Privacy policy
Last updated: October 09th, 2026
1. Controller
The controller responsible for the processing of your personal data under Article 4(7) of the General Data Protection Regulation (GDPR) is:
Seulki Löser trading as Quiet Standard®, Wildparkstraße 18, 85586 Poing, Germany.
Email: hello@quiet-standard.com VAT identification number: DE453841886.
2. Data protection officer
We have not appointed a data protection officer. We are not required to do so, because we do not meet the threshold of Article 37 GDPR in conjunction with Section 38 of the German Federal Data Protection Act (BDSG), which requires the appointment where at least twenty persons are constantly engaged in the automated processing of personal data. You can direct all data protection enquiries to the contact address in Section 1.
3. Scope
This Privacy Policy applies to our online store at https://quiet-standard.com, including all subdomains, and to all related ordering, customer service and marketing activities. It explains what personal data we process, on what legal basis, for how long, and what rights you have.
Personal data means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
4. Hosting and server log files
Our store is hosted by Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland, which acts as our processor under Article 28 GDPR on the basis of a data processing agreement.
Each time you access our website, your browser automatically transmits technical data that is stored in server log files:
- IP address
- Date and time of the request
- Page requested and referring URL
- Browser type and version, operating system, language settings
- Volume of data transferred and access status
Purpose: operation, stability and security of the website, and detection and investigation of misuse. Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is providing a functional and secure online store. Retention: log data is deleted after [NUMBER] days unless a specific security incident requires longer retention for evidentiary purposes.
5. Cookies and similar technologies
We use cookies and similar technologies such as local storage and pixels.
Strictly necessary technologies are required to operate the shop: session management, shopping cart contents, order completion, load balancing and storing your consent choice. Storing information on your device and accessing it for these purposes is permitted without consent under Section 25(2) no. 2 TDDDG. The subsequent processing of personal data is based on Art. 6(1)(f) GDPR and, where the cookie is required to carry out your order, on Art. 6(1)(b) GDPR.
All other technologies, in particular cookies for analytics, personalisation and advertising, are only set after you have given your consent via our consent banner. Storage and access are based on Section 25(1) TDDDG, the subsequent processing on Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via the "Cookie Settings" link in the footer of this website. The lawfulness of processing carried out before the withdrawal remains unaffected.
You can see which categories of technologies we use in the "Cookie Settings" in the footer of this website and select them individually there. The services we use, with provider, purpose, category and storage period, are listed in the following overview.
Overview of the services we use
Shopify
Provider: Shopify International Limited, Dublin, Ireland
Purpose: operation of the shop, shopping cart, checkout, storing your consent choice
Category: strictly necessary
Storage period: session cookies until you close your browser; other cookies for the period stated in Shopify's cookie policy (https://www.shopify.com/legal/cookies)
Third-country transfer: Canada (Shopify Inc.), see section 8
Meta Pixel and Conversions API
Provider: Meta Platforms Ireland Limited, Dublin, Ireland
Purpose: measuring and optimising our advertising on Facebook and Instagram, showing our ads to people who have visited our website
Category: marketing
Storage period: cookies _fbp and _fbc: 90 days
Joint controllership: We and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR for collecting the data on our website and transmitting it to Meta. The essential content of the agreement is set out in Meta's Controller Addendum (https://www.facebook.com/legal/controller_addendum). Meta is responsible for any further processing after transmission. You can exercise your rights against us or against Meta.
Third-country transfer: USA (Meta Platforms, Inc.), on the basis of the EU-U.S. Data Privacy Framework
Microsoft Clarity
Provider: Microsoft Ireland Operations Limited, Dublin, Ireland
Purpose: analysing how our website is used (clicks, scrolling, session recordings, heatmaps) to improve it
Category: analytics
Storage period: session recordings 30 days, heatmaps up to 9 months
Third-country transfer: USA (Microsoft Corporation), on the basis of the EU-U.S. Data Privacy Framework and standard contractual clauses
Klaviyo
Provider: Klaviyo, Inc., Boston, USA
Purpose: newsletter and email marketing, linking your browsing behaviour on our website to your newsletter profile so we can send relevant emails
Category: marketing
Storage period: cookie __kla_id up to 2 years, shorter depending on your browser; profile data until you unsubscribe
Third-country transfer: USA, on the basis of the EU-U.S. Data Privacy Framework
RevenueHunt (skin quiz)
Provider: Durian Capital Inc., Road Town, Tortola, British Virgin Islands
Purpose: running our skin quiz and showing you a personal product recommendation
Category: strictly necessary for the quiz you request
Storage period: 12 months
Third-country transfer: hosting in the USA (Amazon Web Services), on the basis of standard contractual clauses
Judge.me
Provider: Judge.me Ltd, London, United Kingdom
Purpose: requesting, collecting and displaying product reviews
Category: the cookie _judgeme_session is strictly necessary for the review form you use and is deleted when you close your browser. The cookie judgeme_reviewer stores your name and email address to pre-fill the review form on your next visit; it is a personalisation cookie and is stored for 365 days.
