Data Protection

PREAMBLE

In this privacy policy, we inform you about what personal data we collect, for what purposes we process it and to what extent this takes place. This policy applies to all processing of personal data in connection with our services – in particular on our websites and external online platforms, such as our social media profiles.

Date: 1 January 2026

All references to persons apply equally to all genders.

CONTROLLER AND DATA PROTECTION OFFICER

SC Cosmetics Handels GmbH
Baumgarten 206
6320 Angerberg
Austria

Data Protection Officer: Ms Helga Langreiter
E info@swiss-color.com
T +43 5332 56671

DATA PROCESSED AND PURPOSE

Personal data is processed for the purposes of fulfilling the contract, billing, the assertion of contractual claims, for customer service purposes and for marketing purposes. In doing so, we process, in particular, customer details, payment details, contact details, content data and contractual data. In addition, we collect and use usage data, meta and communication data, as well as log data, in order to provide our online services, make them user-friendly and ensure the security of our systems. Furthermore, the data is used to respond to enquiries, to communicate via various channels and for direct marketing. This includes the management and organisation of user enquiries (e.g. via email, messenger or telephone) as well as marketing communications via email, post, telephone or fax in accordance with legal requirements.

Data processed:

• Master data (e.g. name, address, customer number)
• Contact details (e.g. post and email addresses, telephone numbers)
• Usage data (e.g. page views, clicks, click paths, time spent on site, devices used, content and functions accessed, interactions with content)
• Payment data (bank details, credit card number, invoices, payment history)
• Meta and communication data (e.g. IP addresses, timestamps, technical information)
• Content data (e.g. messages and posts, including authorship and timestamps)
• Contract data (e.g. subject matter of the contract, term, customer category)
• Log data (e.g. login times, access log files)

In addition to communicating with users and prospective customers, data processing is also used to run prize draws and competitions, to measure reach and track usage, to define target groups and measure conversion rates, and for affiliate tracking. Furthermore, we use the data for office and organisational procedures, business processes, conducting surveys, public relations, sales promotion and direct marketing.

Purposes of processing:

• Fulfilment of a contract (processing and handling of orders, fulfilment of contractual obligations)
• Business processes (organisation and business administration)
• Communication (e.g. contact enquiries, follow-up enquiries, public relations, direct marketing, targeted advertising)
• Optimisation of our online offering (e.g. reach measurement and user analysis, feedback from surveys via online forms)
• Organisation of prize draws and competitions
• Security measures (protection against misuse and data security)

Data subjects include service recipients, clients, users, communication partners, prospective customers, and participants in prize draws, competitions, educational programmes and courses.

LEGAL BASIS FOR DATA PROCESSING

Our data processing is based on the following legal bases in accordance with the GDPR (EU General Data Protection Regulation) and the Data Protection Adaptation Act 2018. In addition to the GDPR, national data protection regulations of your or our country of residence may apply.

• Consent (Art. 6(1)(a) GDPR): Processing of personal data with the data subject’s consent for specific purposes.
• Performance of a contract (Art. 6(1)(b) GDPR): Processing for the performance of a contract or the implementation of pre-contractual measures.
• Legal obligation (Art. 6(1)(c) GDPR): Processing to comply with legal requirements. 
• Legitimate interests (Art. 6(1)(f) GDPR): Processing to safeguard legitimate interests, provided that these do not override the rights of the data subject.

Additional regulations in Austria:
In Austria, the provisions of the Data Protection Act (DSG) also apply, for example regarding rights of access, rectification or special categories of personal data, as well as the Telecommunications Act 2003 (TKG 2003), in particular Section 96(3), concerning cookies, tracking and electronic communications.

Applicability of the GDPR and the Swiss Data Protection Act (DSG):
This privacy notice takes into account both the GDPR and the Swiss Data Protection Act (DSG). We use the terms defined in the GDPR to ensure consistency and clarity. The legal meaning of these terms under the Swiss DSG continues to be governed by its provisions.

DATA RETENTION PERIOD

We process your personal data (address, email address, telephone number), where necessary, for the duration of the entire business relationship (from the initiation and execution of a contract through to its termination) and beyond, in accordance with the statutory retention and documentation obligations arising, amongst other things, arise from the Austrian Commercial Code (UGB) and the Federal Tax Code (BAO), and until the conclusion of any legal dispute, ongoing warranty and guarantee periods, etc.

