Privacy Policy
Last update: 28. August 2025
Thank you for your interest in the information on our website!
With the help of this Privacy Policy we would like to inform the users of our website about the type, scope and purpose of the personal data processed. Personal data in this context is all information that can be used to personally identify you as a user of our website (theoretically in an alternative way or by linking various data), including your IP address. Information that is stored in cookies is generally not or only in exceptional cases personally identifiable; however, cookies are covered by specific regulations that makes the permissibility of the use of cookies dependent on their purpose to a large extent on the active consent of the user.
In a general section of this Privacy Policy, we provide you with information on data protection, which generally applies to our processing of data, including data collection on our website. In particular, you as a data subject will be informed about the rights to which you are entitled.
The terms used in our Privacy Policy and our data protection practice are based on the provisions of the EU General Data Protection Regulation ("GDPR") and other relevant national legal provisions.
Controller according to the GDPR
Functional Health Concept GmbH
Fleischmarkt 17, 1010 Vienna Austria
Registration Number: FN 551999 p
Fleischmarkt 17, 18, 26
1010 Wien
Austria
e: service@biocannovea.com
t: +4318906117-301
Data collection on our website
On the one hand, personal data is collected from you when you expressly communicate such data to us, on the other hand, data, especially technical data, is automatically collected when you visit our website. Some of this data is collected to ensure that our website functions without errors. Other data may be used for analysis purposes. However, you can use our website without a need to provide personal information.
Technologies on our website
calendly
Provider: Calendly, LLC, BB&T Tower, 271 17th St NW, Atlanta, GA 30363, USA
Purpose: Organization of Appointments
Category: External Tool
Recipient: USA
Data processed: Email Address, User data, Contact Data
Data subjects: Users
Technology: Plugin
Legal basis: Legitimate Interest, EU-US Privacy Framework https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2z3d0000002GVgAAM&status=Active
Website: https://calendly.com/
Further information: https://calendly.com/privacy
We use the online calendar calendly on our website to request and select an appointment. This gives users the opportunity to make an appointment with us via our website.
As soon as calendly is loaded on a user's computer, the browser establishes a connection to calendly's servers in the USA. Through this, calendly obtains knowledge that our website was accessed via the IP address of a user.
As soon as a user presses the corresponding booking button at calendly, he or she is automatically connected to our appointment calendar at calendly. After selecting a desired appointment, confirming it and entering contact information and additional requests, a user receives an e-mail from calendly confirming the appointment. For this purpose, calendly uses the e-mail address of a user.
The information provided by a user in the calendly form, including the data provided there, is stored by us for the purpose of processing the request and in case of follow-up questions. This data remains with us until we are requested to delete it or the purpose for storing the data no longer applies (e.g. appointment made). Mandatory legal provisions - in particular retention periods - remain unaffected.
Cloudflare
Provider: Cloudflare, Inc, 101 Townsend St., San Francisco, CA 94107, USA
Representative in the EU: Cloudflare Portugal Unipessoal Lda, Praça Marquês de Pombal 14 7th floor, 1250-162 Lisboa, Portugal, DSA-legal-representative@cloudflare.com
Purpose: To measure and analyze website performance from the user's perspective
Category: Statistics
Recipient: USA
Processed data: Page load times, response times, web vitals metrics, URL, browser, operating system, country
Data subjects: Website visitors
Technology: JavaScript beacon, cookies (details in the cookie list)
Legal basis: Consent (purpose)
Certifications: EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework
Further information:
https://www.cloudflare.com/de-de/privacypolicy/
https://www.cloudflare.com/de-de/website-terms/
On our website, we use the Cloudflare Web Analytics service to measure and analyze website performance from the perspective of our users. This tool allows us to track and understand key performance metrics such as load times, responsiveness and visual stability of our website.
Cloudflare Web Analytics works by inserting a JavaScript snippet into HTML pages. This beacon collects data about the user experience, including metrics such as page load time, time to first byte and other web vitals. The tool also collects information about the browser used, the operating system and the user's country.
The collected data is updated in real time and is available shortly after a user request. This enables us to continuously monitor and improve the performance of our website. According to the manufacturer, Cloudflare Web Analytics does not use cookies for analysis purposes, but does use them to recognize users (identification cookie).
The data is stored for the duration of the statutory retention obligations and deleted immediately after this period has expired. Additional details can be found in the linked further information. We recommend that you check these links regularly for changes so that you are always informed about the current practices of Cloudflare Web Analytics.
Additional information on the rights of data subjects and the relevant contact details can be found in the general section of this privacy policy.