Storage period of your review: until you withdraw your consent, see section 6
Third-country transfer: United Kingdom, on the basis of the European Commission's adequacy decision; data may also be processed in the USA
Instafeed
Provider: Mintt Studio, Vila Nova de Gaia, Portugal
Purpose: displaying our Instagram feed on our website
Category: according to the provider, Instafeed does not set cookies
Note: when the content is loaded, your browser may transmit data, in particular your IP address, to Instagram (Meta Platforms Ireland Limited, Dublin, Ireland)
Cowlendar and Google Meet
Provider: Booking Appointment Cowlendar SAS, 14 rue Charles V, 75004 Paris, France
Purpose: booking video consultations
Category: strictly necessary for the booking you request
Storage period: 12 months
Video consultations are held via Google Meet, provided by Google Ireland Limited, Dublin, Ireland. Third-country transfer: USA (Google LLC), on the basis of the EU-U.S. Data Privacy Framework.
6. Processing activities in detail
| Processing activity | Data processed | Legal basis | Retention |
|---|---|---|---|
| Browsing the store | Log data, device and browser data | Art. 6(1)(f) GDPR: secure operation | Held by our hosting provider for the period necessary for security and operations |
| Customer account | Name, email, password (hashed), addresses, order history, preferences | Art. 6(1)(b) GDPR: pre-contractual and contractual measures | Until you delete the account, then subject to statutory retention below |
| Placing and fulfilling an order | Name, billing and delivery address, email, phone number, order contents, order number | Art. 6(1)(b) GDPR: performance of the purchase contract | See statutory retention below |
| Payment processing | Payment method, payment card or account data, transaction and authorisation data | Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR for statutory bookkeeping | 10 years, see below |
| Shipping | Name, delivery address, email address and, where you provide it, phone number for delivery notifications | Art. 6(1)(b) GDPR | Duration of the delivery, then statutory retention |
| Withdrawal, returns and refunds | Order data, withdrawal declaration, bank or payment account details for the refund | Art. 6(1)(c) GDPR: statutory withdrawal rights under Sections 355, 357 German Civil Code; Art. 6(1)(b) GDPR | 10 years as accounting records |
| Warranty and defect claims | Order data, description of the defect, correspondence, photographs you send us | Art. 6(1)(b) and (c) GDPR | Until the statutory limitation period expires, then accounting retention |
| Cosmetovigilance and product safety | Name, contact details, description of the undesirable effect, product and batch number | Art. 6(1)(c) GDPR in conjunction with Art. 23 of Regulation (EC) No 1223/2009; Art. 9(2)(i) GDPR where health data is involved | Retained as part of the Product Information File for 10 years after the last batch was placed on the market, Art. 11(4) Regulation (EC) No 1223/2009 |
| Customer service and enquiries | Name, email, content of the enquiry, related order data | Art. 6(1)(b) GDPR where the enquiry concerns a contract; otherwise Art. 6(1)(f) GDPR: responding to enquiries | 6 years for commercial correspondence, see below |
| Product reviews | Display name, review text, rating, verified purchase status | Art. 6(1)(a) GDPR: your consent when submitting | Until you withdraw consent or request deletion |
| Quiet Points loyalty programme | Name, email, points balance, redemption history and, if you choose to provide it for the birthday reward, your date of birth | Art. 6(1)(b) GDPR: performance of the loyalty programme terms; the date of birth is processed on the basis of Art. 6(1)(a) GDPR and is optional | Until you leave the programme or delete your account |
| Newsletter and email marketing | Email address, name, opt-in timestamp and IP address, opening and click behaviour | Art. 6(1)(a) GDPR; for existing customers, Section 7(3) of the German Act Against Unfair Competition (UWG) in conjunction with Art. 6(1)(f) GDPR | Until you unsubscribe. Proof of consent is retained for 3 years after the end of the year of withdrawal |
| Personalised advertising and retargeting | Cookie and device identifiers, browsing and purchase behaviour, pseudonymous audience identifiers | Art. 6(1)(a) GDPR: consent given via the banner | Until consent is withdrawn, subject to the periods stated in the banner |
| Fraud prevention and payment risk screening | Order data, device and network data, payment data, order patterns | Art. 6(1)(f) GDPR: protection against payment default and fraudulent orders | Duration of the order relationship plus the limitation period |
| Accounting, tax and audit | Invoices, orders, payment records, commercial correspondence | Art. 6(1)(c) GDPR | 10 or 6 years, see below |
Statutory retention periods
Where a statutory obligation applies, we retain data for the following periods, calculated from the end of the calendar year in which the document was created:
- 10 years for invoices, accounting records, booking vouchers and the underlying order data, under Section 147(1) Nos. 1, 4 and 4a of the German Fiscal Code (AO) and Section 14b(1) of the German VAT Act (UStG).
- 6 years for received and sent commercial and business letters, under Section 147(1) Nos. 2 and 3 AO.
