Privacy Policy

Status: April 2026

This privacy policy informs you about which personal data we collect, for what purposes we process it, and what rights you have. It applies to the use of our website www.purepatches.online, our mobile applications, and all related services, functions, and content (hereinafter collectively referred to as "Website").

This privacy policy also applies to targeted content and advertising displayed to you on third-party websites, platforms, and applications ("Third-Party Platforms") based on your online activities. These Third-Party Platforms are subject to their own privacy policies.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is:

May Vision Ltd.
168 Triq San Kristofru
Valletta, VLT 1468
Malta

Website: www.purepatches-shop.com
Contact: Contact Form

If you have any questions regarding the processing of your personal data, you can contact us at any time using the contact form mentioned above.

2. Definitions

Personal Data means any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR). This includes, for example, name, address, email address, phone number, but also IP addresses, device identifiers, purchasing habits, usage behavior, or information about your interests and preferences.

Special Categories of Personal Data (Art. 9 GDPR) include, among others, health data. Such data is subject to special protection and is processed only with your explicit consent or on another legal basis specified in Art. 9 Para. 2 GDPR.

3. Collection and Sources of Personal Data

3.1 Direct Collection from You

We collect personal data when you provide it to us or when it arises from your use of our services, particularly when you:

• visit our website or use our applications,
• register a customer account or maintain your profile,
• purchase a product or service,
• subscribe to our newsletter or participate in marketing campaigns,
• participate in sweepstakes, contests, surveys, or diagnostic and recommendation tests,
• submit an inquiry, contact our customer service team, or leave a review,
• interact with us via social media channels.

3.2 Automatically Collected Data

When you use our website, we automatically collect certain data, including IP address, device information, browser type and version, operating system, access times, pages visited, referral sources, click behavior, and usage patterns. This collection is done through cookies and similar technologies (see Section 5.2).

3.3 Collection from Other Sources

We may also receive personal data from other legitimate sources, particularly from:

• publicly available sources and directories,
• data aggregators and data enrichment services,
• advertising partners and advertising networks,
• social media platforms (to the extent you have a profile there and have consented to sharing),
• business partners and affiliated companies.

We may combine data from these different sources with data directly collected by us to gain a more comprehensive understanding of our customers and their needs and to improve our services accordingly.

4. Minors

Our website is intended for adults. Should we become aware that a user is under 16 years of age, we will not use their personal data for marketing purposes without the consent of a parent or guardian. To give such consent, please contact us via our Contact Form .

Access to certain areas of our website and eligibility to receive prizes, samples, or other benefits may be restricted to users of a certain age. We may use personal data for age verification purposes.

5. Purposes and Legal Bases of Data Processing

5.1 Overview of Processing Purposes

Where we process your data on the basis of your consent, we obtain this explicitly and for a specific purpose. We reserve the right to use personal data for other purposes compatible with those mentioned, provided that this is permissible under Art. 6 Para. 4 GDPR.

5.2 Cookies and Similar Technologies

We use cookies, pixels, tags, and similar technologies on our website. We distinguish between:

• Technically necessary cookies: These are absolutely essential for the operation of the website (e.g., secure login, shopping cart function, language settings, load balancing). These cookies are set without your consent. Legal basis: Art. 6 Para. 1 lit. f GDPR in conjunction with § 25 Para. 2 No. 2 TDDDG.
• Functional cookies: These enable extended functions and an improved user experience (e.g., saving your settings and preferences). Legal basis: Art. 6 Para. 1 lit. f GDPR (legitimate interest in user-friendly design).
• Analysis cookies: These enable us to statistically evaluate website usage to improve our offerings. Legal basis: Art. 6 Para. 1 lit. a GDPR in conjunction with § 25 Para. 1 TDDDG (consent).
• Marketing and advertising cookies: These are used to display relevant advertising to you and to measure the effectiveness of our advertising campaigns. Legal basis: Art. 6 Para. 1 lit. a GDPR in conjunction with § 25 Para. 1 TDDDG (consent).

Google Analytics: We use Google Analytics to statistically evaluate website usage. Your IP address will be truncated within the European Union or the European Economic Area before being transmitted to Google servers (IP anonymization). Further information: Google Analytics and Data Protection. You can prevent data collection by Google Analytics by installing the browser add-on at tools.google.com/dlpage/gaoptout .

You can adjust your cookie settings at any time via our cookie consent tool on the website. Without certain cookies, not all functions of the website may be available.

6. Automated Decision-Making and Profiling

We use automated processes to evaluate certain personal aspects (profiling according to Art. 4 No. 4 GDPR). In particular, we use profiling to display personalized product recommendations and content, to segment our customers into target groups, and to make our marketing measures more effective. The basis for this is your purchase history, your usage behavior, and your stated interests.

We do not make automated decisions that have legal effect on you or significantly affect you in a similar way (Art. 22 GDPR) without your explicit consent or another legal basis.

7. Recipients and Disclosure of Personal Data

7.1 Processors

We transfer your personal data to the following categories of processors who assist us in providing our services (Art. 28 GDPR):

• service providers for hosting, IT infrastructure, and website administration,
• service providers for marketing and advertising activities, including email dispatch and campaign management,
• analysis and data enrichment service providers,
• payment service providers and shipping companies,
• customer service platforms and CRM providers,
• external experts for evaluating customer complaints.

