can find out more about the use of cookies at Vimeo at https://vimeo.com/cookie_policy. Further information on the handling of user data can be found in Vimeo's privacy policy at: https://vimeo.com/privacy.
  
  
• Google Fonts: On our website we use Google Fonts from Google Inc. For the European area, the company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible. We have integrated the Google fonts on Shopify web servers – not on Google's servers. As a result, there is no connection to Google servers and therefore no data transfer or storage. Previously, Google Fonts was also called Google Web Fonts. This is an interactive directory with over 800 fonts that Google provides free of charge. With Google Fonts, one could use fonts without uploading them to one's own server. However, in order to prevent any information transfer to Google servers in this regard, we have downloaded the fonts to our server. In this way, we act in accordance with data protection regulations and do not send any data to Google Fonts. Unlike other web fonts, Google allows us unrestricted access to all fonts. We can therefore access a sea of fonts without limit and thus get the optimum for our website. More about Google Fonts and other questions can be found at https://developers.google.com/fonts/faq?tid=311269125.
  
  
• Mapbox: On our website we use the map service Mapbox via an API from Mapbox Inc., 740 15th Street NW, 5th Floor, District of Columbia 20005, USA. Mapbox is an online map tool (open-source mapping) that is accessed via an interface (API). The use of Mapbox is in the interest of an attractive presentation of our online services and easy location of the places we indicate on the website. In order for Mapbox to fully provide its service, the company must collect and store data about you. This includes your IP address as well as browser information, your operating system, content of the request, limited location and usage data, the URL of the website visited and the date and time of the website visit. However, this data storage takes place on Mapbox's websites. We can only inform you about this, but cannot influence it. Since we have integrated Mapbox into our website, Mapbox sets at least one cookie (name: ppcbb-enable-content-mapbox_js) in your browser. This cookie stores data about your user behaviour. According to Mapbox, the data is only used to improve its own products. Mapbox also collects randomly generated IDs to analyse user behaviour and determine the number of active users. If you have consented to Mapbox being used, the legal basis for the corresponding data processing is this consent. According to Art. 6(1)(a) GDPR (consent), this consent represents the legal basis for the processing of personal data as may occur when collected by Mapbox. On our part, there is also a legitimate interest in using Mapbox to optimise our online service. The corresponding legal basis for this is Art. 6(1)(f) GDPR (legitimate interests). However, we only use Mapbox to the extent that you have given your consent. Mapbox also processes data in the USA, among other places. The data transfer to the USA is based on the standard contractual clauses of the European Commission. These clauses oblige Mapbox to comply with the EU data protection level when processing relevant data outside the EU as well. These clauses are based on an implementing decision of the European Commission. You can find the decision and the clauses here, among other places: https://ec.europa.eu/germany/news/20210604-datentransfers-eu_de. If you would like to find out more about Mapbox's data processing, we recommend that you consult Mapbox's privacy policy at  https://www.mapbox.com/legal/privacy/.

 

Reach and origin analysis (Peilt)

We use an analysis tool to understand the routes by which visitors arrive at our shop — for example via search engines, advertisements or referrals from other websites. In doing so, visits to our pages as well as technical information such as the referring page, browser and approximate region are transmitted to our service provider and evaluated there for us. We use the tool to make our offering and our advertising more targeted; the legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you grant in the cookie banner and can revoke at any time for the future.

Hotjar

To improve usability, we use Hotjar (Hotjar Ltd., Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta). Hotjar records in anonymised form how our pages are used — for example, which areas are clicked on and how far users scroll. This data helps us to identify where our shop is unclear or cumbersome. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR; without consent in the cookie banner, Hotjar will not be loaded.

TikTok Pixel

We use the TikTok Pixel from TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland). It shows us whether visitors have come to us via advertising on TikTok and helps us to deliver our advertising on TikTok more appropriately. In doing so, data such as IP address, device information and pages visited may be transmitted to TikTok, including to countries outside the EU and Switzerland. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. Without consent in the cookie banner, the pixel will not be loaded.

