MSE · THE BEAUTY COMPANY

Privacy policy

Information on the processing of your personal data in the MSE-Shop.

Last updated: 06.10.2026

1. Data controller and contact

MSE The Beauty Company GmbH
Goosmoortwiete 21a
25474 Bönningstedt
Germany

by email: info@mse-beauty.com
Telephone: 040 33465110

This privacy statement describes the processing of personal data when visiting mse-beauty.com, shopping, using customer features and communicating with us.

2. Data and purposes of processing

We process the data that is necessary for the respective process. This includes in particular name, billing and delivery address, e-mail address, if applicable, telephone number, order details, payment and shipping status as well as the content of your requests. When using the store, IP addresses, browser and device information, pages visited and technical access data can also be processed.

The data is used in particular for the processing of orders, the processing of payments and deliveries, the management of customer accounts, the processing of returns and cancellations, the customer support and the safe operation of the store. Data for advertising and consent-required usage analysis are processed on a separate legal basis.

The information necessary for a contract is marked in the ordering process. Without this information, we may not be able to execute an order. You can leave out voluntary information.

3. Legal bases

Contract and pre-contractual measures: Art. 6 (1) letter b GDPR, in particular for orders, payments, deliveries and contract-related requests.

Legal obligations : Art. 6 (1) letter c GDPR, in particular for tax and commercial retention and the fulfillment of statutory consumer rights.

The legitimate interests: Art. 6 (1) letter f GDPR, in particular for IT security, anti-abuse, the processing of general requests and the assertion or defense of legal claims. Your conflicting interests and rights are taken into account.

and consent: Art. 6(1)(a) GDPR, in particular for advertising and analysis that require consent. Section 25(1) TDDDG also applies to storage of or access to information on your device that requires consent. Storage or access that is strictly necessary may fall under the exception in section 25(2) TDDDG.

4. Shopify and technical provision

Our online store is provided through Shopify. Shopify processes data that is necessary for the technical provision of the store, for checkout, order management and security. This may include in particular contact, order, device and access data. The legal basis is Art. 6 (1) letter b or f GDPR; the processing required by law is carried out according to Art. 6 (1) letter c GDPR.

Shopify is used as a service provider in the provision of the store. For certain own services, such as the use of Shop or Shop Pay, Shopify may process data in addition under its own responsibility. Information about this you will find in the Privacy Statement of Shopify and under Shopify Cookies.

5. Cookies and consent management

Cookies and similar storage technologies may store, for example, your shopping cart, login status or chosen settings. Under section 25(2) TDDDG, storage and access that are strictly necessary for the service you have expressly requested do not require consent. Other storage and access generally require prior consent.

For the management of cookie decisions, Pandectes is included in the store. Your choices, the time of the decision and technical identifications can be processed to store and prove decisions. The storage of a selection required for this purpose serves to administer your data protection settings; the processing of personal evidence is based on Art. 6 (1) (c) GDPR, insofar as legal proof is required, or otherwise on Art. 6 (1) (f) GDPR with the interest of an understandable consent management.

You can change or revoke consent for the future through the cookie settings of the store. Simply closing a banner or another visit to the site does not constitute consent. In addition, you can remove stored cookies through the settings of your browser.

6. Payment service providers and Klarna

When choosing a payment method, the data required for processing will be transmitted to the respective payment service provider. This includes, depending on the payment method, name, invoice address, contact, order and payment information. The transmission for payment processing is based on Art. 6 (1) letter b GDPR. Further processing required by law may be based on Art. 6 (1) letter c GDPR.

Klarna: In the case of a Klarna payment, Klarna Bank AB (publ.), Sveavägen 46, 111 34 Stockholm, Sweden, receives the necessary data for the processing of the payment. Klarna processes data in accordance with its own data protection policies and may carry out identity, fraud risk and credit checks, including automated decision-making, depending on the payment option. Information on the data, legal bases, audits and your rights can be found at Data protection of Klarna.

For other payment services offered at checkout, in particular PayPal, Shopify Payments, Shop Pay, Apple Pay or Google Pay, the respective provider’s information also applies. Payment details entered directly with a provider are processed according to that provider’s procedures.

7. Shipping and order processing

To execute your order, we will pass on the necessary delivery data to the shipping company used for the order, such as DHL or UPS. This applies in particular to name and delivery address as well as necessary shipping information. The legal basis is Art. 6 (1) letter b GDPR. Contact details for additional shipment notifications will only be transmitted on a suitable legal basis.

We use our OpenXE enterprise resource planning system and connected in-house systems to process orders, shipments and invoices internally. In particular, order, contact, invoice and shipping data are processed. The legal bases are performance of the contract and compliance with statutory documentation and retention obligations.

8. Contact, WhatsApp and withdrawal

If you contact us by email, phone, contact form or WhatsApp, we process your contact information and the content of your request to respond to you. For contract-related requests, Art. 6 (1) letter b GDPR applies; for general requests, Art. 6 (1) letter f GDPR with the interest in the processing of your request.

The use of WhatsApp is voluntary. When using the service, WhatsApp processes communication and technical data in accordance with its own data protection terms. Alternatively, you can contact us by email or phone. Please do not send any sensitive information via WhatsApp that is not necessary for your request.

