Privacy policy

Privacy Policy

1. Introduction and Controller

1.1 General information

Thank you for visiting our website and for your interest in our company. Below we inform you about how we handle your personal data in connection with your use of our website. Personal data means all information that allows you to be identified.

1.2 Controller within the meaning of the GDPR

The controller responsible for the processing of personal data on this website in accordance with the General Data Protection Regulation (GDPR) is:

TFK DermaCare GmbH
Landstrasse 117
9490 Vaduz
Liechtenstein
Phone: +41782089333
E-mail: support@tederm.li

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3 EU representative

A representative in the European Union has been appointed and can be contacted as follows: TFK DermaCare GmbH, Mathias Koch, Landstrasse 117, 9490 Vaduz.

2. Data collection when visiting the website

2.1 Server log files

When you use our website purely for information purposes – i.e. without registering or otherwise transmitting information – we only collect data that your web browser automatically transmits to our server (so-called "server log files"). When you access our website, the following technically necessary data is collected:

Website accessed
Date and time of access
Amount of data transferred in bytes
Source/reference from which you reached the page
Web browser used
Operating system used
IP address (where applicable in anonymised form)

This data processing is carried out on the basis of Art. 6(1)(f) GDPR, based on our legitimate interest in optimising the stability and functionality of our website. The data is not passed on or otherwise used. We reserve the right to check the server log files retrospectively if there are concrete indications of unlawful use.

2.2 SSL/TLS encryption

For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries), our website uses SSL or TLS encryption. You can recognise an encrypted connection by the character string "https://" and the padlock symbol in your browser bar.

3. Hosting & Content Delivery Network

3.1 Amazon Web Services

For hosting our website and delivering content, we use the services of Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA.

All data collected on our website is processed on this provider's servers. We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and excludes any unauthorised disclosure to third parties.

For data transfers to the USA, the provider has certified under the EU-US Data Privacy Framework, which, by way of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

3.2 Shopify

For hosting our website and displaying content, we use the platform of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify").

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

3.3 AWS CloudFront

We use a Content Delivery Network (CDN) provided by Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA.

This service enables us to deliver large media files such as graphics, content or scripts more quickly via a network of regionally distributed servers. The processing is carried out to safeguard our legitimate interest in optimising the stability and functionality of our website in accordance with Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and excludes any unauthorised disclosure to third parties.

3.4 Shopify CDN

We use a Content Delivery Network (CDN) provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify").

Data may also be transferred to:

Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission. For data transfers to the USA, the data recipient has certified under the EU-US Data Privacy Framework, which, by way of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

4. Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies – i.e. small text files that are stored on your device. Some of these cookies are automatically deleted after you close your browser (so-called "session cookies"), while others remain on your device for longer and store page settings (so-called "persistent cookies"). For persistent cookies, you can view the storage period in the cookie settings of your web browser.

Insofar as personal data is also processed by individual cookies we use, the processing is carried out in accordance with Art. 6(1)(b) GDPR for the performance of a contract, in accordance with Art. 6(1)(a) GDPR where consent has been given, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the optimal functionality of the website and a user-friendly and efficient design of your visit.

You can configure your browser so that you are informed about the setting of cookies and can decide individually whether to accept them, or refuse the acceptance of cookies for certain cases or generally. In addition, you can withdraw your consent to non-essential cookies at any time with effect for the future via the cookie settings on our website.

Please note that the functionality of our website may be limited if cookies are not accepted.

5. Contacting us

5.1 Judge.me

For review reminders we use the services of Judge.me Ltd., c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB, United Kingdom.

Exclusively on the basis of your express consent in accordance with Art. 6(1)(a) GDPR, we transmit your e-mail address and, where applicable, further customer data to this provider so that it can contact you by e-mail with a review reminder.

You can withdraw your consent at any time with effect for the future, either towards us or towards the provider.

We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and excludes any unauthorised disclosure to third parties.

For data transfers to the provider's location, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

5.2 Contact form

If you send us enquiries via our contact form, your details from the enquiry form, including the contact data you provide there, will be stored by us for the purpose of processing your enquiry and in case of follow-up questions. The processing of this data is carried out on the basis of Art. 6(1)(b) GDPR if your enquiry is connected with the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us in accordance with Art. 6(1)(f) GDPR, or on your consent in accordance with Art. 6(1)(a) GDPR where this was requested.

The data you enter in the contact form will remain with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. after your enquiry has been dealt with). Mandatory statutory provisions – in particular retention periods – remain unaffected.

