Last updated: 8 October 2026

1. Who is responsible

Skin2Glow Medical Beauty e.U., Sieveringer Straße 9/11, 1190 Wien, Austria (company register FN 641849 x), runs the online shop skin2glow.com and is the controller for the personal data described here. For any privacy question, write to office@skin2glow.com.

2. What we process, why, and on what legal basis

• Orders and customer account: name, billing and delivery address, email address, phone number, order and payment details, login details. We need them to conclude and fulfil the purchase contract, to deliver, and to handle returns and warranty claims (Art. 6(1)(b) GDPR). Without this data we cannot accept an order.
• Invoices and accounting records: we are required by law to keep them (Art. 6(1)(c) GDPR, § 132 BAO).
• Customer service: what you write to us, to answer your request (Art. 6(1)(b) or (f) GDPR).
• Newsletter: your email address and, if you give them, your name and language, only with your consent (Art. 6(1)(a) GDPR). Every newsletter has an unsubscribe link.
• Running and protecting the shop: device and connection data such as IP address, browser and pages visited, which are needed to deliver the website, prevent fraud and keep the shop secure (Art. 6(1)(f) GDPR; our legitimate interest is a safe, working shop).
• Statistics and advertising: only with your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Details in section 3.

We do not make automated decisions that have legal effects on you.

3. Cookies and similar technologies

On your first visit, a cookie banner asks for your choice. Necessary cookies are always active because the shop cannot work without them. All other categories stay off until you switch them on. You can change or withdraw your choice at any time via "Cookie settings" at the bottom of every page or with the cookie button at the bottom of the screen. Withdrawing does not affect processing that took place before.

Our consent tool is Pandectes GDPR Compliance (Pandectes, Estonia; servers at Amazon Web Services in Ireland). It saves your choice and keeps a record without your name (anonymised IP address, date and time, consent status) so that we can prove your consent (Art. 7(1) and Art. 6(1)(c) GDPR). Pandectes keeps these records for 6 years.

Necessary (always active)

• localization, _shopify_essential, cart_currency, _shop_app_essential: Shopify cookies for cart, checkout, language, currency, Shop Pay and protection against misuse. 1 year (cart_currency 14 days). Full list: www.shopify.com/legal/cookies
• s2g_lang: remembers the shop language. Until you close the browser; 1 year if you choose a language yourself.
• _pandectes_gdpr: saves your cookie choice. 1 year.

Statistics (only with your consent)

• _ga, _ga_*: Google Analytics 4, Google Ireland Limited, Ireland. Shows us how the shop is used (pages and products viewed, purchases). Your browser receives a random ID, so this data is not anonymous. 2 years.
• _shopify_analytics: Shopify statistics about shop use. 1 year.

Marketing (only with your consent)

• _gcl_au, _gcl_ls: Google Ads and Google Merchant Center: conversion tracking and remarketing, Google Ireland Limited, Ireland. Measures which ads lead to purchases and can show you our ads on other websites. 90 days.
• _fbp: Meta Pixel and Meta Conversions API, Meta Platforms Ireland Limited, Ireland. Measures our Facebook and Instagram ads and can show you our ads there. Meta may link this data to your Facebook or Instagram account. For collecting and sending the data, we and Meta are joint controllers (Art. 26 GDPR): www.facebook.com/legal/controller_addendum. 90 days.
• _shopify_marketing: Shopify marketing measurement. 1 year.

4. Who receives your data

• Shopify International Limited, Ireland: our shop platform, as our processor. For some functions, such as Shop Pay and fraud protection across shops, Shopify acts as its own controller: www.shopify.com/legal/privacy/app-users, privacy.shopify.com/en.
• The payment provider you choose at checkout. We never see your full card number.
• Shipping companies: name, delivery address and, where needed for delivery notices, email address or phone number.
• Google and Meta: only with your consent (section 3).
• Klaviyo, Inc., USA: sending our newsletter, only if you have subscribed.
• Pandectes: consent records (section 3).
• Shopify apps that provide shop functions, for example gifts in the cart, which process cart data on our behalf.
• Our tax advisor and public authorities, where the law requires it.

We do not sell your personal data.

5. Transfers outside the EU

Some recipients or their parent companies are in the USA or Canada (Google LLC, Meta Platforms, Inc., Klaviyo, Inc., Shopify Inc.). Transfers to the USA rely on the European Commission's adequacy decision of 10 July 2023 for the EU-U.S. Data Privacy Framework where the recipient is certified (Google LLC, Meta Platforms, Inc. and Klaviyo, Inc. are), and otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR). Canada is covered by an adequacy decision of the European Commission.

6. How long we keep your data

• Order and invoice data: 7 years (§ 132 BAO), longer only while a legal dispute or warranty claim is open.
• Customer account: until you delete it or ask us to.
• Newsletter: until you unsubscribe.
• Customer service messages: as long as needed for your request, then up to 3 years for possible claims.
• Cookies: see section 3. Consent records: 6 years.

7. Your rights

You have the right to access (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), in particular against processing based on our legitimate interest, and at any time against direct marketing. You can withdraw a consent at any time with effect for the future (Art. 7(3)). Write to office@skin2glow.com; we answer within one month.

You may also complain to a supervisory authority. Ours is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Wien, www.dsb.gv.at. You can also contact the authority in the EU country where you live: list of EU data protection authorities.

8. Security

All data between your browser and our shop is sent encrypted (TLS). Access to customer data is limited to the people who need it for your order.

9. Children

Our shop is not aimed at children under 16, and we do not knowingly collect their data.

10. Changes

We update this policy when our shop or the law changes. The date at the top shows the current version.