7.2 Other Recipients

In addition, we transfer your personal data to the following third parties:

• Affiliated companies within our group of companies, if this is necessary for the purposes mentioned in Section 5 (Art. 6 Para. 1 lit. f GDPR).
• Advertising partners and advertising networks, provided you have given your consent (Art. 6 Para. 1 lit. a GDPR).
• Third parties who send you marketing communications, provided you have consented to this (Art. 6 Para. 1 lit. a GDPR).
• Law enforcement agencies or other government bodies, if we are legally obliged to do so or if it is necessary to protect our rights (Art. 6 Para. 1 lit. c or lit. f GDPR).
• Advisors (lawyers, auditors, tax advisors), insofar as this is necessary to safeguard our legitimate interests.
• Potential buyers, investors or business partners in the context of an actual or planned company transaction (merger, acquisition, sale, restructuring), provided that the recipients commit to confidentiality (Art. 6 Para. 1 lit. f GDPR).

7.3 Social Media Platforms

When we use audience functions of platforms such as Facebook, Instagram or Google, your data is usually pseudonymized or anonymized before transmission. If the transmission of non-anonymized data is necessary, this is done on the basis of your consent (Art. 6 para. 1 lit. a GDPR) or our legitimate interest in effective advertising (Art. 6 para. 1 lit. f GDPR).

7.4 Disclosure of Usage Data

With your consent or on the basis of our legitimate interest, we disclose website usage data to trusted third parties (e.g., advertising networks, advertisers, analysis partners) to show you content and advertising tailored to your interests and to measure the effectiveness of our measures. These third parties may use their own cookies and tracking technologies (see Section 5.2).

Further information on personalized advertising and your choices can be found at www.youronlinechoices.com.

8. Transfer to Third Countries

We and our service providers may transfer and process personal data in countries outside the European Economic Area (EEA).

For some countries outside the European Economic Area (EEA), the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR, which permits data transfer to these countries.

If personal data is transferred to countries for which there is no adequacy decision by the European Commission, we ensure an adequate level of data protection through appropriate safeguards, in particular through:

• Standard contractual clauses of the European Commission in accordance with Art. 46 para. 2 lit. c GDPR,
• binding corporate rules in accordance with Art. 47 GDPR,
• other appropriate safeguards within the meaning of Art. 46 GDPR.

Further information on the transfer mechanisms used can be obtained upon request via our contact form.

9. Storage duration

We store your personal data for as long as is necessary to fulfill the purposes mentioned in section 5, an active customer relationship exists, or we have a legitimate business interest in storing it (e.g., to assert or defend legal claims), or as required by legal retention obligations.

In particular, the following retention periods apply:

• Commercial and tax law retention obligations according to HGB (German Commercial Code) and AO (German Tax Code): up to 10 years for booking records and business documents (§ 257 HGB, § 147 AO).
• Civil law limitation periods: regularly 3 years (§ 195 BGB), in certain cases up to 30 years (§ 197 BGB).
• Marketing data: Data processed for marketing purposes based on your consent or our legitimate interest will be stored until you withdraw your consent or object, or as long as we have a legitimate interest in storing it, but no longer than 36 months after your last interaction with us.

After the respective periods expire, your data will be deleted or further used in anonymized form for statistical purposes.

10. Your rights as a data subject

Under the GDPR, you have the following rights, provided the respective legal requirements are met:

• Right of access (Art. 15 GDPR): You have the right to request information about whether and which personal data we process about you.
• Right to rectification (Art. 16 GDPR): You can request the correction of inaccurate or the completion of incomplete personal data.
• Right to erasure (Art. 17 GDPR): Under certain conditions, you can request the deletion of your personal data, unless there are legal retention obligations or other overriding reasons for further processing.
• Right to restriction of processing (Art. 18 GDPR): You can request the restriction of the processing of your personal data.
• Right to data portability (Art. 20 GDPR): You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing where the processing is based on point (f) of Article 6(1) GDPR. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims. If we process your personal data for direct marketing purposes, you have the right to object at any time without giving reasons.

To exercise your rights, please contact us via the contact form. We may require proof to verify your identity before fulfilling your request.

To stop receiving marketing communications from us, you can use the unsubscribe link in our marketing emails, adjust your settings in your customer account, or contact our customer service team.

11. Withdrawal of your consent

If the processing of your personal data is based on your consent, you can revoke it at any time with effect for the future (Art. 7 para. 3 GDPR). The lawfulness of the data processing carried out until the revocation remains unaffected.

You can withdraw your consent as follows:

• Marketing: Via the unsubscribe link in our emails or the settings in your customer account.
• Cookies: Via our cookie consent tool on the website.
• Other purposes: By contacting us via the contact form.

12. Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data violates data protection regulations, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). You can contact, in particular, the supervisory authority of your usual place of residence, your workplace, or the place of the alleged infringement. A list of German data protection supervisory authorities can be found at: www.bfdi.bund.de.

13. Data security

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, destruction, alteration, or unauthorized disclosure (Art. 32 GDPR). Please note that despite our efforts, no transmission over the Internet and no electronic storage is completely secure.

14. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy at any time with effect for the future to adapt it to changed legal situations, technical developments, or changes in our data processing. Changes will be published on our website and will take effect upon publication. Significant changes that substantially affect your rights will be communicated to you by appropriate means (e.g., by email or by a notice on the website). Continued use of our website after the publication of the changes will be considered as acknowledgement of the updated Privacy Policy.

We recommend that you visit this page regularly to stay informed about the current status.