Cookies and Local Storage
We use cookies to make our website as user-friendly and functional as possible for you. Some of these cookies are stored on the device you use to access the site.
Cookies are small packages of data that are exchanged between your browser and our web server whenever you visit our website. They do not cause any damage and are used solely to recognise website visitors. Cookies can only store information provided by your browser, e.g. information that you have entered into your browser or that is available on the website. Cookies cannot execute code and cannot be used to access your terminal device.
The next time you access our website using the same device, the information stored in the cookies can then either be sent back to us (“first-party cookie”) or to a web application of third party to whom the cookie belongs (“third-party cookie”). The information that is stored and sent back allows each web application to recognise that you have already accessed and visited the website using the browser on your device.
Cookies contain the following information:
Cookie name
Name of the server from which the cookie originates
Cookie ID number
An expiry date, after which the cookie will be automatically deleted
We classify cookies in the following categories depending on their purpose and function:
Technically necessary cookies, to ensure the technical operation and basic functions of our website. These types of cookies are used, for example, to maintain your settings while you navigate our website; or they can ensure that important information is retained throughout the session (e.g. login, shopping cart).
Statistics cookies, to understand how visitors interact with our website by collecting and analysing information on an anonymous basis only. In this way we gain valuable insights to optimize both the website and our products and services.
Marketing cookies, to provide targeted promotional and marketing activities for users on our website.
Unclassified cookies are cookies that we are trying to classify together with individual cookie providers.
Depending on the storage period, we also divide cookies into session and persistent cookies. Session cookies store information that is used during your current browser session. These cookies are automatically deleted when the browser is closed. No information remains on your device. Persistent cookies store information between two visits to the website. Based on this information, you will be recognized as a returning visitor on your next visit and the website will react accordingly. The lifespan of a persistent cookie is determined by the provider of the cookie.
The legal basis for using technically necessary cookies is our legitimate interest in the technically fault-free operation and smooth functionality of our website. The use of statistics and marketing cookies is subject to your consent. You can withdraw your consent for the future use of cookies at any time. Your consent is voluntary. If consent is not given, no disadvantages arise. For more information about the cookies we actually use (specifically, their purpose and lifespan), refer to this Privacy Policy and to the information in our cookie banner about the cookies we use.
You can also set your web browser so that it does not store any cookies in general on your device or so that you will be asked each time you visit the site whether you accept the use of cookies. Cookies that have already been stored can be deleted at any time. Refer to the Help section of your browser to learn how to do this.
Please note that a general deactivation of cookies may lead to functional restrictions on our website.
On our website, we also use so-called local storage functions (also called "local data"). This means that data is stored locally in the cache of your browser, which continues to exist and can be read even after you close the browser - as long as you do not delete the cache or data is stored within the session storage.
Third parties cannot access the data stored in the local storage. If special plug-ins or tools use the local storage functions, you are informed within the description of the respective plug-in or tool.
If you do not wish plug-ins or tools to use local storage functions, you can control this in the settings of your respective browser. We would like to point out that this may result in functional restrictions.
Google Analytics
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, e-mail: support-de@google.com
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Purpose: Web analysis, performance measurement, conversion tracking, collection of statistical data
Category: Statistics
Recipient: EU, USA
Processed data: IP address, details of the website visit, user data
Data subjects: Website visitors
Technology: JavaScript call, cookies (details in the cookie list), fingerprinting, local storage
Legal basis: Consent (purpose)
Certifications: EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework
Further information:
https://policies.google.com/privacy
https://safety.google/intl/de/principles/
https://business.safety.google/privacy/
https://business.safety.google/adsprocessorterms/
Here you can find out exactly where Google data centers are located: https://www.google.com/about/datacenters/locations/
On our website, we use the functions of the web analysis service Google Analytics to analyze user behavior and to optimize our website. The reports provided by Google are used to analyze the performance of our website and to measure the success of possible campaigns via our website.
Google Analytics uses cookies that enable us to analyze the use of our website. All details (name, purpose, storage duration) of the cookies can be found in our specific list of cookies used.
Google Analytics can use local storage. This is an alternative to using cookies to store the client ID. This makes it possible to track user behavior without setting cookies.
Information about the use of the website such as browser type/version, operating system used, the previously visited page, host name of the accessing computer (IP address), time of the server request are usually transmitted to a Google server and stored there. We have concluded a contract with Google for this purpose.
Google will use this information on our behalf to evaluate the use of our website, to compile reports on the activities within our website and to provide us with further services associated with the use of our website and the Internet.
