Privacy Policy

This is a translation for convenience. In case of doubt, the German version prevails.

1. Controller

The controller responsible for processing personal data on this website and in our business operations is:

DermaPurge AG
Hohe Straße 6
01069 Dresden
Germany

Represented by the Management Board (Vorstand): Felix Klee
E-mail: info@dermapurge.com
Phone: +49 351 4658 1322
Commercial register: Local Court (Amtsgericht) Dresden, HRB 48667

For all data protection questions, please contact us at info@dermapurge.com. We have not appointed a data protection officer, as the legal requirements for doing so (Section 38 BDSG) are not met.

2. Legal bases and recipients at a glance

We process personal data only where one of the following legal bases under the General Data Protection Regulation (GDPR) applies:

  • Consent (Art. 6(1)(a) GDPR), e.g. for non-essential cookies and statistics. You can withdraw your consent at any time with effect for the future.
  • Contract and pre-contractual measures (Art. 6(1)(b) GDPR), e.g. for handling enquiries and orders.
  • Legal obligation (Art. 6(1)(c) GDPR), e.g. for retention obligations under tax and commercial law.
  • Legitimate interests (Art. 6(1)(f) GDPR), e.g. for the secure operation of this website and communication with business contacts.

Access to information on your device (e.g. cookies) is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

We only share data where this is necessary for the purposes stated. Recipients are in particular our IT and hosting providers, our fulfilment partner, shipping providers and our tax advisors. Service providers who process data on our behalf are contractually bound under Art. 28 GDPR. Where data is transferred to a country outside the EU or EEA, this only takes place on the basis of an adequacy decision of the European Commission (e.g. the EU-US Data Privacy Framework) or the EU Standard Contractual Clauses.

3. Hosting and server log files

This website is hosted by checkdomain GmbH, Große Burgstraße 27/29, 23552 Lübeck, Germany. A data processing agreement under Art. 28 GDPR is in place with checkdomain; processing takes place in the EU/EEA.

When you visit the website, information transmitted by your browser is automatically recorded in server log files:

  • IP address
  • date and time of access
  • page or file requested and amount of data transferred
  • browser type and version, operating system
  • referrer URL (previously visited page)

This processing is necessary to deliver the website and to ensure its security and stability, e.g. to fend off attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The log files are deleted in accordance with the host’s retention periods, unless they are needed longer to investigate a security incident.

The website is encrypted via TLS (HTTPS).

4. Cookies and consent management

Cookies are small text files stored on your device. We distinguish between:

  • Strictly necessary cookies: These are required to operate the website, e.g. to store your language setting or your cookie choice. The legal basis is Section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.
  • Non-essential cookies and services (e.g. statistics with Google Analytics): We only use these if you have given your prior consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

To manage your consent, we use the WordPress plugin CookieYes. It displays a cookie banner on your first visit and stores your choice in a cookie on your device so that it is taken into account on subsequent visits. You can change your settings or withdraw your consent at any time via the “Cookie-Einstellungen” (cookie settings) button on this website.

In the banner you can choose “Alle akzeptieren” (accept all), “Alle ablehnen” (reject all) or make individual choices via “Cookie-Einstellungen”. There are two categories: “Notwendig” (necessary, always active) and “Statistik” (statistics: Google Analytics, see section 8). The “Statistik” category is disabled by default.

You can also delete or block cookies in your browser at any time. In that case, some functions of the website may be limited.

5. Contact form and e-mail

If you contact us via the contact form, by e-mail or by phone, we process the information you provide (e.g. name, company, e-mail address, phone number, content of your message) in order to handle your enquiry and any follow-up questions.

The contact form is operated with the WordPress plugin WPForms. Your entries are processed on our web server and forwarded to us by e-mail; sending is done via our own mail server using the plugin WP Mail SMTP. Our mailboxes are also operated by checkdomain GmbH (see section 3).

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or its initiation, and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).

We delete your enquiry once it has been fully dealt with and no statutory retention obligations apply. Business letters and e-mails relating to a contract are retained for up to 6 or 8 years in accordance with commercial and tax law.

6. Customers, distributors and order processing

We process the data of our customers, distributors, suppliers and other business partners and their contact persons in order to handle enquiries, quotations, orders, deliveries and invoices. This includes in particular name, company, position, contact and delivery addresses, order and contract data, and payment and invoice data.

