Privacy Policy

We are pleased that you are interested in our websites and online shop. The protection of your personal data is important to us. Below, we inform you about which personal data we process when you use our web-sites and online shop, the purposes for which this is done and the rights to which you are entitled.

1. Scope

This Privacy Policy applies to the following websites and online services operated by Trend-Design GmbH, including their respective language and country versions and, where applicable, their www variants:

• coiffeur.fashion
• friseurumhang.de
• frisørenkappe.dk
• klippkappa.se
• meinfriseurmagazin.de
• salon.fashion
• salonbrand.shop
• trend-design.cloud
• trend-design.com
• trend-design.de
• trend-design.eu
• trend-design.shop
• umhangspezialisten.de

Where different functions, services or technologies are used on individual websites or in our online shop, we expressly indicate in the respective sections which website or domain the relevant data processing applies to.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is: Trend-Design GmbH Goebenstr. 66 D-32051 Herford Tel. +49 (0) 5221 54900 Email: info@trend-design.com

3. General information on data processing

We process personal data only insofar as this is necessary to provide our websites and online shop, process orders, communicate with you, fulfil legal obligations, protect our legitimate interests or on the basis of your consent. Personal data is processed in particular on the basis of Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (per-formance of a contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interests). Where information is stored on or read from your device, we additionally comply with Section 25 TDDDG. We delete personal data as soon as the respective processing purpose no longer applies and there are no stat-utory retention obligations or legitimate reasons for retention to the contrary. Statutory retention obliga-tions under commercial and tax law may apply in particular to order- and accounting-related documents.

4. Provision of the website, hosting and server log files

When you access our website, the web server automatically processes information transmitted by your brows-er. This may include, in particular, your IP address, date and time of access, pages/files accessed, amount of data transferred, referrer URL, browser type and version, operating system and requesting provider. The processing is carried out to provide the website technically, ensure stability and security, detect mis-use and rectify errors. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and function-al operation of the websites. Server log files are processed exclusively to ensure technical operation, IT security and error analysis. In particu-lar, IP address, date and time of access, pages accessed, browser information, operating system, referrer URL and technical log data are processed. Log files are deleted or anonymised after the applicable retention period has expired, unless longer storage is required to investigate security incidents or due to statutory obligations. Our websites are hosted by Mittwald CM Service GmbH & Co. KG Königsberger Straße 4–6 32339 Espelkamp The data processing carried out as part of hosting takes place exclusively in data centres in Germany. We have concluded a data processing agreement with the hosting provider in accordance with Art. 28 GDPR.

4.1 Wordfence Security

On our WordPress websites, we use Wordfence Security provided by Defiant, Inc. Attn: Legal Department 1700 Westlake Ave N Ste 200 Seattle, WA 98109 USA Wordfence is used to protect our websites against cyber attacks, malware, unauthorised access and other security threats. For this purpose, access to our websites is analysed and suspicious or harmful access may be blocked. Depending on the functions activated, this may include in particular IP and proxy IP addresses, URLs ac-cessed, HTTP headers and HTTP request data, the email address of the website administrator and, where appli-cable, usernames and email addresses of website users and file names in the event of detected malware. The legal basis for processing is Art. 6(1)(f) GDPR. Our legitimate interest consists in ensuring the security, in-tegrity and functionality of our websites and in detecting and preventing cyber attacks and other abusive access. Firewall and security logs, in particular data relating to IP addresses, access attempts and login attempts, are stored for 30 days according to our current configuration. Scan results are stored until they are overwritten by subsequent scan results or manually deleted. Data relating to blocking entries is stored for as long as re-quired for the relevant security function, depending on the configuration and type of entry. Temporary blocks are lifted once the configured blocking period has expired; permanently configured blocks remain in place until manually removed. We have concluded a data processing agreement with Defiant, Inc. in accordance with Art. 28 GDPR. Per-sonal data may be processed in the USA and, through sub-processors engaged by Defiant, in other countries. Trans-fers to third countries are based on the Standard Contractual Clauses approved by the European Commis-sion in accordance with Art. 46 GDPR. In addition, the safeguards provided for in the provider's Data Processing Addendum are applied. Where personal data is transferred to Defiant as part of the service, it is generally retained in accordance with the Data Processing Addendum for the duration of the contractual relationship plus one month and sub-sequently deleted or anonymised, unless statutory obligations or technical reasons prevent this. Further information on data processing can be found in the Privacy Policy and the Data Processing Addendum of Wordfence.