We only use Google Analytics with IP anonymization activated by default. This means that the IP address of a user is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. According to Google, the IP address transmitted by a user's browser as part of Google Analytics is not linked to other Google data.
During the website visit, user behavior is recorded in the form of so-called events. These can be the following:
Page views, the click path of a user
First visit to our website
Websites visited
Start of a session
Interaction with our website
User behavior (e.g. clicks, scrolls, dwell time, bounce rates)
File downloads
Viewed / clicked ads
Interaction with videos
internal search queries
is also recorded:
approximate location (region)
Date and time of the visit
IP address (in abbreviated form)
technical information about the browser or the end devices used (e.g. language setting, screen resolution)
Internet provider
Referrer URL (via which website/advertising medium a user came to our website)
This data is essentially processed by Google for its own purposes, such as profiling (without us being able to influence this).
The data on the use of our website will be deleted immediately after the end of the retention period set by us. Google Analytics specifies a standard retention period of 2 months for user and event data, with a maximum retention period of 14 months. This retention period also applies to conversion data. The following options are available for all other event data: 2 months, 14 months, 26 months (Google Analytics 360 only), 38 months (Google Analytics 360 only), 50 months (Google Analytics 360 only). We choose the shortest storage period that corresponds to our intended use. You can ask us at any time about the retention period we have currently set.
Data whose retention period has been reached is automatically deleted once a month.
Additional details can be found in the linked further information. It is recommended that you check these links regularly for changes, as Google Analytics may update its functions and privacy policy. Further information on rights and contact details can be found in the general section of this privacy policy.
Google Fonts
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company Google LLC (USA), https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active
Purpose: Integration of fonts
Category: Statistics
Recipients: EU, USA (possible)
Data processed: IP address, language settings, screen resolution, version and name of browser.
Data subjects: website visitors
Technology: JavaScript call
Legal basis: Consent, Data Privacy Framework
Website: www.google.com
Further information: https://developers.google.com/fonts/faq https://policies.google.com/privacy https://www.google.com/about/datacenters/inside/locations/
To display fonts consistently, our website uses Web Fonts which are provided by Google.
To display web fonts, the web browser you use must connect with a Google server. This informs Google that our website is being accessed via your IP address. The IP address from the browser of the device you are using to access our site is also stored by Google. If your browser does not support Web Fonts, your device will display the site using a standard font type. With each Google Font request, your IP address is automatically transferred to a Google server along with information such as your language preferences, display resolution, version and name of your browser. The usage data collected by Google enables them to determine the popularity of specific font types. Google publishes these findings on internal analytics sites (e.g. Google Analytics).
Google Fonts enables us to use fonts on our own website without uploading them to our server. Google Fonts is an important building block for maintaining the high quality of our website. All Google fonts are automatically optimized for the web. This reduces the data volume and is particularly advantageous for use on mobile devices. When you visit our site, the low file size allows for quicker loading times. Furthermore, Google Fonts are secure Web Fonts that support all major browsers.
Google stores requests for CSS assets for one day on its servers. This enables us to use the fonts with the support of a Google style sheet. The font files are stored by Google for one year. To delete data prematurely, you must contact Google Support ( https://support.google.com ).
Google Marketing Platform / Google Ad Manager
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent company: Google LLC (USA)
Purpose: Personalized Advertising, Conversion Tracking, Remarketing, Campaign Performance Measurement
Category: Marketing
Recipients: EU, USA
Data processed: IP Address, Website Visit details, User data
Data subjects: Users
Technology: JavaScript Call, Cookies
Legal basis: Consent, Data Privacy Framework, https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active
Website: https://www.google.com
Further information:
https://policies.google.com/privacy
https://safety.google/intl/de/principles/
https://business.safety.google/privacy/
https://business.safety.google/adsprocessorterms/
Here you can find out where exactly Google data centers are located: https://www.google.com/about/datacenters/inside/locations/
On this website, the Google Ads service is used for the purpose of advertising our products and services. Google Ads is Google's in-house online advertising system.
It is important for us to know whether an interested visitor ultimately becomes our customer. To be able to measure this, there is the so-called conversion tracking. Furthermore, we would like to be able to address visitors to our website again and in a targeted manner. We achieve this through so-called remarketing (retargeting).
Google Ads serves both conversion tracking and remarketing, i.e. we can see what happened after you clicked on one of our ads. In order for this service to work, cookies are used and visitors are sometimes included in remarketing lists in order to be served only with certain advertising campaigns.
This is done by means of a pseudonymous identification number (pID), which the browser of a user receives and is assigned to him. This pID enables the service to recognize which ads have already been displayed to a user and which have been called up. The data is used to serve ads across websites by enabling Google to identify the pages visited by the user.
