Data Controller
Pursuant to Article 4(7) of the General Data Protection Regulation (GDPR), the data controller is:
Brand: Skinpoemstudio
Email: staff@skinpoemstudio.com
Website: www.skinpoemstudio.com
Personal Data We Collect
We process the personal data you provide when you place an order, contact us, or otherwise interact with our website. This includes:
Name and contact details (mailing address, email address, phone number)
Order details and transaction records
Payment-related information required to process transactions
Correspondence or communications sent to us
When you visit our website, we also automatically process certain technical data, such as your IP address, browser type, and the pages visited. Such processing is essential for the operation and security of the website.
Purposes of Processing and Legal Basis
We process your personal data for the following purposes:
Performance of a contract: To process and fulfill your orders, including payment processing and order-related communication (Article 6(1)(b) GDPR).
Legal obligations: To comply with record-keeping and archiving obligations under German commercial and tax laws (Article 6(1)(c) GDPR).
Legitimate interests: To ensure the security and stability of the website and to respond to your inquiries (Article 6(1)(f) GDPR).
Payment Processing
We use Stripe as our payment processing service provider. Stripe processes the personal data required to complete payment transactions, including payment method details, transaction amounts, and contact information. Stripe acts as an independent data controller for certain aspects of payment processing and may transfer data to countries outside the European Economic Area, subject to applicable legal safeguards. For more information, please refer to Stripe’s privacy policy.
Data Retention
We retain personal data only for as long as necessary to achieve the purposes for which it was collected. Specifically:
Order and transaction data will be retained for the duration of the contractual relationship and subsequently for the periods prescribed by German commercial and tax laws. Under Section 257 of the German Commercial Code (Handelsgesetzbuch) and Section 147 of the German Fiscal Code (Abgabenordnung), business records and documents must be retained for six (6) to ten (10) years. For correspondence related to inquiries that do not result in a contractual relationship, we will delete the data once your inquiry has been satisfactorily resolved, provided there is no statutory obligation to retain it.
Technical data collected during your visit to the website will be retained only for the limited period necessary to ensure the website’s security and functionality.
Upon the expiration of applicable retention periods, we will delete the data or render it irreversibly anonymous, unless you have expressly consented to its continued use.
Recipients of Data
We may share your personal data with the following parties:
Stripe (for payment processing).
Service providers engaged to process data on our behalf (e.g., hosting providers), provided they have offered sufficient guarantees regarding the implementation of appropriate technical and organizational measures.
Competent authorities (where we are legally obliged to disclose data).
International Data Transfers
If personal data is transferred to countries outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place in accordance with Chapter V of the General Data Protection Regulation (GDPR), such as the use of Standard Contractual Clauses approved by the European Commission or transfers based on an “adequacy decision.”
Your Rights
You have the right to:
Request access to your personal data (Article 15 GDPR)
Request the correction of inaccurate data (Article 16 GDPR)
Request the deletion of your data (Article 17 GDPR)
Request the restriction of processing (Article 18 GDPR)
Object to processing based on legitimate interests (Article 21 GDPR)
Request data portability (Article 20 GDPR)
To exercise any of the above rights, please contact us at staff@skinpoemstudio.com.
You also have the right to lodge a complaint with a supervisory authority. The competent supervisory authority is determined by our registered address in Germany.
Obligation to Provide Data
You are under no legal or contractual obligation to provide personal data. However, providing certain data is necessary for the conclusion and performance of a contract. If you do not provide the required data, we may be unable to process your order or respond to your inquiries. Automated Decision-Making
We do not engage in automated decision-making (including profiling) as referred to in Article 22 of the General Data Protection Regulation (GDPR).
Changes to This Privacy Policy
We reserve the right to update this privacy policy to reflect changes in legal requirements or adjustments to our data processing practices. The version published at the time you access this website is the applicable version.
