With the following Privacy Policy, we would like to inform you about the types of your personal data (hereinafter also briefly referred to as “data”) we process, for what purposes, and to what extent. This Privacy Policy applies to all processing of personal data carried out by us, both within the scope of providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offering”).

Status: February 24, 2021

Happy Lotus
c/o Anna Stechert
Augustenstraße 26, 1st Floor
80333 Munich

Authorized Representative: Anna Stechert

Email Address: anna@happylotus.de

Imprint: happylotus.de/impressum

The following overview summarizes the types of data processed and the purposes of their processing, and refers to the data subjects.

Below, we share the legal bases of the General Data Protection Regulation (GDPR) on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations in your or our country of residence and establishment may apply.

• Consent (Art. 6 para. 1 sentence 1 lit. a GDPR) – The data subject has given consent to the processing of his or her personal data for one or more specific purposes.
• Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Protection of vital interests (Art. 6 para. 1 sentence 1 lit. d GDPR) – Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
• Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection regulations of the General Data Protection Regulation, national data protection regulations apply in Germany. This includes, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains special provisions, in particular, on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission as well as automated individual decision-making including profiling. Furthermore, it regulates data processing for employment purposes (§ 26 BDSG), particularly with regard to the establishment, performance, or termination of employment relationships and the consent of employees. In addition, state data protection laws of the individual federal states may apply.

In accordance with legal requirements and taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection commensurate with the risk.

The measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access, input, disclosure, ensuring availability, and their separation. Furthermore, we have established procedures that ensure the exercise of data subjects’ rights, the erasure of data, and responses to data breaches. We also consider the protection of personal data already during the development or selection of hardware, software, and procedures in accordance with the principle of data protection by design and by privacy-friendly default settings.

In the course of our processing of personal data, it may happen that data is transmitted to or disclosed to other entities, companies, legally independent organizational units, or persons. Recipients of this data may include, for example, payment institutions in the context of payment transactions, service providers commissioned with IT tasks, or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude corresponding contracts or agreements with the recipients of your data that serve to protect your data.

Data transfer within the organization: We may transfer personal data to other entities within our organization or grant them access to this data. If this transfer is for administrative purposes, the transfer of data is based on our legitimate business and economic interests or takes place if it is necessary for the fulfillment of our contract-related obligations or if there is consent from the data subjects or a legal permission.

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or if processing takes place within the scope of using third-party services or disclosing or transferring data to other persons, entities, or companies, this is only done in accordance with legal requirements.

Subject to explicit consent or contractually or legally required transfer, we only process or have data processed in third countries with a recognized level of data protection, which includes US processors certified under the “Privacy Shield”, or on the basis of special guarantees, such as contractual obligations through so-called standard protection clauses of the EU Commission, the existence of certifications, or binding internal data protection regulations (Art. 44 to 49 GDPR, EU Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de ).

“Cookies” are small files that are stored on users’ devices. Various information can be stored using cookies. This information may include, for example, language settings on a website, login status, a shopping cart, or the point at which a video was watched.

Cookies are generally also used when a user’s interests or behavior (e.g., viewing certain content, using functions, etc.) are stored in a user profile on individual websites. Such profiles serve to show users content that matches their potential interests, for example. This process is also referred to as “tracking,” i.e., tracking the potential interests of users. The term cookies also includes other technologies that perform the same functions as cookies (e.g., when user information is stored using pseudonymous online identifiers, also referred to as “user IDs”).

If we use cookies or “tracking” technologies, we will inform you separately in our Privacy Policy.

Notes on legal bases: The legal basis on which we process your personal data with the help of cookies depends on whether we ask for your consent. If this is the case and you consent to the use of cookies, the legal basis for processing your data is the given consent. Otherwise, the data processed with the help of cookies will be processed on the basis of our legitimate interests (e.g., in the economic operation of our online offering and its improvement) or, if the use of cookies is necessary to fulfill our contractual obligations.

Revocation and Objection (Opt-Out): Regardless of whether the processing is based on consent or legal permission, you always have the option to revoke a given consent or to object to the processing of your data by cookie technologies (collectively referred to as “Opt-Out”).

You can initially declare your objection via your browser settings, for example, by deactivating the use of cookies (although this may also restrict the functionality of our online offering).

An objection to the use of cookies for online marketing purposes can be declared through a variety of services, especially in the case of tracking, via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/ or generally at http://optout.aboutads.info.