5. Cookies, similar technologies and consent management

Our websites use cookies and similar technologies. Cookies are small text files stored on your device. Simi-lar technologies may include, for example, Local Storage, pixels or scripts. We use technically necessary cookies and technologies to ensure that our websites and online shop func-tion properly, for example for the shopping basket, login, language settings, security functions and order pro-cessing. The legal basis for processing is Art. 6(1)(b) or (f) GDPR. In accordance with Section 25(2) TDDDG, no consent is required for access to your device insofar as the technologies used are strictly necessary. We use non-essential cookies and similar technologies, in particular for analytics, marketing or conven-ience functions and external content, exclusively on the basis of your prior consent in accordance with Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw or change your consent at any time via the cookie settings on the respective website, with effect for the future. Further information on the cookies used, the respective providers, the purposes of processing and storage periods can be found in the cookie settings of the respective website. You can change the cookie settings here: Trend-Design Shop: https://trend-design.shop/cookie/offcanvas Trend-Design.com https://trend-design.com/de/cookies/

6. Customer account, registration and orders in the online shop

If you create a customer account or place an order in our online shop (trend-design.shop), we process the data required for this purpose. Depending on the process, this includes in particular your name, address, billing and delivery address, email address, telephone number, customer number, customer account login details, order data, payment method, billing data and other communication data relating to your order. Mandatory information is marked as such. Without this information, we cannot provide a customer account or process an order. The legal basis is Art. 6(1)(b) GDPR. Where we store data to fulfil statutory retention obliga-tions, the legal basis is Art. 6(1)(c) GDPR. You may request deletion of your customer account from us at any time. However, deletion is only possi-ble insofar as we no longer need the relevant data for contract processing, compliance with legal obligations or the assertion, exercise or defence of legal claims.

7. Payment processing

For payment processing, we transfer the data required for this purpose to the payment service provider se-lected by you, the participating credit institution or the respective payment provider. The legal basis is Art. 6(1)(b) GDPR. We offer the following payment methods: Payment service provider PayPal (Europe) S.à r.l. et Cie, S.C.A. Depending on the respective country, PayPal may offer the following payment methods in particular:

• PayPal
• PayPal Pay Later
• Apple Pay
• Google Pay
• Credit and debit card
• SEPA Direct Debit
• Bancontact
• BLIK
• eps
• iDEAL
• Multibanco
• OXXO
• Przelewy24

Direct payment methods

• Invoice
• Payment in advance after order confirmation
• Payment upon collection

For payment methods where you are redirected to the payment service provider's website or enter your pay-ment details directly there, the respective payment service provider is responsible for processing your person-al data. We generally only receive information as to whether a payment has been successfully complet-ed and the payment references required to allocate the payment. Information from the payment service providers on data processing can be found at: https://www.paypal.com/de/legalhub/paypal/privacy-full

8. Shipping and delivery

To fulfil the contract concluded with you, we transfer the personal data required for delivery to the ap-pointed shipping service provider. This includes in particular your name, delivery address and shipment data required for delivery. The legal basis for processing is Art. 6(1)(b) GDPR. We use the following shipping service provider in particular to dispatch our goods: United Parcel Service Deutschland S.à r.l. & Co. OHG (UPS) Where necessary for delivery, we also transmit your email address and/or telephone number to the ship-ping service provider so that they can inform you about the shipping status, announce the delivery or coordi-nate delivery with you. The legal basis for processing is Art. 6(1)(b) GDPR. Further information on data processing by UPS can be found at: https://www.ups.com/de/de/support/shipping-support/legal-terms-conditions/privacy-notice.page

