Privacy Policy (Datenschutzerklärung)Controller and Contact
The controller responsible for the processing of personal data in connection with this website is:
Dr. Yuliya Zielinski
theSKINBOX – Sole Proprietorship
Schloßschmidstrasse 16
80639 Munich
Germany
Email: mail@the-skin-box.com
Phone: +49 89 7454 5642
If you have questions about data protection or wish to exercise your data protection rights, you can contact us using the details above.
2. Scope
This privacy policy informs you about the processing of personal data when you visit our website and when you contact theSKINBOX.
For the processing of personal data in connection with clinical studies, research projects, or other separate offerings, affected individuals receive supplementary privacy notices tailored to that specific processing.
3. Provision of the Website and Hosting
When you access our website, technical data is processed in order to deliver the requested content to your device and to enable the secure operation of the website. This includes your IP address, the date and time of access, the pages or files accessed, the access status, the amount of data transferred, information about your browser and operating system, and, where applicable, the previously visited page.
This processing serves to provide the website, to analyse errors, and to detect or defend against attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a secure and functional web presence.
Hosting provider: Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA
Webflow is certified under the EU-U.S. Data Privacy Framework, including the UK and Swiss extensions, with the U.S. Department of Commerce. This certification serves as the safeguard for the transfer of personal data to Webflow in the United States. Further information is available at www.dataprivacyframework.gov.
We do not use any additional delivery providers, proxy or DNS services, or content delivery networks beyond Webflow's own hosting infrastructure.
Access logs are retained only for as long as necessary for the purposes described above and are deleted once these purposes no longer apply. In the event of a concrete security incident, the data required for that purpose may be retained until the incident has been resolved and, where applicable, to assert or defend legal claims.
Processing takes place in Germany and, in relation to hosting, in the United States. Further detail on this transfer is set out in Section 6.
4. Contact and Business Inquiries
If you contact us by email or telephone, we process the data you provide to us. This may include your name, business contact details, your organisation, your role, the content of your inquiry, and any documents submitted.
We use this data to respond to your inquiry and to conduct the related correspondence.
Where the inquiry relates to a contract with you or to pre-contractual measures taken at your request, the legal basis is Art. 6(1)(b) GDPR. For general inquiries and communication with contacts at companies or institutions, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in handling business matters and maintaining the related correspondence.
You are generally not obliged to provide data for an inquiry. However, without the information required to process and respond to it, we may not be able to address your request.
We use Google Workspace (Google LLC, USA) for email communication. Google LLC is certified under the EU-U.S. Data Privacy Framework, including the UK and Swiss extensions, with the U.S. Department of Commerce. This certification serves as the safeguard for the transfer of personal data to Google in the United States.
We delete the data once the inquiry has been fully processed and no further retention is required. Where an inquiry results in a contract, the related correspondence and documents may be subject to statutory retention obligations under German commercial and tax law, generally six years for commercial correspondence under § 257 HGB and up to ten years for accounting-relevant records under § 147 AO. The legal basis for this retention is Art. 6(1)(c) GDPR.
Where data is required to assert, exercise, or defend legal claims, further retention takes place on the basis of Art. 6(1)(f) GDPR until this purpose no longer applies.
5. Cookies and Similar Technologies
To the extent we store information on your device or access information already stored there, this is governed by § 25 TDDDG.
For technically essential operations that serve to provide a digital service you have explicitly requested, no consent is required under § 25(2) No. 2 TDDDG.
Any other storage or access takes place only with your prior consent under § 25(1) TDDDG. Where this involves consent-based processing of personal data, that processing is based on Art. 6(1)(a) GDPR.
We use only the technically essential cookies and local storage required by our hosting infrastructure to deliver the website and maintain its security. These serve solely to provide the website you have requested and fall under § 25(2) No. 2 TDDDG. Any personal data processed in this context is processed on the basis of Art. 6(1)(f) GDPR, with our legitimate interest lying in a secure and functional web presence.
We do not use analytics, tracking, profiling, advertising technologies, or any other technology requiring consent. We therefore do not operate a consent banner or consent management tool.
6. Recipients and Processing Outside the EU/EEA
Personal data may be transferred to the service providers named in this policy, to the extent necessary for the purposes described. Webflow, Inc. and Google LLC act as processors on our behalf under data processing agreements pursuant to Art. 28 GDPR.
Website design, development, and ongoing technical maintenance are carried out by an external freelance web developer engaged by us, who may in this context have access to personal data submitted through the website.
Where a legal obligation exists, data may also be transferred to competent authorities or courts.
The following transfers take place outside the EU/EEA:
Recipient: Webflow, Inc., United States Processing concerned: hosting and delivery of the website, including the technical access data described in Section 3 Basis for transfer: EU-U.S. Data Privacy Framework certification Further information: www.dataprivacyframework.gov; Webflow's data processing addendum is available at webflow.com/legal/dpa
Recipient: Google LLC, United States Processing concerned: business email correspondence as described in Section 4 Basis for transfer: EU-U.S. Data Privacy Framework certification Further information: www.dataprivacyframework.gov; further detail is available at policies.google.com/privacy/frameworks
7. Health Data and Research Information
The general contact channels on this website are not intended for the submission of patient records or other personal health data.
Please do not send us identifiable patient data, findings, or comparable sensitive information through these channels. Where such data is required within the scope of an agreed project, we will separately arrange the transmission method and the applicable privacy information.
8. Your Rights
Subject to the statutory requirements, you have the right to:
Access to your personal data under Art. 15 GDPR;
Rectification of inaccurate data and completion of incomplete data under Art. 16 GDPR;
Erasure under Art. 17 GDPR;
Restriction of processing under Art. 18 GDPR;
Data portability under Art. 20 GDPR.
You may withdraw any consent given at any time with future effect. Processing carried out before the withdrawal remains lawful.
To exercise your rights, please contact mail@the-skin-box.com.
9. Your Right to Object
Where we process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time for reasons arising from your particular situation. This also applies to any profiling based on this legal basis.
We will then no longer process the data concerned, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing is necessary to assert, exercise, or defend legal claims.
You may object at any time, without giving reasons, to the processing of your data for direct marketing purposes. This includes profiling to the extent it is related to such direct marketing. Your data will then no longer be processed for these purposes.
10. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement.
For private companies based in Bavaria, the following authority generally has jurisdiction:
Bayerisches Landesamt für Datenschutzaufsicht
Promenade 18
91522 Ansbach
Germany
Website: www.lda.bayern.de
Email: poststelle@lda.bayern.de
11. Automated Decision-Making
In connection with the website processing described here, we do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of Art. 22 GDPR.
Last updated: 15 September 2026