Processing of cookie data based on consent: Before we process or have data processed within the scope of using cookies, we ask users for consent, which can be revoked at any time. Unless consent has been given, only cookies that are necessary for the operation of our online offering will be used. Their use is based on our interest and the interest of users in the expected functionality of our online offering.

• Types of data processed: Usage data (e.g., visited websites, interest in content, access times), Meta/communication data (e.g., device information, IP addresses).
• Data subjects: Users (e.g., website visitors, users of online services).
• Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

We process data of our contract and business partners, e.g., customers and prospective customers (collectively referred to as “contract partners”) within the framework of contractual and comparable legal relationships, as well as related measures and within the scope of communication with contract partners (or pre-contractually), e.g., to answer inquiries.

We process this data to fulfill our contractual obligations, to secure our rights, and for the administrative tasks associated with this information, as well as for business organization. We only pass on the data of contract partners to third parties within the framework of applicable law to the extent that this is necessary for the aforementioned purposes or for the fulfillment of legal obligations, or with the consent of the contract partners (e.g., to involved telecommunication, transport, and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). Contract partners will be informed about further forms of processing, e.g., for marketing purposes, within this Privacy Policy.

We will inform the contract partners which data are required for the aforementioned purposes before or during data collection, e.g., in online forms, by special marking (e.g., colors) or symbols (e.g., asterisks or similar), or personally.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, e.g., as long as it must be retained for legal reasons of archiving (e.g., for tax purposes, generally 10 years). Data disclosed to us by the contract partner in the context of an order will be deleted by us in accordance with the order’s specifications, generally after the end of the order.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

Economic analyses and market research: For business reasons and to identify market trends, wishes of contract partners and users, we analyze the data available to us regarding business transactions, contracts, inquiries, etc., whereby the group of data subjects may include contract partners, prospective customers, customers, visitors, and users of our online offering.

The analyses are carried out for the purpose of business evaluations, marketing, and market research (e.g., to determine customer groups with different characteristics). In doing so, we may, if available, take into account the profiles of registered users including their details, e.g., regarding services used. The analyses serve only us and are not disclosed externally, unless they are anonymous analyses with aggregated, i.e., anonymized values. Furthermore, we respect the privacy of users and process the data for analysis purposes as pseudonymously as possible and, if feasible, anonymously (e.g., as aggregated data).

Online shop and e-commerce: We process the data of our customers to enable them to select, acquire, or order the chosen products, goods, and associated services, as well as their payment and delivery or execution.

The required information is marked as such within the order or comparable acquisition process and includes the information necessary for delivery, provision, and billing, as well as contact information to allow for any necessary consultation.

• Types of data processed: Inventory data (e.g., names, addresses), Payment data (e.g., bank details, invoices, payment history), Contact data (e.g., email, phone numbers), Contract data (e.g., subject matter of contract, term, customer category), Usage data (e.g., visited websites, interest in content, access times), Meta/communication data (e.g., device information, IP addresses).
• Data subjects: Prospective customers, Business and contract partners, Customers.
• Purposes of processing: Contractual services and support, Contact inquiries and communication, Office and organizational procedures, Management and response to inquiries, Visit action evaluation, Interest-based and behavioral marketing, Profiling (creating user profiles), Security measures.
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), Legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

We use blogs or comparable means of online communication and publication (hereinafter “publication medium”). The data of readers are processed for the purposes of the publication medium only to the extent necessary for its presentation and communication between authors and readers or for security reasons. For the rest, we refer to the information on the processing of visitors to our publication medium within these data protection notices.

Comments and contributions: If users leave comments or other contributions, their IP addresses may be stored based on our legitimate interests. This is for our security, in case someone leaves unlawful content in comments and contributions (insults, prohibited political propaganda, etc.). In this case, we ourselves could be held liable for the comment or contribution and are therefore interested in the identity of the author.

Furthermore, we reserve the right to process user data for spam detection purposes based on our legitimate interests.

On the same legal basis, we reserve the right to store the IP addresses of users for the duration of surveys and to use cookies to prevent multiple votes.

The personal information, any contact and website information, as well as the content details provided within the scope of comments and contributions, are permanently stored by us until the user objects.