9. Contact form, email and other enquiries

If you contact us via contact form, email, telephone or other means, we process the personal data you provide for the purpose of handling your enquiry. This includes in particular your name, contact details, the content of your message and other information that you voluntarily provide to us as part of your enquiry. The legal basis for processing is Art. 6(1)(b) GDPR insofar as your enquiry relates to an existing or intended con-tractual relationship. In all other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in handling your enquiry and communicating with you. We delete the personal data processed as part of your enquiry as soon as your enquiry has been conclusive-ly dealt with and there are no statutory retention obligations or other legitimate reasons preventing dele-tion.

9.1 Microsoft 365

For business communication and the storage and exchange of documents, we use Microsoft 365 services pro-vided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopard-stown, Dublin 18, Ireland. These include in particular Exchange Online (email), OneDrive for Business, Microsoft Teams and Share-Point Online. As part of these services, we process in particular contact, communication, contractual and business data of customers, suppliers, prospective customers and other business partners. This includes, for example, emails, enquiries, orders, order confirmations, invoices, shipping information, correspondence and other business-related documents. The processing is carried out to take pre-contractual measures and fulfil contracts in accordance with Art. 6(1)(b) GDPR and to protect our legitimate interests in secure and efficient business communication, collabora-tion and document management in accordance with Art. 6(1)(f) GDPR. According to the settings of our Microsoft 365 tenant, Germany is currently specified as the data location for Exchange Online, Microsoft Teams, OneDrive and SharePoint. According to the settings of our Microsoft 365 tenant, data for Exchange Online, Microsoft Teams, OneDrive and SharePoint is stored in Germany. We have concluded a data processing agreement with Microsoft in accordance with Art. 28 GDPR. Where per-sonal data is processed outside the European Union (EU) or the European Economic Area (EEA) in individual cases, this is carried out exclusively in compliance with the requirements of Art. 44 et seq. GDPR. Further information on data protection at Microsoft can be found at: https://www.microsoft.com/de-de/privacy/privacystatement

10. Newsletter and email advertising

If you subscribe to our newsletter, we process your email address and, where applicable, other voluntary in-formation such as your name or form of address. Registration is generally carried out using the double opt-in procedure. After registration, you will receive an email asking you to confirm your subscription. We store the time of regis-tration, the time of confirmation and the IP addresses used in this process in order to be able to prove your consent. Rapidmail provides this double opt-in verification data for registration forms. The legal basis for sending the newsletter is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future via the unsubscribe link in the newsletter or by notifying us. The lawfulness of processing carried out on the basis of your consent up to the time of withdrawal remains unaffected. If we have received your email address in connection with the sale of goods or services, we may use it to ad-vertise our own similar goods or services, provided that the requirements of Section 7(3) UWG are met and you have not objected to such use. The legal basis for processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in direct advertising to existing customers. You may object to this use at any time without incurring costs other than the transmission costs according to the basic rates. For sending our newsletter, we use the services of Positive Group Deutschland GmbH (rapidmail) Ingeborg-Krummer-Schroth-Straße 18a 79106 Freiburg im Breisgau Germany Rapidmail processes the data required for newsletter distribution on our behalf. This may include in particu-lar the email address, voluntarily provided master data, double opt-in verification data, dispatch status and infor-mation about deliveries, unsubscribes and undeliverable emails. Open and click tracking is disabled in our rapidmail account. Therefore, no personal data is collected regard-ing whether you open a newsletter or which links contained in it you click. According to rapidmail, data processing takes place on servers in Germany. We have concluded a data pro-cessing agreement with rapidmail in accordance with Art. 28 GDPR. After unsubscribing from the newsletter, your data will be deleted from the newsletter distribution list unless statutory retention obligations or other legitimate reasons prevent deletion. Data required to prove that con-sent was given may additionally be stored for the duration of the statutory limitation periods. Further information on data protection at rapidmail can be found at: https://www.rapidmail.de/datenschutz

11. Postal advertising

We may use your name and postal address to send you information about our products, services or offers by post. The legal basis for processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in direct advertising to our cus-tomers and business partners. You may object to the processing of your personal data for the purpose of direct advertising at any time with effect for the future.