We process your personal data (address, email address, telephone number) for the duration of the entire business relationship (from the initiation and execution to the termination of a contract) and beyond, in accordance with statutory retention and documentation obligations. These arise, amongst other things, from the Austrian Commercial Code (UGB) and the Federal Tax Code (BAO). Furthermore, data is retained until the conclusion of any legal dispute and throughout ongoing warranty and guarantee periods.

Personal data that we process is deleted as soon as the underlying consents are withdrawn or there are no longer any legal grounds for processing. This applies to cases where the original purpose of processing no longer applies or the data is no longer required. We process data that must be retained for commercial or tax law reasons, or for the purposes of legal proceedings, exclusively for these purposes.

The retention periods are governed by statutory requirements:

• 10 years: Books, records, annual accounts, inventories, management reports, opening balance sheets, accounting vouchers, invoices and all necessary work instructions and organisational documents (Section 132 of the Federal Tax Code (BAO), Sections 190–212 of the Austrian Commercial Code (UGB)).
• 6 years: Business documents such as commercial and business correspondence, price labels, hourly wage slips and similar documents (Section 132 of the Federal Tax Code (BAO), Sections 190–212 of the Austrian Commercial Code (UGB)).
• 3 years: Data relating to the processing of potential warranty and compensation claims, as well as associated enquiries, in accordance with the standard limitation period (Sections 1478, 1480 of the ABGB).

These periods generally commence at the end of the calendar year in which the event triggering the limitation period occurs. In the case of ongoing contractual relationships, this is the date of termination of the contract.

Right of withdrawal:
Your express consent is required for the processing of your data. As a matter of principle, we do not process data relating to minors and assume that you are at least 14 years of age or have the consent of your legal representative.

In accordance with the General Data Protection Regulation (GDPR), you may exercise various rights against us at any time. These are set out in particular in Articles 15 to 21 of the GDPR:

• Right to object: You may object at any time, on grounds relating to your particular situation, to the processing of your personal data, provided that such processing is carried out on the basis of Article 6(1)(e) or (f) of the GDPR. This also applies to profiling based on these provisions. If your personal data is used for direct marketing, you have the unrestricted right to object to processing for this purpose – including profiling, insofar as it is related to such direct marketing.
• Withdrawal of consent: You have the right to withdraw any consent you have given to the processing of your personal data at any time, with effect for the future.
• Right to rectification: You may request the rectification of inaccurate personal data or the completion of incomplete personal data, provided this complies with the statutory requirements.
• Right to erasure and restriction of processing: You have the right to request the immediate erasure of your personal data, provided the legal requirements are met. Alternatively, you may request the restriction of the processing of your data, provided that the legal requirements permit this.
• Right of access and right to data portability: You have the right to request confirmation as to whether your personal data is being processed, as well as to obtain information about this data. You may also request a copy of the data being processed. In accordance with the legal requirements, you may also request that your data be provided in a structured, commonly used and machine-readable format, or request that it be transferred to another data controller, provided this is technically feasible.
• Right to lodge a complaint: Should you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Austrian Data Protection Authority (Wickenburggasse 8–10, 1080 Vienna, email:& nbsp;dsb@dsb.gv.at).

Please contact us at any time via the following email address if you have any questions, wish to withdraw consent, request corrections or have any other concerns regarding the processing of your data: info@swiss-color.com  or write to: SC Cosmetics Handels GmbH, Baumgarten 206, 6320 Angerberg.

ONLINE SHOP PURCHASES AND CONTRACT PROCESSING

When shopping via our online shop at  https://www.swiss-color.com we store various data using cookies, including customer and prospective customer details, payment details and technical information. This data processing is necessary to enable you to use the online shop, to process orders, to carry out pre-contractual measures and to fulfil legal obligations. Without this data, it is not possible to conclude a contract. Furthermore, the data collected serves administrative purposes and contributes to the security of our business partners and our business operations. In this way, we ensure a smooth and secure ordering process whilst protecting your data.

Data is only disclosed to third parties to the extent necessary, for example to fulfil legal obligations or where there is a legitimate interest.

• Banks and payment service providers: To process payment transactions.
• Transport companies and delivery service providers: For the delivery of the goods ordered.
• Tax advisers: To fulfil our tax obligations.