In the case of a notice of withdrawal, we process the information necessary for the assignment and processing, in particular name, contact address, details on the order concerned, content of the statement as well as date and time of receipt. This serves to process the cancellation and necessary confirmations of entry. The legal basis is Art. 6 (1) letter b and c GDPR.

9. Newsletter and Klaviyo

Klaviyo is included as an email marketing service and corresponding shop features. For a newsletter, in particular, your e-mail address, if necessary your name and proof of registration will be processed. The sending of consent-based advertising is carried out in accordance with Art. 6 (1) letter a GDPR. You can revoke your consent at any time for the future via the opt-out link or by sending a message to us.

Insofar as openings, clicks or personal-related usage behavior are processed for analysis or personalization, a separate consent required for this is relevant. An subscription to the newsletter alone does not replace the required tracking consent. Information on processing by Klaviyo can be found in Klaviyo Privacy Center.

Necessary messages about orders, payments, deliveries or cancellations are intended for the execution of the contract or legal obligations and are independent of a newsletter subscription.

10. Wish lists and reviews

List of wishes: We use Swym for wish lists in the shop. When you use this function, selected products, technical identifiers and, if you sign in or request a notification, associated contact details may be processed. Processing to provide the requested function is based on Art. 6(1)(b) GDPR. Further analysis or advertising requires a separate legal basis; device access that requires consent is subject to that consent.

The evaluations: For product evaluations we use our own TraceAmp system. The order and products concerned, the evaluation, voluntary texts or images, the displayed name and technical data may be processed. The assignment to the order enables in particular the labeling of verified purchases. The evaluation content intended for publication is displayed publicly; contact and complete order details are not included in the public evaluation.

The provision of an evaluation submitted by you is based on Art. 6 (1) letter b GDPR. The prevention of manipulated reviews and multiple voting may be based on Art. 6 (1) letter f GDPR with the interest of reliable evaluations. Consent-needed storage accesses and advertising evaluation requires the respective necessary consent.

11. Advertising, analytics and social networks

We advertise our shop through Google and Meta. If corresponding analytics or advertising technologies are used in the shop, device identifiers, IP addresses, page views, interactions and purchase events may be processed and transmitted to the respective provider. Personal profiles and tracking operations requiring consent require prior consent; a general reliance on legitimate interests does not replace it.

For these consent-based transactions, Art. 6 (1) letter a GDPR and for corresponding terminal accesses additionally § 25 (1) TDDDG applies. Provider information you can find below Google Data Protection and Meta Data Protection.

Simprosys is included to connect the product feed. A product feed contains product data; it is distinguished from the processing of personal visits or purchase events. If additional tracking functions are used, the respective necessary consent shall apply.

Our store contains links to social networks and other external websites. If you open these links, the data protection notice of the respective provider applies there.

12. Recipients and transfers to third countries

Recipients may include, to the extent necessary, technical service providers, payment and shipping companies, providers of the shop functions you use and bodies to which we must disclose data to comply with a legal obligation. Service providers acting solely on our behalf are engaged under the required data processing agreements.

For international suppliers, processing may take place outside the EU or EEA. Such transmission requires the conditions of Article 44 ff. GDPR, for example, a relevant adequacy decision or appropriate safeguards such as EU standard contractual clauses. The mechanisms used for the respective service must be taken into account in its data protection and contract information. You can request further information via the above contact address.

13. Retention periods and security

We retain personal data only for as long as necessary for the stated purposes. Once the purpose no longer applies, data is deleted or anonymised unless statutory retention duties or retention necessary to establish or defend legal claims prevent this. The applicable tax and commercial retention periods apply to invoices and business documents.

Consent and objection evidence may be retained to fulfill the obligation of proof or to comply with your decision. Data from optional services are additionally guided by the deletion periods relevant for the respective service.

We take appropriate technical and organizational measures to protect personal data. Please only provide the information that is necessary for your request.

14. Your rights

You have the right to information (Art. 15 GDPR), rectification (Art. 16), deletion (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can revoke a given consent at any time for the future. The legality of the processing until the revocation remains unaffected.

contradiction is : You may object to processing based on Art. 6(1)(e) or (f) GDPR on grounds relating to your particular situation. You may object at any time to processing for direct marketing purposes; this also applies to related profiling (Art. 21 GDPR).

Where a decision is based solely on automated processing and produces legal or similarly significant effects, the safeguards in Art. 22 GDPR apply. For checks carried out by a payment service provider acting as an independent controller, further information is available in that provider’s privacy notice.

To exercise your rights, please contact info@mse-beauty.com . We may need appropriate confirmation of your identity to avoid disclosing data to unauthorised persons.

15. Right to complain and changes

You have the right to complain to a data protection supervisory authority. For companies with headquarters in Schleswig-Holstein, the Independent Land Centre for Data Protection Schleswig-Holstein (ULD) is responsible. Information and complaints are available under Report to the ULDby . You can also contact another competent supervisory authority.

We will adjust this data protection statement as our processing or legal requirements change.