Trusted Shops

For the quality seal and customer reviews, we integrate Trusted Shops (Trusted Shops SE, Subbelrather Strasse 15c, 50823 Cologne, Germany). When our pages are accessed, the Trustbadge is loaded. In doing so, technical data such as the IP address is transmitted to Trusted Shops so that the seal and reviews can be displayed. After an order, if you have consented, we invite you by email to submit a review. For this purpose, we transmit your email address and order number to Trusted Shops. The legal basis is our legitimate interest in a trustworthy presentation of our shop pursuant to Art. 6(1)(f) GDPR; for the review invitation, your consent pursuant to Art. 6(1)(a) GDPR.

WhatsApp messages via the KEAZ app

We use the KEAZ app to send you automated WhatsApp messages in connection with your order. For this purpose, your name, telephone number and order number are transmitted to the operator of the KEAZ app, Pocket Agency GmbH (Kollwitzstrasse 76, 10435 Berlin, Deutschland). These data are required to enable communication via WhatsApp. If you provide your telephone number, you will automatically receive a message about your order status. The legal basis is the performance of the contract pursuant to Art. 6(1)(b) GDPR.

In addition, you can sign up to receive news and offers via WhatsApp. You will only receive such messages with your express consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time, for example by replying 'STOP'.

Messages are sent via the WhatsApp Business platform of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). Data may also be transferred to the USA; Meta is certified under the EU-US Data Privacy Framework for this purpose. Further information on data protection at KEAZ can be found at www.keaz.app.

16. What data is transmitted to payment providers?

The processing of personal data by a payment provider is carried out on the basis of Article 6(1)(b) GDPR for the purpose of contract processing and only to the extent necessary for this purpose, as well as within the framework of our legitimate interests pursuant to Art. 6(1)(f) GDPR, in order to be able to offer you reliable and secure payment processes. The responsibility for the data protection-compliant handling of the data collected and processed by the payment provider lies with the respective payment provider. We currently use the services of the following payment providers:

• PayPal: On our website, we offer payment via PayPal, among other options. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). If you select payment via PayPal, the payment data you enter will be transmitted to PayPal. The transmission of your data to PayPal is based on Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (processing for the performance of a contract). You have the option to revoke your consent to data processing at any time. A revocation does not affect the validity of data processing operations that took place in the past. PayPal may transfer, process and store personal data outside the EU and Switzerland (i.e. in particular also in the USA). The data transfer to these countries (i.e. in particular also to the USA) is based on the standard contractual clauses of the EU Commission. Through these clauses, PayPal undertakes to comply with the European data protection level when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. More information about the standard contractual clauses and about the data processed through the use of PayPal can be found in the privacy policy at https://www.paypal.com/webapps/mpp/ua/privacy-full.
  
  
• Shopify Payments: On our website, we offer payment via Shopify Payments, among other options. The provider of this payment service is Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter "Shopify"). If you select payment via Shopify Payments, the payment data you enter will be transmitted to Shopify. The transmission of your data to Shopify is based on Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (processing for the performance of a contract). The disclosure of your data is carried out exclusively for the purpose of payment processing with Shopify and only to the extent that it is necessary for this purpose. You have the option to revoke your consent to data processing at any time. A revocation does not affect the validity of data processing operations that took place in the past. Shopify may transfer, process and store personal data outside the EU and Switzerland (i.e. in particular also in Canada and in the USA). When transferring to Canada, your personal data is protected by Canadian law. The European Commission has determined that this ensures adequate protection of your data. If your personal data is then sent by Shopify to a country outside Canada, this data is protected by contractual obligations comparable to those in standard contractual clauses (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en). More information about this and about the data processed through the use of Shopify Payments can be found in Shopify's privacy policy at https://www.shopify.com/de/legal/datenschutz.
  