Our goal is that the offer of our website through the use of Google Ads targeted to those visitors who are actually interested in our offer. The data from conversion tracking allows us to measure the benefit of individual advertising measures and optimize our website for our visitors. Conversion can be measured through the use of cookies.
The information generated is transferred by Google to a server in the U.S. for evaluation and stored there. A transfer of data by Google to third parties only takes place due to legal regulations or in the context of commissioned data processing. Under no circumstances will Google link data of a user with other data collected by Google.
Google Tag Manager
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent company: Google LLC (USA)
Purpose: Launching Tools and Plugins
Category: Technically Required
Recipients: EU, USA (possible)
Data processed: IP Address
Data subjects: User
Technology: JavaScript Call
Legal basis: legitimate interest, Data Privacy Framework, https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active
Website: https://www.google.com
Further information:
https://policies.google.com/privacy
https://safety.google/intl/en/principles/
https://business.safety.google/adsprocessorterms/
Here you can find out where exactly Google data centers are located: https://www.google.com/about/datacenters/locations/
The Google Tag Manager service is used on our website.
The Tag Manager is a service that allows us to manage website tags via an interface. This allows us to include code snippets such as tracking codes or conversion pixels on websites without interfering with the source code. In doing so, the data is only forwarded by the Tag Manager, but neither collected nor stored. The Tag Manager itself is a cookie-less domain and does not process any personal data, as it serves purely to manage other services in our online offering.
When the Google Tag Manager is started, the browser establishes a connection to Google's servers. These are mainly located in the U.S. Through this, Google obtains knowledge that our website was called up via the IP address of a user.
The Tag Manager ensures the resolution of other tags, which in turn may collect data. However, the Tag Manager does not access this data. If a deactivation has been made at the domain or cookie level, this remains in place for all tracking tags that are implemented with the Tag Manager.
Google Translate
On our website, a web service called Google Translate is loaded for the translation of texts and terms of the company Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").
Legal basis: Legitimate interest, Data Privacy Framework,
https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active
When Google Translate is started, your browser establishes a connection to Google's servers. This informs Google that our website has been accessed via your IP address.
To use the functions of Google Translate it is necessary to store your IP address. Generally information is transferred to a Google server in the USA and stored there.
We use this service to ensure the full functionality and easy access to our website as well as the accessibility of our online offer for international users. This constitutes a legitimate interest within the meaning of Art 6 paragraph 1 lit. f GDPR.
The data will be deleted as soon as the purpose of their collection has been fulfilled.
You can find out exactly where Google data centres are located here: https://www.google.com/about/datacenters/inside/locations/
Further information on the handling of the transferred data can be found in Google's privacy policy: https://policies.google.com/privacy?hl=en
Hosting
In the context of hosting our website, all data that arises in connection with the operation and use of the website is processed. This includes, in particular, content data, usage data, communication data, and technical data that are necessary for providing and securely operating the website.
The storage and processing of this data is necessary to enable access to the website, ensure the stability and security of the online offering, and to technically optimize the website.
To provide our online presence, we use the services of external web hosting providers. In this context, the data generated during the operation of the website is transmitted to these service providers or processed by them on our behalf. Processing is carried out exclusively in accordance with legal requirements and based on contractual agreements for data processing on behalf.
Further information on the handling of personal data in connection with hosting can be found in the privacy policy of this website.
Klaviyo
Provider: Klaviyo, Inc, 125 Summer Street, Floor 6, Boston, MA, 02110, USA
Purpose: Marketing automation, sending emails & SMS
Category: external service, marketing
Recipient country: Third country (USA)
Processed data: IP address, personal details, details of the website visit, online-related data
Data subjects: Website visitors, interested parties
Technology: JavaScript call
Legal basis: Consent, certification according to EU-US Data Privacy Framework https://www.dataprivacyframework.gov/list, Standard Contractual Clauses SCC
Website: https://www.klaviyo.com/
Further information:
https://www.klaviyo.com/legal
https://www.klaviyo.com/legal/privacy/privacy-notice
https://www.klaviyo.com/legal/data-processing-agreement
We use the Klaviyo service on our website for our email marketing. Users have the option of registering on our website to receive a newsletter. Klaviyo takes care of sending the newsletter. The provider processes content, usage and meta/communication data. We require a valid e-mail address to process the newsletter registration. If further data is entered, it is transmitted to Klaviyo in the USA in encrypted form.