All third-party providers have undertaken to comply with data protection regulations. Data processing agreements in accordance with Article 28 of the GDPR are in place with these service providers. Further information on the data processors can be requested at info@swiss-color.com.

Events:
When organising and running events, we process participants’ data to enable participation and provide services. Where special categories of data (e.g. health data) are processed, this is done on the basis of consent, for security purposes or on the basis of information clearly provided in the context of the event.

NEWSLETTER

Newsletters and electronic notifications:
We send out newsletters containing information about our services, promotions and offers. To subscribe free of charge, your email address is usually sufficient. Optionally, we may ask for your name or further details to create personalised content.

Opting out:
You can unsubscribe from the newsletter at any time. You will find the unsubscribe link in every email, or you can use the contact details provided (preferably by email).

Deletion and restriction of processing:
We may retain unsubscribed email addresses for up to three years in order to provide evidence of consent previously given. This data is processed exclusively for the purpose of defending against potential claims. You may request the deletion of your data at any time, provided that consent has been confirmed. In order to permanently honour any objections, we may store email addresses on a ‘blocklist’.

Logging and mailing service providers:
The registration process is logged for verification purposes. Where we commission service providers such as Mailchimp to send emails, this is done on the basis of our legitimate interests in a secure and efficient system.

Note on relevant services:
Mailchimp

SOCIAL MEDIA

We operate social media channels and process user data in order to communicate with active users or provide information. In doing so, user data may be processed outside the European Union, which could entail potential risks for users, for example with regard to the enforcement of their rights.

Within social networks, user data is generally used for market research and advertising purposes. For example, usage profiles are created based on behaviour in order to display targeted advertisements both within and outside the networks. Cookies are used for this purpose, which store users’ usage behaviour and interests. In some cases, this data may be stored across devices, particularly if users are members of the respective platforms and remain logged in.

For detailed information on data processing and opt-out options, please refer to the privacy policies of the respective platform operators. If you have any enquiries or wish to exercise your rights, please feel free to contact us via the following email address: info@swiss-color.com or write to: SC Cosmetics Handels GmbH, Baumgarten 206, 6320 Angerberg.

Information on the services concerned:

• Instagram: https://www.instagram.com/swisscolor/
• Facebook:  https://www.facebook.com/SwissColorInternational
• YouTube:  https://www.youtube.com/@SwissColorVideo 
• Pinterest: https://www.pinterest.com/swiss_color/
  
  

REGISTRATION, USER ACCOUNT AND AFFILIATE PROGRAMME

Registration and user account:
Users can create a personal user account to make full use of our services. As part of the registration process, we collect and process the required mandatory information, such as username, password and email address, in order to provide the account and fulfil contractual obligations. In addition, whilst the user account is in use, we store the IP address and the times of the respective user actions. This serves to protect against misuse and unauthorised use and is carried out on the basis of our legitimate interests. This data will only be disclosed to third parties where required by law or to enforce claims.

Users may be informed by email about relevant matters, such as technical changes or security-related notices. Upon termination of a user account, all associated data will be deleted, provided there is no statutory obligation to retain it. It is the users’ responsibility to back up their data before the end of the contract, as we are entitled to delete the data irrevocably.

Affiliate programme:
We offer an affiliate programme in which users, as ‘affiliates’, receive commissions or benefits by referring others to our offers. These referrals are made via individual links or discount codes assigned to affiliates to track their success.

For the purposes of attribution, we store information on whether a user has followed an affiliate link and whether this has resulted in a transaction or other use of our services. This data processing is carried out solely for the purpose of commission settlement and is deleted as soon as it is no longer required.

Affiliate links may be supplemented with specific values, which are stored either within the link itself or in cookies. This enables us to clearly trace the origin of a transaction.

PAYMENT PROCEDURES

Within the framework of contractual relationships, legal obligations or our legitimate interests, we offer secure and efficient payment methods, utilising payment service providers in addition to banks and credit institutions.

The data processed by payment service providers includes personal details (e.g. name, address), bank details (e.g. account numbers, credit card numbers), passwords, TANs and security codes, as well as transaction-related information. These are necessary to process payments. The data entered is processed and stored exclusively by the payment service providers. We do not receive any account or credit card details, but only a confirmation or rejection of the payment. In some cases, payment service providers may transmit data to credit reference agencies for identity and creditworthiness checks.