  
• Stripe: On our website, we offer payment via Stripe and the associated payment methods, among other options. The provider of these payment services is Stripe Payments Europe Ltd, Block 4, Harcourt Centre, Harcourt Road, Dublin 2. If you select payment via Stripe, the payment data you enter will be transmitted to Stripe. The transmission of your data to Stripe is based on Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (processing for the performance of a contract). You have the option to revoke your consent to data processing at any time. A revocation does not affect the validity of data processing operations that took place in the past. All data required for payment processing is used exclusively for carrying out payments and is transmitted via the "SSL" procedure. Stripe is PCI DSS certified. Stripe may transfer, process and store personal data outside the EU and Switzerland (i.e. in particular also in the USA). The data transfer to these countries (i.e. in particular also to the USA) is based on the standard contractual clauses of the EU Commission. Through these clauses, Stripe undertakes to comply with the European data protection level when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. More information about the standard contractual clauses and about the data processed through the use of Stripe can be found in the privacy policy at https://stripe.com/at/privacy.
  
  
• Klarna: On our website, we offer payment with Klarna's services, among other options. The provider is Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden. Klarna offers various payment options (e.g. instalment purchases). If you choose to pay with Klarna (Klarna checkout solution), Klarna will collect various personal data from you. Details about this can be found in Klarna's privacy policy at the following link: https://www.klarna.com/de/datenschutz/. Klarna uses cookies to optimise the use of the Klarna checkout solution. The optimisation of the checkout solution represents a legitimate interest within the meaning of Art. 6(1)(f) GDPR. Cookies are small text files that are stored on your device and do not cause any damage. They remain on your device until you delete them. Details on the use of Klarna cookies can be found at the following link: https://cdn.klarna.com/1.0/shared/content/policy/cookie/de_de/checkout.pdf. The transmission of your data to Klarna is based on Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (processing for the performance of a contract). You have the option to revoke your consent to data processing at any time. A revocation does not affect the validity of data processing operations that took place in the past.
  
  
• TWINT: On our website, we offer payment via TWINT and the associated payment methods, among other options. The provider of these payment services is TWINT AG
  Stauffacherstrasse 41, CH-8004 Zürich. If you select payment via TWINT, the payment data you enter will be transmitted to TWINT. The transmission of your data to TWINT is based on Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (processing for the performance of a contract). You have the option to revoke your consent to data processing at any time. A revocation does not affect the validity of data processing operations that took place in the past. Information on the type, scope and purpose of data processing can be found on the page about data protection for TWINT apps (https://www.twint.ch/datenschutz-app/). Further information can be found in the imprint of TWINT AG (https://www.twint.ch/impressum/), in the privacy policy for the TWINT website (https://www.twint.ch/datenschutz-website/) and in the General Terms and Conditions (GTC) for the use of TWINT (https://www.twint.ch/agb-app/).

 

17. Can this privacy policy be amended?

This privacy policy does not form part of any contract with you. We may amend this privacy policy at any time. The version published on this website is the current version in each case.

18. Vision AI System ai-yelasai.com

In addition to the above provisions, we operate a premium vision AI system for hair growth specialists at ai-yelasai.com (hereinafter "Salon Partners"). The following provisions apply additionally to processing in the AI system.

18.1 Responsibility
In the AI system, YELASAI GmbH acts as a processor on behalf of the respective Salon Partner (Art. 28 GDPR; Art. 9 revFADP). The Salon Partner is the controller for the processing of end customer data in relation to their end customers.

18.2 What data is processed?
End customer master data: name, date of birth, address, contact details
Anamnesis data: complaint markers, pre-existing condition notes, pregnancy and medication notes
Scalp and hair images (micro-camera, mobile phone image) - special categories of personal data pursuant to Art. 9 GDPR and Art. 5(c) revFADP (health data)
Care plans and treatment history
Chat histories between Salon Partner and end customers, if this function has been activated

18.3 Legal basis
Art. 6(1)(b) GDPR (performance of contract) for the use of the hairdressing service by the Salon Partner

Art. 9(2)(a) GDPR (explicit consent) for the processing of health data (scalp images, anamnesis)
The consent of end customers is obtained by the Salon Partner and documented in the YELASAI system. The Salon Partner has contractually undertaken to obtain this consent from each end customer BEFORE the first image is taken.