During these periods, processing is restricted to the fulfilment of the retention obligation itself. The data is no longer used for any other purpose.
7. Recipients and categories of recipients
We disclose personal data only where a legal basis permits it. The following categories of recipient are involved:
- E-commerce platform and hosting: Shopify International Limited, Ireland, with onward processing by Shopify Inc., Canada, and its sub-processors. Processor under Article 28 GDPR.
- Payment service providers: Shopify Payments (operated by Shopify International Limited, Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, and Klarna Bank AB (publ), Sweden. These providers act as independent controllers for the payment transaction and process your data under their own privacy notices.
- Digital wallets: Apple Distribution International Ltd., Ireland, and Google Ireland Limited, Ireland, where you use Apple Pay or Google Pay. Independent controllers.
- Shipping and logistics: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany (domestic shipping), and Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany (international shipping), for the delivery of your order.
- Loyalty programme: Appstle Inc., Canada, for the operation of the Quiet Points programme. Processor under Article 28 GDPR.
- Public authorities: tax authorities, customs authorities and the competent cosmetics market surveillance authority, where we are legally obliged to provide information.
- Transfers to third countries: where personal data is processed outside the European Economic Area, this takes place only on the basis of an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR, in particular standard contractual clauses.
We do not sell your personal data, and we do not disclose it for the independent commercial purposes of third parties.
8. Transfers to third countries
Some of our processors are established outside the European Economic Area or process data outside it.
- Transfers to Canada (Shopify Inc.) are covered by the European Commission's adequacy decision of 20 December 2001 for commercial organisations subject to PIPEDA.
- Transfers to the United States to providers certified under the EU-US Data Privacy Framework are covered by the European Commission's adequacy decision of 10 July 2023.
- For all other transfers, we rely on the Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) GDPR, supplemented where necessary by additional technical and organisational measures following a transfer impact assessment.
You can request a copy of the safeguards in place by writing to hello@quiet-standard.com.
9. Is the provision of your data required?
Providing the data marked as mandatory during checkout is necessary for the conclusion and performance of the purchase contract. Without it we cannot process or deliver your order. Providing your date of birth for the loyalty birthday reward, your phone number for delivery notifications, and your email address for the newsletter is voluntary. Not providing them has no consequence other than that the specific optional feature is unavailable.
10. Automated decision-making
We do not use automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Article 22(1) GDPR. Automated fraud screening carried out by our payment providers may flag an order for manual review, but no order is rejected without a human decision.
11. Your rights
Under the GDPR you have the following rights, which you can exercise free of charge by writing to hello@quiet-standard.com. We will respond within one month, extendable by two further months where the request is complex, in which case we will inform you of the extension and its reasons.
- Right of access, Article 15 GDPR. To obtain confirmation of whether we process your data, and if so, a copy of that data together with the information listed in Article 15(1).
- Right to rectification, Article 16 GDPR. To have inaccurate data corrected and incomplete data completed.
- Right to erasure, Article 17 GDPR. To have your data deleted where one of the grounds in Article 17(1) applies. This right does not extend to data we are legally obliged to retain under Section 6.
- Right to restriction of processing, Article 18 GDPR.
- Right to data portability, Article 20 GDPR. To receive the data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
- Right to withdraw consent, Article 7(3) GDPR. Where processing is based on your consent, you can withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before it.
We may ask you to verify your identity before acting on a request, where we have reasonable doubts as to the identity of the person making it, in accordance with Article 12(6) GDPR.
12. Right to object
Right to object to processing based on legitimate interests, Article 21(1) GDPR. You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data that is based on Article 6(1)(f) GDPR. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Right to object to direct marketing, Article 21(2) GDPR. You have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling connected with such marketing. This right is unconditional. If you object, we will stop processing your data for direct marketing immediately.
To exercise either right, write to hello@quiet-standard.com or use the unsubscribe link in any of our marketing emails.
13. Right to lodge a complaint
Without prejudice to any other remedy, you have the right under Article 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or place of the alleged infringement.
The supervisory authority competent for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany.
14. Data security
We use TLS encryption for all data transmitted between your browser and our store, indicated by the padlock in your browser's address bar. We apply appropriate technical and organisational measures under Article 32 GDPR, including access controls, pseudonymisation where practicable, and contractual controls over our processors. No transmission over the internet can be guaranteed to be entirely secure. Please do not send sensitive information to us over unsecured channels.
15. Children
Our store is not directed at children. We do not knowingly process the personal data of persons who lack the legal capacity to enter into a contract without the consent of a parent or guardian. Under Section 4(1) of the Regulation implementing Article 8 GDPR in Germany, consent by a child in relation to information society services is valid from the age of 16. If you believe that a child has provided us with personal data, please contact us and we will delete it.
16. Changes to this Privacy Policy
We keep this Privacy Policy under review and update it where our processing changes or where legal requirements change. The current version is always available on this page. Where a change materially affects your rights, we will notify you separately, for example by email.