In addition, the following data is collected during registration in order to be able to prove your registration at a later date:
IP address
Date and time of registration and
Date and time of confirmation of registration
We reserve the right to store the registration data for a period of 3 years in order to document proof of consent.
Contact
Our website offers various options for contacting us, for example via contact forms or e-mail addresses provided. When contacting us, the personal data provided will be processed exclusively for the purpose of processing and responding to the respective inquiry. The processing takes place insofar as this is necessary to carry out pre-contractual measures or to fulfill a contract, or on the basis of legitimate interests, for example to maintain customer relationships or to document processes.
It may be necessary to provide certain data in order to fully process an inquiry. Without this information, it may not be possible to process the request, or only to a limited extent.
Personal data from contact requests may also be stored in a customer or prospective customer database on the basis of legitimate interests in order to optimize communication and support. Use for marketing purposes only takes place if separate consent has been obtained or a legitimate interest exists and there are no overriding interests of the data subject that require protection.
Personal data from contact inquiries will only be stored for as long as is necessary for the processing and handling of the inquiry or for as long as there are statutory retention obligations. After final processing of the inquiry and expiry of any legal deadlines, the data will be deleted or anonymized. As a rule, deletion takes place at the latest after three years without further contact, unless there are longer statutory or contractual retention obligations.
Additional information on the rights of data subjects and the relevant contact details are listed in the general section of this privacy policy.
Meta Pixel
Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, e-mail: privacy@facebook.com
Parent company: Meta Platforms, Inc, 1601 Willow Road, Menlo Park, CA 94025, USA
Purpose: Web analysis, tracking (conversion)
Category: Marketing
Recipient: EU, USA
Processed data: Visitor data (e.g. IP address, location data), behavioral data (e.g. clicks, duration of visit, conversion data), device data (e.g. browser type, operating system), e-commerce data (e.g. order ID, product information)
Data subjects: Website visitors
Technology: JavaScript, cookies (details in the cookie list), tracking pixels
Legal basis: Consent (purpose)
Certifications: EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework
Website: https://www.facebook.com/business/tools/meta-pixel
Further information:
https://www.facebook.com/privacy/policy/
https://www.facebook.com/legal/terms
The Meta Pixel service of the social network Facebook is used on our website for the analysis, optimization and economic operation of our online offer.
With the help of Meta Pixel, it is possible for Meta to determine the visitors to our website as a target group for the display of personalized ads. Accordingly, we use Meta Pixel to display the advertisements placed by us only to those users who have also shown an interest in our online offering or who have certain characteristics (e.g. interests in certain topics or products determined on the basis of the websites visited) that we transmit to Meta (so-called “custom audiences”). With the help of Meta Pixel, we also want to ensure that our meta ads correspond to the potential interest of users and are not annoying. With the help of Meta Pixel, we can also track the effectiveness of the Meta Ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a meta ad (so-called “conversion”).
The actions of users are stored in one or more cookies. These cookies make it possible to match Meta user data (such as IP address, user ID) with the data of a Facebook account. The data collected is anonymous and not visible to us and can only be used in the context of advertisements. Users can prevent the link to their Facebook account by logging out before taking any action.
To set which types of ads are displayed within Facebook, users can go to the page set up by Meta and follow the instructions on the settings for usage-based advertising: https://www.facebook.com/settings?tab=ads
The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.
Additional details can be found in the linked further information. It is recommended that you check these links regularly for changes, as Meta may update its functions and privacy policy. Further information on rights and contact details can be found in the general section of this privacy policy.
Pinterest Conversion Tag
Provider: Pinterest Inc, 651 Brannan Street, San Francisco, CA 94107, USA, e-mail: privacy-support@pinterest.com
Purpose: Tracking conversions and user behavior for Pinterest ads
Category: Marketing
Recipient: EU, USA
Processed data: URLs visited, device information, IP address, user behavior, conversion events, email address (optional)
Data subjects: Users
Technology: JavaScript code, tracking pixels, cookies (details in the cookie list)
Legal basis: Consent (purpose and data transfer)
Website: https://www.pinterest.com
Further information:
Privacy policy:
https://policy.pinterest.com/de/privacy-policy
https://policy.pinterest.com/de/terms-of-service
ATTENTION: In the context of this service, data is transferred to the USA or such a transfer cannot be ruled out. We would like to point out that on July 10, 2023, the European Commission issued an adequacy decision on the EU-US data protection framework (Data Privacy Framework). Accordingly, organizations or companies (as data importers) in the USA that are registered in a public list as part of the self-certification option of the Data Privacy Framework offer an adequate level of protection for data transfers. You can find out whether the specific provider of this service is already certified here: https://www.dataprivacyframework.gov/s/participant-search
We use the Pinterest Conversion Tag service on our website. This tool enables us to measure the effectiveness of our Pinterest ads and to analyze user behavior on our website. The Pinterest Conversion Tag works by placing a JavaScript code on our website. This code loads a tracking pixel that collects data about visits and actions on our website.
