1) Information on the collection of personal data and contact details of the controller
1.1 In the following, we inform you about the handling of your personal data. Personal data is any data with which you can be personally identified.
Please carefully check which personal data you share with us via Instagram. Instagram is part of the Meta group of companies and shares its infrastructure, systems and technology with Meta and other Meta companies (https://www.facebook.com/help/111814505650678?ref=dp). We expressly point out that Meta stores the data of users of its services (e.g. personal information, IP address, etc.) and may also use it for business purposes. Further information on Meta's data processing on Instagram can be found in Instagram's privacy policy at https://help.instagram.com/help/instagram/519522125107875/.
We have no influence on the data collection and further processing by Meta. Furthermore, we cannot ascertain the extent to which, where, and for how long the data is stored, to what extent Meta complies with existing deletion obligations, what evaluations and links are made with the data, and to whom the data is passed on. If you wish to prevent Meta from processing personal data transmitted by you to us, please contact us by other means. Our full contact details can be found in our imprint on Instagram.
1.2 The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is MALU WILZ Beauté GmbH, Gaußstr. 13, 85757 Karlsfeld, Germany, Tel.: +49 (0)8131/390-02, E-Mail: shop@malu-wilz-beaute.com, insofar as we process the data transmitted to us by you via Instagram exclusively ourselves. Insofar as the data transmitted to us by you via Instagram is also or exclusively processed by Meta, Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland, is also responsible for the data processing within the meaning of the General Data Protection Regulation (GDPR) in addition to us.
The controller for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
2) Data Protection Officer
You can reach our data protection officer as follows: "Dr. Sebastian Kraska, External Data Protection Officer, IITR Datenschutz GmbH, Marienplatz 2, 80331 Munich, Telephone: 08131 - 390 560, marketing@malu-wilz-beaute.vom"
You can contact Meta's data protection officer via the online contact form provided at https://www.facebook.com/help/contact/540977946302970.
3) Data processing when making contact
We ourselves collect personal data when you, for example, contact us via a contact form or messenger. Which data we collect when you contact us via a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of answering your request or for contacting you and the associated technical administration. The legal basis for the processing of the data is our legitimate interest in answering your request in accordance with Art. 6 para. 1 lit. f GDPR. If your contact aims at the conclusion of a contract, an additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted after final processing of your request, provided that there are no legal retention obligations to the contrary. We assume that processing is complete if it can be inferred from the circumstances that the matter concerned has been conclusively clarified.
4) Data processing for direct marketing
Advertising by post
Based on our legitimate interest in personalized direct marketing, we reserve the right to store your first and last name, your postal address and - if we have received this additional information from you within the framework of the contractual relationship - your title, academic degree, year of birth and your professional, industry or business designation in accordance with Art. 6 para. 1 lit. f GDPR and to use it for sending interesting offers and information about our products by post.
You can object to the storage and use of your data for this purpose at any time by sending a corresponding message to the controller.
5) Data processing for statistical and marketing purposes
Facebook Lead Ads
We use the "Lead Ads" function of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Facebook"), to collect and process certain personal data of interested parties – so-called leads – via a contact form (so-called "Instant Form") displayed on Facebook websites. The content and scope of the data requested in this form depend on the orientation of the respective lead campaign.
The processing of data is strictly tied to the purposes pursued with the respective Lead Ad campaign. These purposes are clearly named within the Lead Ad or on the provided form before the specified data is transmitted. Depending on the orientation of the Lead Ad campaign, the legal basis for data processing is either your express consent in accordance with Art. 6 para. 1 lit. a GDPR (e.g. for direct marketing measures such as registration for email newsletter dispatch) or our legitimate interest in optimal marketing of our offer in accordance with Art. 6 para. 1 lit. f GDPR. Data will not be passed on to third parties.
As part of the aforementioned services, data transmitted via instant forms can be stored on servers of Meta Platforms, Inc., 1601 Willow Rd, Menlo Park, CA 94025, USA.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
Further information on data processing via Facebook Lead Ads can be found in Facebook's data policy at https://de-de.facebook.com/privacy/explanation.
6) Rights of the data subject
6.1 The applicable data protection law grants you comprehensive data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below:
- Right of access according to Art. 15 GDPR;
- Right to rectification according to Art. 16 GDPR;
- Right to erasure according to Art. 17 GDPR;
- Right to restriction of processing according to Art. 18 GDPR;
- Right to notification according to Art. 19 GDPR;
- Right to data portability according to Art. 20 GDPR;
- Right to withdraw consent given according to Art. 7 para. 3 GDPR;
- Right to lodge a complaint according to Art. 77 GDPR.
6.2 RIGHT TO OBJECT
IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST WITHIN THE FRAMEWORK OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ASSERTION, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
7) Duration of storage of personal data
The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing and – if applicable – additionally by the respective statutory retention period (e.g. commercial and tax law retention periods).
When personal data is processed on the basis of an explicit consent pursuant to Art. 6 para. 1 lit. a GDPR, the data concerned will be stored until you withdraw your consent.
If there are statutory retention periods for data that are processed within the framework of legal or quasi-legal obligations on the basis of Art. 6 para. 1 lit. b GDPR, these data will be routinely deleted after the expiry of the retention periods, provided that they are no longer required for the fulfillment or initiation of a contract and/or we no longer have a legitimate interest in further storage.
When personal data is processed on the basis of Art. 6 para. 1 lit. f GDPR, this data will be stored until you exercise your right to object pursuant to Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.
When personal data is processed for the purpose of direct marketing on the basis of Art. 6 para. 1 lit. f GDPR, this data will be stored until you exercise your right to object pursuant to Art. 21 para. 2 GDPR.
Unless otherwise stated in the other information in this declaration on specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.
Copyright notice: This privacy policy was created by the specialist lawyers of IT-Recht Kanzlei and is protected by copyright (https://www.it-recht-kanzlei.de)
Status: 19.05.2026, 13:13:46