18.4 Server hosting and data location
The AI system ai-yelasai.com is hosted by:
Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Deutschland - Server location: Falkenstein (Saxony, Germany).

All system data remains within the European Union. Hetzner is certified to ISO/IEC 27001. A data processing agreement exists with Hetzner pursuant to Art. 28 GDPR.

18.5 AI processing and sub-processors
For AI-supported diagnostic analyses, care plan generation and chat response suggestions, we use the AI models of Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA.

Legal basis for third country transfer: Anthropic is certified under the EU-US Data Privacy Framework (DPF) and its Swiss extension (Swiss-US DPF). The data transfer to the USA is based primarily on this. In addition, EU Standard Contractual Clauses (SCC) pursuant to Commission Implementing Decision (EU) 2021/914 exist as a fallback level.
No AI training: Anthropic does NOT use API inputs and outputs for training or improving its own AI models according to its Commercial Terms of Service. A Data Processing Addendum (DPA) exists between YELASAI and Anthropic.
Processed data: Image data of the scalp and textual diagnostic information. Directly identifying clear names are replaced by pseudonymous IDs before transmission. Note: Image data may make the data subject identifiable; complete anonymisation of the image material is therefore not possible.

Retention at Anthropic: Anthropic stores API inputs and outputs exclusively for security and abuse detection purposes for a short period (currently 7 days); automatic deletion follows thereafter.
Permanent storage in Anthropic systems does not take place.

18.5a Commands and voice input:
Salon Partners can operate the AI system with short commands (e.g. "Open the gallery of...") and dictate notes, typed or spoken. Voice recordings (commands, fault reports and dictated notes) are converted into text exclusively on our own server at Hetzner; the recording is then immediately deleted and not transmitted to anyone. To recognise the desired action, a command is subsequently transmitted as text to Anthropic; customer names are replaced by placeholders wherever possible beforehand, new customers are recorded directly in the app without AI. Commands and notes can always be typed as well.

18.6 Profiling and automated decisions in the AI system
The AI generates care plan suggestions and chat response suggestions based on the collected data. These suggestions represent **professional recommendations** and are exclusively reviewed, adapted and approved by the Salon Partner. A **fully automated decision within the meaning of Art. 22 GDPR** does not take place - the Salon Partner always makes the final decision on treatment and recommendations.

18.7 Retention periods in the AI system

Data category Retention period

End customer master data During active salon relationship

Images, analyses, care plans During active salon relationship

Archived end customer data Until deliberate deletion by Salon Partner

Chat histories During active salon relationship

Audit logs (anonymised) Up to 3 years

Final deletion after contract termination Within 30 days

The Salon Partner decides independently on the archiving and final deletion of end customer data. YELASAI does not carry out automatic deletion.

18.8 Rights of end customers vis-à-vis the Salon Partner
End customers of the Salon Partner have the rights described in Section 11 (access, rectification, erasure, restriction, data portability, objection, complaint).
The respective Salon Partner is primarily responsible for enquiries (controller within the meaning of the GDPR). YELASAI supports the Salon Partner in implementing these rights technically through:
Data export as ZIP archive
Archiving (soft delete)
Final deletion (hard delete)
Enquiries directed to YELASAI directly are forwarded to the supervising Salon Partner.

18.9 Security measures in the AI system
YELASAI implements technical and organisational measures in accordance with the state of the art:
Encryption in transit: TLS 1.2/1.3 for all connections
Encryption at rest: encrypted filesystem on server
Authentication: passwords hashed with bcrypt, CSRF protection, brute-force limitation
Role-based access control: Admin, Coach, Hairdresser, End Customer
GDPR audit logging of sensitive data access
Backup strategy: daily backups, 30-day retention, weekly off-site backup
Sub-processor selection: documented review, DPA contracts, DPF/SCC for third country transfer.
The complete list of technical and organisational measures (TOMs) is part of the data processing agreement (DPA) and is made available to Salon Partners upon request.