The legal basis is the performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR) and, for contact persons at companies, our legitimate interest in the business relationship (Art. 6(1)(f) GDPR).

For order processing we use the following recipients:

  • Billbee GmbH, Arolser Straße 10, 34477 Twistetal, Germany – software for order processing and invoicing (processor under Art. 28 GDPR).
  • SERVIND ITALY s.r.l., Via Palmarina 62/1, 33048 San Giovanni al Natisone (UD), Italy – manufacturing and direct shipment of orders; receives the recipient’s name, delivery address and contact details for this purpose (processor under Art. 28 GDPR).
  • Shipping providers and freight forwarders – receive name, delivery address and, where applicable, phone number or e-mail address for delivery and shipment tracking; they act as independent controllers.
  • Tax advisors (impuls.blau GmbH, Dresden) – receive invoice and accounting data to fulfil tax obligations; they act as independent controllers (Section 11(2) StBerG).

If you buy our products via Amazon, Amazon is itself responsible for processing your data on its platform. We only receive from Amazon the data needed for delivery and invoicing.

We store contract data until the statutory retention periods have expired (6 years for business correspondence, 8 years for accounting vouchers and 10 years for books and annual financial statements under Section 257 HGB and Section 147 AO) and delete it thereafter.

7. Embedded content: YouTube, distributor map, fonts

YouTube videos

On some pages we embed our own videos via YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open the page, we initially only show a preview image hosted on our own server; no data is transmitted to YouTube. Only when you click on the preview image is the video loaded from YouTube. Data such as your IP address, the page visited and, if applicable, your Google account is then transmitted to Google. We use YouTube’s privacy-enhanced mode (youtube-nocookie.com). The legal basis is your request for the video triggered by your click (Section 25(2) no. 2 TDDDG) and our legitimate interest in presenting our product videos (Art. 6(1)(f) GDPR).

Distributor map (link to Google My Maps)

On the “Distributors” page and on individual product pages, we link to a map of our distribution partners on Google My Maps. The map is not embedded in our website. Data is only transmitted to Google when you click the link and open the map on Google’s site; Google’s privacy policy applies there.

For YouTube: Google may also transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Further information: Google Privacy Policy.

Fonts

We use the font “Nunito”. It is hosted locally on our server; no connection to Google servers is established when you visit the website.

8. Web analytics with Google Analytics

With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics analyses how visitors use our website, e.g. pages viewed, time spent, source of the visit, and device and browser information. Cookies are set for this purpose. We use the analyses to improve our website.

Google Analytics 4 does not store IP addresses. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Google processes the data on our behalf on the basis of Google’s data processing terms.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google Analytics is only loaded if you choose “Alle akzeptieren” (accept all) in the cookie banner or enable the “Statistik” category in the cookie settings. You can withdraw your consent at any time via the “Cookie-Einstellungen” button. The data is deleted after 14 months.

9. Social media

We maintain company profiles on Instagram and LinkedIn to provide information about our products and to interact with users. On our website we only link to these profiles; no data is transmitted to the networks when you visit our website. Only when you click a link are you taken to the respective provider’s platform.

  • Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland – Privacy Policy
  • LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland – Privacy Policy

When you visit our profiles, the providers process your data in accordance with their own privacy policies, including for advertising and market research purposes; data may be transferred to the USA. For the statistics on our profiles (Insights), we are joint controllers with the respective provider (Art. 26 GDPR); the providers have published agreements on this and assume primary responsibility for data subject rights. The legal basis for our presence is our legitimate interest in modern corporate communication (Art. 6(1)(f) GDPR). You can exercise your rights most effectively directly with the respective provider, but you may also contact us.

10. Storage period, your rights and right to lodge a complaint

Storage period

We store personal data only as long as necessary for the respective purpose or as required by statutory retention periods. The data is then deleted. Data that we retain solely due to legal obligations is restricted from use for other purposes.

Your rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR)

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, an informal message to info@dermapurge.com is sufficient.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner)
Postfach 11 01 32
01330 Dresden, Germany
E-mail: post@sdtb.sachsen.de
Website: www.datenschutz.sachsen.de

No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Status

This privacy policy was last updated in November 2026. We will update it if our data processing or the legal situation changes.