12. Analytics, marketing and security services

We use various analytics, marketing and security services on our websites and in our online shop to analyse the use of our online services, ensure their functionality and security, and optimise our content and advertising measures. Where cookies or similar technologies are used or personal data is processed for this purpose, this is carried out – unless otherwise stated in the respective subsection – exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future via the cookie settings of the respective website.

12.1 Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on all websites operated by Trend-Design GmbH and in the online shop. Google Ana-lytics is used for the statistical analysis of the use of our online services and their optimisation. IP address anonymisation is activated by default in Google Analytics 4. Due to IP anonymisation, your IP address is shortened by Google within Member States of the European Union or in other contracting states of the Agreement on the European Economic Area. Google Analytics 4 processes the IP address when the re-quest is technically received, but according to Google does not store or log it as an individual IP address. Ap-proximate location data may in particular be derived from the information transmitted for technical purposes. According to Google, the IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. During your visit to the website, your user behaviour is recorded in the form of “events”. Events may in-clude:

• Page views
• First visit to the website
• Start of a session
• Websites visited
• Your “click path”, interaction with the website
• Scrolls (whenever a user scrolls to the end of the page (90%))
• Clicks on external links
• Internal searches
• Interaction with videos
• File downloads
• Ads viewed / clicked
• Language setting

In addition, the following is recorded:

• Your approximate location (region)
• Date and time of the visit
• Your IP address (in shortened form)
• Technical information about your browser and the devices you use (e.g. language setting, screen resolu-tion)
• Your internet service provider
• The referrer URL (the website / advertising medium through which you arrived at this web-site)

Purposes of processing On behalf of the operator of this website, Google will use this information to evaluate your use of the website and compile reports on website activity. The reports provided by Google Analytics are used to analyse the performance of our website and the success of marketing campaigns. Recipients

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor pursuant to Art. 28 GDPR)
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
• Alphabet Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Third-country transfer For the USA, the European Commission adopted its adequacy decision on 10 July 2023. Google LLC is certi-fied under the EU-US Data Privacy Framework. Where personal data is processed outside the European Union or the European Economic Area, this is carried out on the basis of the EU-US Data Privacy Framework and, addi-tionally, the Standard Contractual Clauses approved by the European Commission. Storage period The retention period we have configured for user- and event-related data in Google Analytics is two months. This setting does not apply to the standard aggregated reports. The lifetime of cookies set by Google Analytics may be up to two years, depending on the specific configuration and settings of the device. Withdrawal You may withdraw your consent at any time with effect for the future by accessing the cookie settings Cookie Consent Trend-Design Shop and Cookie Consent Wordpress and changing your selection there. The lawfulness of processing carried out on the basis of consent up to the time of withdrawal remains unaffected. Further information about Google Analytics and data protection at Google can be found at: https://marketingplatform.google.com/about/analytics/terms/de/ https://policies.google.com/privacy https://business.safety.google/intl/de/gdpr/

12.2 Google Ads / Remarketing

We use Google Ads and the remarketing functions of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This enables interest-based advertisements to be displayed to users who have visited our websites and allows the success of our advertising measures to be measured. Cookies and similar technologies may be used for this purpose and personal data may be processed, in particu-lar pseudonymous identifiers, usage data and information about your interactions with our online ser-vices. Where personal data is processed outside the European Union (EU) or the European Economic Area (EEA), this is carried out on the basis of the EU-US Data Privacy Framework, provided that Google is certified for the re-spective service. Standard Contractual Clauses may also apply. Further information on data protection at Google can be found at: https://policies.google.com/privacy https://business.safety.google/intl/de/gdpr/