18.10 Data processing agreement (DPA)
A **data processing agreement pursuant to Art. 28 GDPR** is concluded with each Salon Partner. This contains in particular:
Register of sub-processors (Hetzner, Anthropic, Microsoft, OpenAI)
Technical and organisational measures (TOMs)
Notification obligations in the event of data breaches
Obligations to obtain end customer consent
Third country transfer safeguards
The complete DPA is available for inspection upon request.

18.11 AI chat assistant ("YELASAI AI Assistant")

On our website we offer an AI-supported chat assistant that answers questions about our products and their application. Use is voluntary.

What data we process

• Your messages entered into the chat and the assistant's responses
• the application recommendations generated in the conversation
• voluntarily provided email address, if you save your recommendations and have a retrieval link sent to you
• technical data for abuse prevention and stability (a shortened/encrypted identifier of your IP address, browser information, timestamp)

Purpose Answering your product and application questions, creating and storing your personal application recommendations, and ensuring technically stable and abuse-free operation.

Legal basis Processing is carried out for the performance of pre-contractual or contractual measures and to answer your enquiry (Art. 6(1)(b) GDPR) and on the basis of our legitimate interest in a secure, functional service (Art. 6(1)(f) GDPR). If you voluntarily provide your email address, the retrieval link is sent on the basis of your consent (Art. 6(1)(a) GDPR), which you can revoke at any time.

No health or medical advice The assistant provides exclusively general product and application information and does not replace medical or healthcare advice. Please do not enter any health data or special categories of personal data (Art. 9 GDPR) in the chat.

Photo upload (optional) You can voluntarily upload a photo of your scalp/hair in the chat to receive an initial, general assessment and suitable care advice. The photo is processed exclusively for this one evaluation and is not stored by YELASAI (neither on our servers nor in the chat database nor in logs). For evaluation purposes, it is transmitted once to our AI service provider (Anthropic) and is not permanently stored there. The assessment from a photo is only a first impression and does not replace a personal scalp analysis by a hair growth specialist or medical assessment. The legal basis is your consent through voluntary uploading (Art. 6(1)(a) GDPR).

Question to our team (optional) You can use the "Question to YELASAI" function to send a question – for example about your order or delivery – together with your email address to our service team (info@yelasai.com). For better context, the previous chat history is sent along. We use this information exclusively to answer your enquiry. The assistant itself has no access to order or delivery data and does not show you any shipment status. The legal basis is the response to your enquiry (Art. 6(1)(b) or (f) GDPR).

Storage period Chat histories and saved recommendations are automatically and completely deleted after 12 months without further activity. Uploaded photos are not stored at all (see "Photo Upload"). You can also remove your conversation yourself at any time using the "Delete conversation" function in the chat.

Processors / Recipients For operation, we use the following service providers with whom corresponding data processing agreements exist:

• Anthropic (AI language processing of chat requests)
• Hetzner Online GmbH (server hosting in Germany/Finland)
• Microsoft 365 (sending of email with retrieval link)

Your rights You have the right to access, rectification, erasure, restriction of processing as well as to data portability and objection. For deletion, the "Delete conversation" function in the chat is sufficient; beyond that, you can reach us using the contact details provided in this privacy policy.

18.12 Contact for AI system-specific questions
YELASAI GmbH
Hinterbissaustrasse 64 A
9410 Heiden, Schweiz
Email: info@yelasai.com

Competent supervisory authorities:
Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern

Germany: competent state data protection authority at the registered office of the salon partner
Austria: Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna

Note: In the event of contradictions between the general provisions of this privacy policy and the more specific provisions of this Section 18, the more specific provisions for processing in the Vision AI system ai-yelasai.com shall take precedence.

Last updated: 10.08.2026