When a user visits our website, the Pinterest conversion tag collects various information. This includes the URLs visited, device information such as browser type and operating system, the IP address (in abbreviated form), as well as specific actions that have been defined as conversions, such as purchases, newsletter sign-ups or other important interactions.
The tool uses cookies to identify users across different sessions and devices. All relevant information about the cookies, including name, purpose of use and storage duration, is included in our detailed list of cookies used.
Optionally, an e-mail address can also be recorded if this is provided by the user, e.g. when registering for a newsletter. This enables more precise tracking and retargeting.
The collected data is used to measure the performance of Pinterest ads, to create target groups for remarketing and to optimize the advertising campaigns. The storage period of the collected data varies depending on the setting and purpose of use. By default, conversion data is stored for 30 days, but can also be stored for longer if this is necessary for analysis purposes. After the storage period has expired or if the data is no longer required, it is deleted or anonymized.
Additional details can be found in the linked further information. We recommend that you check these links regularly for changes, as Pinterest may update its privacy policy and how the Pinterest Conversion Tag works. Additional information on the rights of data subjects and the relevant contact details can be found in the general section of this privacy policy.
Server Log Files
For technical reasons, particularly to ensure a functioning and secure website, we process the technically necessary data about accesses to our website in so-called server log files which your browser automatically sends to us.
The access data we process includes:
The name of the website you are accessing
The browser type (including version) you use
The operating system you use
The site you visited before accessing our site (referrer URL)
The time of your server request
The amount of data transferred
The host name of computer (IP address) you are using to access the site
This data cannot be traced back to any natural person and is used solely to perform statistical analyses and to operate and improve our website while also optimising our site and keeping it secure. This data is sent exclusively to our website operator. The data is neither connected nor aggregated with other data sources. In case of suspicion of unlawful use of our website, we reserve the right to examine the data retroactively. This data processing takes place on the legal grounds of our legitimate interest in maintaining a technically fault-free and optimal website.
The access data is deleted within a short period of time after serving its purpose (usually within a few days) unless further storage is required for evidence purposes. In such cases, the data is stored until the incident is definitively resolved.
SSL Encryption
Within your visit to our website, we use the widespread SSL procedure (Secure Socket Layer) in conjunction with the highest level of encryption supported by your browser. You can tell whether an individual page of our website is transmitted in encrypted form by the closed representation of the key or lock symbol in the lower status bar of your browser. We use this encryption procedure on the basis of our justified interest in the use of suitable encryption techniques.
We also make use of suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorised access by third parties. Our security measures are continuously improved in line with technological developments and kept state-of-the-art.
Trusted Shop
The Trusted Shops Trustbadge is integrated on this website to display our Trusted Shops seal of approval and the possibly collected evaluations as well as to offer the Trusted Shops products to buyers after an order.
This is necessary for the fulfilment of our and Trusted Shops' overweighing legitimate interests in the provision of the buyer protection linked to the specific order in each case and the transactional evaluation services pursuant to Art. 6 paragraph 1 sentence 1 lit. f GDPR. Further details, including the objection, can be found in the Trusted Shops privacy policy linked herein and in the privacy policy linked in the Trustbadge itself.
The Trustbadge and the services advertised with it are an offer of the Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne. The trust badge is provided by a CDN provider (Content-Delivery-Network) within the scope of order processing. The Trusted Shops GmbH uses also service provider from the USA. An appropriate level of data protection is ensured. Further information to the data security of the Trusted Shops GmbH finds you here: https://www.trustedshops.co.uk/imprint/
When the trustbadge is called up, the web server automatically saves a so-called server log file, which also contains your IP address, the date and time of the call, the amount of data transferred and the requesting provider (access data) and documents the call. Individual access data are stored in a security database for the analysis of security problems. The log files are automatically deleted 90 days after creation at the latest.
Further personal data is transferred to Trusted Shops GmbH if you decide to use Trusted Shops products after completing an order or if you have already registered for use. The contractual agreement between you and Trusted Shops applies. For this an automatic collection of personal data takes place from the order data. Whether you as a buyer are already registered for a product use is automatically checked on the basis of a neutral parameter, the e-mail address hashed by cryptological one-way function. The e-mail address is converted into this hash value, which cannot be decoded for Trusted Shops, before transmission. After checking for a match, the parameter is automatically deleted.