6. Data processing upon conclusion of a contract

6.1 Processing of customer data

We collect, process and use personal data only insofar as it is necessary for the establishment, content-related structuring or amendment of the legal relationship (inventory data). This is carried out on the basis of Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures. We collect, process and use personal data concerning the use of our website (usage data) only insofar as this is necessary to enable the user to use the service or to invoice it.

The customer data collected will be deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

6.2 Transfer of data to shipping service providers

If you have given us your express consent in accordance with Art. 6(1)(a) GDPR as part of your order, we transmit your e-mail address to the selected shipping service provider so that it can inform you by e-mail about the shipping status of your order before delivery of the goods.

You can withdraw your consent at any time with effect for the future, either towards us or towards the shipping service provider.

7. Payment service providers

7.1 Shopify Payments (Stripe)

If you select a payment method offered via the "Shopify Payments" payment service, payment is processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. To process payments, Stripe may make use of further payment services.

The data processing serves the purpose of payment processing and is carried out on the basis of Art. 6(1)(b) GDPR (performance of a contract). The data transmitted may include inventory data (e.g. name, address), payment data (e.g. bank details, credit card numbers) and order data (e.g. invoice number, invoice amount).

For data transfers to third countries, a data processing agreement pursuant to Art. 28 GDPR has been concluded with the payment service provider and, where applicable, the Standard Contractual Clauses of the European Commission have been agreed.

Further information on "Shopify Payments" can be found at: https://www.shopify.com/legal/terms-payments-de

8. Newsletter and e-mail marketing

8.1 Sending our newsletter with Klaviyo

On our website you have the option to subscribe to our free newsletter. To send our newsletter and manage our subscribers, we use the services of Klaviyo, Inc., 125 Summer Street, Boston, Massachusetts 02110, USA ("Klaviyo").

We use the so-called double opt-in procedure for newsletter registration. This means that, after you register, we send an e-mail to the address you provided asking you to confirm that you wish to receive the newsletter. We only add your e-mail address to our distribution list once you have confirmed. We log your registration and confirmation (in each case the time and IP address) in order to be able to demonstrate your consent.

As part of sending the newsletter, we process your e-mail address as well as your first and last name. To design and optimise our newsletter, we also analyse whether and when newsletters are opened and which links they contain are clicked.

This processing is carried out on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by unsubscribing via the unsubscribe link contained in every e-mail or by sending us a corresponding message. The lawfulness of processing already carried out remains unaffected by the withdrawal.

8.2 Onsite tracking by Klaviyo

Klaviyo also uses cookies and similar technologies (including "__kla_id") to record your behaviour on our website, to recognise you on a return visit and to link this information to your profile. This enables us to send you content and marketing messages tailored to your interests (e.g. reminders about uncompleted orders).

These technologies are used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TTDSG. You may withdraw your consent at any time with effect for the future via our cookie settings.

We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and excludes any unauthorised disclosure to third parties. For data transfers to the USA, the provider has certified under the EU-US Data Privacy Framework, which, by way of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

For further information, please see Klaviyo's privacy notice at: https://www.klaviyo.com/legal/privacy/privacy-notice

9. Web analytics and advertising

9.1 Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Analytics uses cookies that enable an analysis of your use of the website. The information generated by the cookies about your use of this website is generally transmitted to a Google server in the USA and stored there.

On this website, IP anonymisation is activated, so that your IP address is truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before transmission.

The use of Google Analytics is based on your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TTDSG. You may withdraw your consent at any time with effect for the future.

For data transfers to the USA, Google has certified under the EU-US Data Privacy Framework, which, by way of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

Further information on Google Analytics can be found at: https://policies.google.com/privacy

9.2 Google Ads and conversion tracking

This website uses Google Ads, an online advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

As part of Google Ads, we use conversion tracking. When you click on an ad placed by Google, a cookie is set for conversion tracking. These cookies expire after 30 days and are not used for personal identification.

Enhanced Conversions: In addition, we use the "Enhanced Conversions" feature. When you carry out a conversion (e.g. complete a purchase), data provided by you – in particular your e-mail address – is transmitted to Google in irreversibly encrypted (hashed) form and matched there with signed-in Google accounts in order to measure the success of our advertising more accurately and to attribute conversions correctly.

Google Consent Mode: We use Google Consent Mode. This controls the behaviour of the Google services used – in particular the setting of cookies and the transmission of data to Google – depending on the consent granted or refused via our cookie banner.