12.3 Google reCAPTCHA

To protect our forms against abusive automated input (spam), we use the Google reCAPTCHA service provid-ed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google reCAPTCHA is used to determine whether entries in our forms are made by a human or automati-cally. For this purpose, Google processes in particular the IP address, information about the device and browser used, language settings and other technical information required to detect abusive or automated access. Per-sonal data may also be transmitted to Google LLC in the USA. Google reCAPTCHA is used to protect our website and online services against misuse and to ensure the securi-ty and functionality of our forms. The legal basis for processing is Art. 6(1)(f) GDPR. Our legitimate interest con-sists in preventing spam, preventing abusive automated access and securely providing our online ser-vices. Where personal data is transferred to the USA, this is carried out on the basis of the European Commis-sion's adequacy decision for the EU-US Data Privacy Framework, provided that Google is certified for the re-spective service. Standard Contractual Clauses may also apply. Further information on data protection at Google can be found at: https://policies.google.com/privacy https://business.safety.google/intl/de/gdpr/

13. Social media and external communication services

On our websites, we provide links to our Facebook and Instagram profiles as well as a contact option via WhatsApp. Simply accessing our websites does not result in personal data being transmitted to the respective provid-ers as a result of these links. Only when you actively click on a corresponding link will you be redirected to the respective service. From this point onwards, the respective provider processes personal data under its own responsibility. The respective provider's privacy policy then applies. Further information on data protection can be found at: Facebook: https://www.facebook.com/privacy/policy/ Instagram: https://privacycenter.instagram.com/policy WhatsApp: https://www.whatsapp.com/legal/privacy-policy

13.1 Company profiles on Facebook and Instagram

We maintain company profiles on Facebook and Instagram. The provider of these services for users within the European Union and the European Economic Area is: Meta Platforms Ireland Limited Merrion Road Dublin 4 D04 X2K5 Ireland When you visit our company profiles, send us a message, comment on a post or otherwise interact with our profiles or content, we process the personal data visible to us or provided by you in the process. This may in-clude in particular your profile name, profile picture, the content of your message or comment, the time of communication and other information provided by you. We process this data to maintain our company profiles, communicate with customers, prospective cus-tomers and business partners, respond to enquiries and present and promote our company and products. Where your contact relates to an existing or intended contractual relationship, processing is based on Art. 6(1)(b) GDPR. In all other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest consists in cor-porate communication, handling enquiries and presenting and promoting our company and products. We also use the advertising and analytics functions provided by Meta to display advertisements on Face-book and Instagram, determine their reach and evaluate the success of our content and advertising measures. Meta provides us in particular with statistical and generally aggregated analyses of the use of our profiles, con-tent and advertisements. When visiting or interacting with our company profiles, Meta also processes personal data under its own data protection responsibility. This may include in particular information about content accessed, interactions, mes-sages, devices, browsers, IP addresses and use of the platform. We have only limited influence over the nature and extent of data processing by Meta. Where Meta creates so-called Insights data for our company profiles, we and Meta Platforms Ireland Lim-ited may be jointly responsible for the processing required for this purpose. Under the agreement concluded with page operators, Meta is responsible in particular for providing data protection information and handling data subject rights with regard to Insights data. We delete messages and other enquiries from our own systems as soon as the respective communication has been completed and there are no statutory retention obligations or other legitimate reasons for further stor-age. We have no complete control over the independent storage and deletion of data by Meta. Meta may also process personal data outside the European Union or the European Economic Area. Further information on data processing by Meta as well as your rights and available settings can be found in Meta's Privacy Policy.