• Types of data processed: Inventory data (e.g., names, addresses), Contact data (e.g., email, phone numbers), Content data (e.g., text entries, photographs, videos), Usage data (e.g., visited websites, interest in content, access times), Meta/communication data (e.g., device information, IP addresses).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: Contractual services and support, Feedback (e.g., collecting feedback via online form), Security measures, Management and response to inquiries.
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR), Consent (Art. 6 para. 1 sentence 1 lit. a GDPR), Protection of vital interests (Art. 6 para. 1 sentence 1 lit. d GDPR).

When contacting us (e.g., via contact form, email, phone, or social media), the information of the inquiring persons is processed to the extent necessary to answer the contact inquiries and any requested measures.

The response to contact inquiries within the framework of contractual or pre-contractual relationships is made for the fulfillment of our contractual obligations or to answer (pre-)contractual inquiries, and otherwise on the basis of legitimate interests in answering the inquiries.

• Types of data processed: Inventory data (e.g., names, addresses), Contact data (e.g., email, phone numbers), Content data (e.g., text entries, photographs, videos).
• Data subjects: Communication partners.
• Purposes of processing: Contact inquiries and communication.
• Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

We use messenger services for communication purposes and therefore ask you to observe the following information regarding the functionality of messengers, encryption, the use of communication metadata, and your objection options.

You can also contact us through alternative channels, e.g., via phone or email. Please use the contact options provided to you or those specified within our online offering.

In the case of end-to-end encryption of content (i.e., the content of your message and attachments), we point out that the communication content (i.e., the content of the message and attached images) is end-to-end encrypted. This means that the content of the messages cannot be viewed, not even by the messenger providers themselves. You should always use an up-to-date version of the messenger with encryption activated to ensure the encryption of message content.

However, we also inform our communication partners that although the messenger providers cannot view the content, they can find out that and when communication partners communicate with us, and technical information about the communication partners’ device used and, depending on their device settings, also location information (so-called metadata) is processed.

Notes on legal bases: If we ask communication partners for permission before communicating with them via messenger, the legal basis for our processing of their data is their consent. Otherwise, if we do not ask for consent and you, for example, contact us on your own initiative, we use messengers in relation to our contractual partners and in the context of pre-contractual steps as a contractual measure, and in the case of other interested parties and communication partners on the basis of our legitimate interests in fast and efficient communication and in meeting our communication partners’ needs for communication via messengers. We also inform you that we will not transmit the contact details you provide to the messenger services for the first time without your consent.

Withdrawal, objection and deletion: You may withdraw any consent you have given at any time and object to communication with us via messenger at any time. In the case of communication via messenger, we delete messages in accordance with our general deletion policies (i.e., for example, as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise as soon as we can assume that any information requests from communication partners have been answered, provided that no reference to a previous conversation is to be expected and no statutory retention obligations prevent deletion.

Reservation of the right to refer you to other communication channels: Finally, we would like to point out that, for your security, we reserve the right not to respond to inquiries via messenger. This is the case, for example, if internal contractual matters require special confidentiality or if a reply via messenger does not meet formal requirements. In such cases, we will refer you to more suitable communication channels.

• Types of data processed: Contact data (e.g., email, phone numbers), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Communication partners.
• Purposes of processing: Contact requests and communication, direct marketing (e.g., by email or post).
• Legal bases: Consent (Art. 6(1) sentence 1 lit. a GDPR), legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Services and service providers used:

• Facebook Messenger: Facebook Messenger with end-to-end encryption (end-to-end encryption in Facebook Messenger requires activation if it is not enabled by default); service provider: https://www.facebook.com, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA; website: https://www.facebook.com; privacy policy: https://www.facebook.com/about/privacy; Privacy Shield (ensuring an adequate level of data protection when processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active; option to object (opt-out): https://www.facebook.com/settings?tab=ads.
• WhatsApp: WhatsApp Messenger with end-to-end encryption; service provider: WhatsApp Inc. WhatsApp Legal 1601 Willow Road Menlo Park, California 94025, USA; website: https://www.whatsapp.com/; privacy policy: https://www.whatsapp.com/legal; Privacy Shield (ensuring an adequate level of data protection when processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000TSnwAAG&status=Active

The surveys and questionnaires we conduct (hereinafter “surveys”) are evaluated anonymously. Personal data is processed only to the extent necessary to provide and technically carry out the surveys (e.g., processing the IP address to display the survey in the user’s browser or using a temporary cookie (session cookie) to enable the survey to be resumed) or if users have consented.

Notes on legal bases: If we ask participants for consent to process their data, this is the legal basis for processing; otherwise, participants’ data is processed on the basis of our legitimate interests in conducting an objective survey.