The use of Google Ads and Enhanced Conversions is based on your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TTDSG. You may withdraw your consent at any time with effect for the future.

Further information on Google Ads can be found at: https://policies.google.com/privacy

9.3 Meta Pixel (Facebook Pixel), Advanced Matching and Conversions API

This website uses the Meta Pixel (formerly Facebook Pixel) provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta").

With the Meta Pixel, we can address visitors to our website as a target group for the display of advertisements (so-called "Facebook Ads"). The Meta Pixel enables us to track the effectiveness of our Facebook advertisements for statistical and market research purposes.

Advanced Matching: Where you have consented, the Meta Pixel transmits to Meta, in addition to the standard information, certain data you have entered with us (e.g. e-mail address, name, address) in irreversibly encrypted (hashed) form. This serves to attribute website events to your Meta account and to improve the attribution and measurement of conversions.

Conversions API: In addition to the Meta Pixel, we use the Meta Conversions API. In this process, event and interaction data is transmitted to Meta not exclusively via your browser, but additionally server-side directly from our server or the Shopify server used. Events recorded on the browser side and server side are merged (deduplicated) via a shared event identifier in order to avoid double counting. Personal data (e.g. hashed e-mail address, IP address, browser and order information) may also be processed within the framework of the Conversions API.

The use of the Meta Pixel, Advanced Matching and the Conversions API is based on your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TTDSG. You may withdraw your consent at any time with effect for the future.

For data transfers to the USA, Meta has certified under the EU-US Data Privacy Framework, which, by way of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

Further information on Meta and Facebook Ads can be found at: https://www.facebook.com/privacy/explanation

9.4 TikTok Pixel

This website uses the TikTok Pixel provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

With the TikTok Pixel, we can address visitors to our website as a target group for the display of advertisements on TikTok. The TikTok Pixel enables us to track the effectiveness of our TikTok advertisements.

The use of the TikTok Pixel is based on your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TTDSG. You may withdraw your consent at any time with effect for the future.

For data transfers to the USA, TikTok has certified under the EU-US Data Privacy Framework, which, by way of an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

Further information can be found in TikTok's privacy policy: https://www.tiktok.com/legal/privacy-policy

9.5 Microsoft Clarity

This website uses Microsoft Clarity, an analytics service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland ("Microsoft"). In this context, data may also be transferred to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA.

Using Microsoft Clarity, the movements and interactions of visitors on our website are recorded and analysed in pseudonymised form by means of cookies (including "_clck", "_clsk") and similar technologies. In particular, mouse, scroll and click movements are captured, from which so-called heatmaps and session recordings ("session replays") are created. This enables us to understand how our website is used and to improve its design and usability. Entries in form fields are masked (rendered unrecognisable) by default.

The use of Microsoft Clarity is based on your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TTDSG. You may withdraw your consent at any time with effect for the future via our cookie settings.

For further information, please see Microsoft's privacy statement at: https://privacy.microsoft.com/en-us/privacystatement

10. Your rights as a data subject

10.1 Right of access

You have the right to obtain confirmation from us as to whether personal data concerning you is being processed. Where such processing is taking place, you can request information about this personal data and further information in accordance with Art. 15 GDPR.

10.2 Right to rectification

You have the right, in accordance with Art. 16 GDPR, to request the immediate rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data.

10.3 Right to erasure

You have the right, in accordance with Art. 17 GDPR, to request the immediate erasure of personal data concerning you, provided that one of the legally prescribed grounds applies.

10.4 Right to restriction of processing

You have the right, in accordance with Art. 18 GDPR, to request the restriction of the processing of your personal data if one of the legal requirements is met.

10.5 Right to data portability

You have the right, in accordance with Art. 20 GDPR, to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us.

10.6 Right to object

You have the right, in accordance with Art. 21 GDPR, to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR.

10.7 Withdrawal of consent

You have the right to withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the withdrawal.

10.8 Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. For data subjects in Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC).

11. Data security

We use technical and organisational security measures to protect the data we manage against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. Our security measures are continuously improved in line with technological developments.

12. Currency and amendment of this privacy policy

This privacy policy is currently valid. Due to the further development of our website and offers or as a result of changed statutory or official requirements, it may become necessary to amend this privacy policy. The privacy policy in force at any given time can be accessed and printed out by you at any time on the website.

(Date: 12.09.2026)