13.2 Instagram feed

In our online shop at trend-design.shop, we use the plugin “Instagram Elements – Instagram for Shopping Ex-periences” to display posts from our Instagram profile. The displayed content is retrieved server-side, temporarily cached on our systems and delivered through our online shop. When the Instagram feed is accessed, no direct connection is established between the visi-tor's device and Instagram or Meta servers. Therefore, simply displaying the posts does not transmit any per-sonal data of visitors to Instagram or Meta. If you click on a post contained in the feed or on the “View on Instagram” link, you will be redirected to Insta-gram. From this point onwards, the respective provider processes personal data under its own responsibil-ity. The legal basis for processing associated with providing the Instagram feed is Art. 6(1)(f) GDPR. Our legiti-mate interest consists in the appealing presentation of our company and products and in providing current content from our social media channel.

14. Recipients of data and processors

We only transfer personal data to external recipients where this is necessary to perform a contract or take pre-contractual measures, you have given your consent, there is a legal obligation or the transfer is based on an-other legal basis under data protection law, in particular to protect legitimate interests. Transfers are always limited to the extent necessary for the respective purpose. Depending on the processing involved, recipients or categories of recipients may include in particular hosting and IT service providers, Microsoft Ireland Operations Limited as part of the use of Microsoft 365 in-cluding Exchange Online, OneDrive, Microsoft Teams and SharePoint, payment service providers and credit institu-tions, shipping and logistics service providers, newsletter service providers, providers of analytics, mar-keting and security services, tax advisers, legal advisers and public authorities, insofar as there is a legal obliga-tion or authorisation to transfer the data. Depending on their respective function, these recipients process personal data either on our behalf or under their own data protection responsibility. Where a service provider processes personal data on our behalf, we conclude a data processing agreement with them in accordance with Art. 28 GDPR.

15. Transfers to third countries

Where we transfer personal data to recipients in countries outside the European Union (EU) or the Europe-an Economic Area (EEA), or where personal data is accessed from such countries, this only takes place if, in addi-tion to a legal basis for processing, the requirements of Art. 44 et seq. GDPR are met. Depending on the recipient and third country, we base transfers in particular on an adequacy decision by the European Commission, including the EU-US Data Privacy Framework for appropriately certified companies in the USA, or on appropriate safeguards pursuant to Art. 46 GDPR, in particular the Standard Contractual Clauses approved by the European Commission. Where required, additional safeguards are implemented. Further information on transfers to third countries in connection with the services used can be found in the relevant sections of this Privacy Policy. A copy of the applicable safeguards can be requested from info@trend-design.com.

16. Your rights

Subject to the statutory requirements, you have the right to obtain information about the personal data stored about you pursuant to Art. 15 GDPR, to have inaccurate data corrected or incomplete data completed pursuant to Art. 16 GDPR, to have data erased pursuant to Art. 17 GDPR, to have processing restricted pursuant to Art. 18 GDPR and to data portability pursuant to Art. 20 GDPR. Where we process personal data on the basis of Art. 6(1)(e) or (f) GDPR, you have the right under Art. 21 GDPR to object to the processing at any time on grounds relating to your particular situation. Where processing is based on your consent, you may withdraw this consent at any time with effect for the future. The lawfulness of processing carried out on the basis of your consent up to the time of withdrawal re-mains unaffected. Objection to direct marketing Where we process personal data for the purpose of direct marketing, you have the right to object at any time and without giving reasons to the processing of your personal data for this purpose. Following your objec-tion, we will no longer process your personal data for direct marketing purposes. To exercise your rights, it is sufficient to send a message to: info@trend-design.com

17. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedies, pursuant to Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR. In particular, you may contact a supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for our company is: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia Postfach 20 04 44 40102 Düsseldorf Email: poststelle@ldi.nrw.de https://www.ldi.nrw.de

18. Automated decision-making in individual cases

We do not carry out decision-making based solely on automated processing, including profiling, which produc-es legal effects concerning you or similarly significantly affects you.

19. Status and amendments to this Privacy Policy

Status of this Privacy Policy: 08.2026.