UNPKG
Provider: Npm, Inc, 1999 Harrison Street #1150, Oakland, CA 94612, USA, privacy@npmjs.com
Purpose: Content Delivery Networks (CDN) for JavaScript libraries and other resources
Category: external service
Recipient: USA, worldwide (as the CDN is distributed globally and Cloudflare in particular is integrated as a service provider based in the USA)
Processed data: IP address, browser type, operating system, reference URL, time of request, possibly other technical details such as user agent, server logs (temporary for provision and security)
Data subjects: Users of the website
Technology: JavaScript, server logs, (optional) cookies, (optional) caching in the browser (e.g. LocalStorage, if used by the operator)
Legal basis: legitimate interest
Website: https://unpkg.com
Further information:
https://www.npmjs.com/policies/privacy (Privacy Policy)
https://www.npmjs.com/policies/terms (Terms of use)
https://www.cloudflare.com/privacypolicy (privacy policy of Cloudflare, as technical CDN operator)
https://unpkg.com (project page)
ATTENTION! In the context of this service, data is transferred to the USA or such a transfer cannot be ruled out. We would like to point out that on 10 July 2023 the European Commission issued an adequacy decision on the EU-US data protection framework (Data Privacy Framework). Accordingly, organisations or companies (as data importers) in the USA that are registered in a public list as part of the self-certification option of the Data Privacy Framework offer an adequate level of protection for data transfers. You can find out whether the specific provider of this service is already certified here: https://www.dataprivacyframework.gov/s/participant-search.
On our website, we use the UNPKG service to provide JavaScript libraries and other resources published on npm quickly and reliably. The technical purpose of UNPKG is to act as a global CDN (Content Delivery Network) to deliver the requested files from server locations that are as close as possible. This reduces loading times and ensures that the libraries delivered are up to date.
Technically, UNPKG works in such a way that when a website that integrates resources via UNPKG is called up (e.g. via a `<script>` tag), the user's browser establishes a connection to the UNPKG servers. These servers are operated by Cloudflare, a global CDN provider based in the USA. Technical data such as the IP address, browser type, operating system, reference URL and the time of the request are recorded and stored in server logs each time a request is made. This data is required to deliver the requested files, monitor performance and prevent security threats.
UNPKG itself does not set cookies, however, individual libraries integrated via UNPKG can in turn use cookies or other storage technologies (e.g. LocalStorage). The use of such technologies depends on the respective integrated packages and is therefore optional. All details (name, purpose, storage duration) of the cookies can be found in our specific list of cookies used.
The data collected is only stored for as long as is necessary to fulfill the purpose. If there is no specific information on the storage period, the statutory retention obligations apply; the data will be deleted immediately after this period has expired. Additional details can be found in the linked further information. We recommend regularly checking these links for changes by the user, especially in connection with UNPKG. Further information on rights and contact details can be found in the general section of this privacy policy.
Webcare
Provider: DataReporter GmbH, Zeileisstraße 6, 4600 Wels, Austria.
Purpose: Consent Management
Category: technically required
Recipient: EU, AT
Data processed: IP Address, Consent Data
Data subjects: Users
Technology: JavaScript call, Cookies, Swarmcrawler
Legal basis: Legitimate interest, consent (swarmcrawler to evaluate search results)
Website: https://www.datareporter.eu/
Further information: https://www.datareporter.eu/company/info
On our website, we use the Webcare tool for consent management. Webcare records and stores the decision of each user of our website. Our Consent Banner ensures that statistical and marketing technologies such as cookies or external tools are only set or started if the user has expressly consented to their use.
We store information on the extent to which the user has confirmed the use of cookies. The user's decision can be revoked at any time by accessing the cookie setting and managing the declaration of consent. Existing cookies are deleted after revocation of consent. For the storage of information about the status of the consent of the user, a cookie is also set, which is referred to in the cookie details. Furthermore, the IP address of the respective user(s) is transmitted to DataReporter's servers when this service is called up. The IP address is neither stored nor associated with any other data of the user, it is only used for the correct execution of the service.
With the help of Webcare, our website is regularly checked for technologies relevant to data protection. This investigation is only carried out for those users who have expressly given their consent (for statistical or marketing purposes). The search results of the users are evaluated by Webcare in an anonymous form and only in relation to technologies and used for the fulfillment of our information obligations. To start the Swarmcrawler technology, a request is sent to our servers and the IP address of the user is transmitted for the purpose of data transfer. Servers are selected which are geographically close to the respective location of the user. It can be assumed that for users within the EU, a server with a location within the EU will also be selected. The IP address of the user is not stored and is removed immediately after the end of the communication.