Payments are subject to the terms and conditions and privacy policies of the respective payment service providers, which are available on their websites or apps. We recommend that you consult these for further information and to exercise your rights (withdrawal, access to data, etc.).

Information on the services concerned:

• Apple Pay
• Klarna
• Mastercard
• PayPal
• Visa
  
  

WEB ANALYTICS, OPTIMISATION AND ONLINE MARKETING

As part of our web analytics, optimisation and online marketing activities, we process personal data to improve our online offering, enhance user-friendliness and display targeted advertising content. This processing is carried out in compliance with applicable data protection regulations, either on the basis of users’ consent or our legitimate interests.

Web analytics and optimisation:
Web analytics is used to analyse visitor traffic and measure reach. In doing so, we collect pseudonymised data, such as pages visited, click paths, usage intensity and technical information (e.g. device types, operating systems). Using testing methods (e.g. A/B tests), we optimise our content and functions to improve user-friendliness.

To this end, we use IP masking so that users’ IP addresses are processed in a pseudonymised manner. Location data is only processed with the users’ express consent.

Online marketing:
We also create pseudonymised user profiles for the purpose of marketing advertising space and displaying interest-based content. In doing so, information such as content viewed, networks used and technical details is stored and analysed. Cookies or similar methods enable this data to be analysed and retrieved again on other websites that use the same method.

Conversion tracking allows us to determine which of our marketing measures have led to the desired outcome, such as the conclusion of a contract. Here, too, processing takes place on a pseudonymous basis. Users’ personal data is only processed if they have given their additional consent, e.g. as members of a social network.

In this context, we would also like to draw your attention to the information regarding our cookies and cookie settings.

Services concerned:

• Google Analytics (analysis of visitor traffic and reach measurement)
• Google Ads and conversion tracking (performance analysis of advertising campaigns)

COMPETITIONS, CONTESTS AND SURVEYS

In the context of prize draws, contests and surveys, we process participants’ personal data in compliance with the applicable data protection regulations. Processing takes place insofar as it is contractually necessary for the provision, organisation and administration of the respective promotion, the participants have given their consent, or our legitimate interests – such as the security of the promotions or protection against misuse – are safeguarded.

Prize draws and competitions:
Personal data, such as name, contact details or entries, is processed to enable the organisation and administration of the prize draws. If entries are published as part of the campaign (e.g. for voting or reporting purposes), participants’ names may also be visible. Participants may object to such publication at any time.

Should prize draws take place on online platforms such as Facebook or Instagram, the terms of use and privacy policies of the respective platforms shall also apply. Please direct any enquiries regarding the prize draw to us directly. Participants’ data will be deleted once the campaign has ended, as soon as it is no longer required. Winners’ data may be stored for longer for legal reasons; for example, in the case of non-cash prizes, for up to three years to process warranty claims.

Surveys and questionnaires:
Our surveys serve to collect information anonymously, for example through feedback forms or online questionnaires. Personal data is only processed if this is necessary for the provision and conduct of the survey, e.g. to display the survey in the browser or to enable it to be resumed.

Note on relevant services:
For surveys, we may use services such as Google Forms. In such cases, the respective data protection provisions of the service platform, such as Google Ireland Limited, apply.

DATA SECURITY AND TRANSFERS

SC Cosmetics Handels GmbH implements appropriate technical and organisational security measures in accordance with legal requirements, taking into account the current state of the art, implementation costs, and the nature, scope, circumstances and purposes of the data processing. These ensure a level of protection for personal data that is appropriate to the risk, safeguarding it against accidental or deliberate manipulation, loss, destruction and unauthorised access.

These measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access. We take data protection into account right from the selection of hardware, software and procedures, in accordance with the principle of data protection by design and privacy-friendly default settings.

In the course of processing personal data, it may be necessary to transfer such data to other bodies, organisations or individuals, e.g. to providers of integrated IT services. In such cases, we ensure that legal requirements are observed and enter into contracts to protect your data. Within our organisation, we may transfer personal data to other departments or grant them access to it where this is necessary to fulfil contractual obligations or on the basis of legitimate interests.

CHANGES AND UPDATES

Please check our privacy policy regularly. We will make changes where adjustments to data processing are required. Should your involvement (e.g. consent) or individual notification be necessary, we will inform you accordingly.