Webshop with customer account
We process data of our customers in particular their master data, communication data, payment data, contract data in the context of the execution of order processes in our web shop. This is done for the purpose of selecting and ordering the selected products and / or services, as well as their payment and delivery or execution.
The purpose of the processing is the provision of contractual services within the framework of the operation of our web shop, the billing of deliveries and services, the delivery of products and the performance of services.
The processing is carried out for the purpose of fulfilling the contract for the processing of orders and furthermore for the fulfilment of legal storage obligations based on trade and tax regulations. The mandatory data for the fulfilment of the contract are specially marked as such when they are entered in our shop system or we will inform you of them personally. We transmit the data to third parties only for the provision of our services (e.g. to involved transport or other auxiliary services such as subcontractors or telecommunications services), for the processing of payment transactions (e.g. to banks, payment service providers, tax authorities or consultants) or within the scope of our legal rights and obligations, as well as within the scope of our legitimate interest in the appropriate legal prosecution vis-à-vis legal advisors, courts and authorities in the event of an incident. The data will only be processed in third countries if this is absolutely necessary for the fulfilment of the contract (e.g. at the customer's request on delivery or payment) and insofar as appropriate data protection guarantees are available. Any other transfer of data to third parties will only take place with your express consent.
Users can create a user account, e.g. by viewing their orders. User accounts are not visible to the public. If users have terminated their user account, their data will be deleted with regard to the user account unless their retention is absolutely necessary for commercial or tax reasons or is necessary due to our legitimate interest in enforcing the law. It is the responsibility of the users to secure their data before the end of the contract in the event of termination.
Within the scope of registration and in the case of renewed registration and use of our online services, we store the IP address and the time of the respective user action. The storage takes place on the basis of our legitimate interests, as well as in the legitimate interest of the users themselves for protection against misuse and against other unauthorized use. This data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so.
As part of an order process, we collect additional data such as products ordered, payment information and the delivery address (if different). If products are placed in the shopping cart and the order process is canceled after a user has provided the email address, we may send an automated email reminder of the products in the shopping cart.
The data will be deleted after expiry of statutory warranty and compensation obligations or other contractual or statutory obligations. The deletion of the data takes place after the expiry of legal warranty and compensation obligations or other contractual or legal obligations. Our customers and contractual partners are informed separately in this data protection declaration about further processing of data within the scope of marketing activities.
Additional information on the rights of data subjects and the relevant contact details are listed in the general section of this privacy policy.
YouTube
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC (USA)
Purpose: Integration of Video Content, Collection of Statistical Data
Category: Statistics
Recipients: EU, USA
Data processed: IP Address, Website Visit Details, User Data
Data subjects: Users
Technology: JavaScript Call, Cookies, Device Fingerprinting, Local Storage
Legal basis: Consent, Data Privacy Framework, https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active
Website: https://www.youtube.com
Further information: https://www.youtube.com/intl/ALL_at/howyoutubeworks/user-settings/privacy/
https://policies.google.com/privacy
https://safety.google/intl/en/principles/
https://support.google.com/youtube/answer/10364219?hl=en
On our website, we use the YouTube service to embed videos.
We have activated the extended data protection mode on YouTube. According to YouTube, this mode means that YouTube does not store any information about visitors to this website before they watch a video. However, the disclosure of data to YouTube partners is not excluded by the extended data protection mode.
As soon as you start a YouTube video, a connection to YouTube's servers is established. This tells YouTube which of our pages you have visited. If you are logged into your YouTube account, you thereby enable YouTube to assign your surfing behaviour directly to your personal profile. This can be prevented by logging out of your account.
Furthermore, YouTube can save various cookies on your end device after starting a video or use comparable technologies (e.g. device fingerprinting). YouTube also uses the local storage on your end device. In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to collect video statistics, improve the user experience and prevent fraud attempts
General information on data protection
The following provisions in its principles apply not only to the data collection on our website, but also in general to other processing of personal data.
Personal data
Personal data is information that can be assigned to you individually. Examples include your address, your name as well as your postal address, email address or telephone number. Information such as the number of users who visit a website is not personal data because it is not assigned to a person.
Legal basis for the processing of personal data
Unless more specific information is provided in this Privacy Policy (e.g. in the case of the technologies used), we may process personal data from you on the basis of the following legal principles:
consent in accordance with Art. 6 paragraph 1 lit. a of the GDPR - The data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes.
Fulfillment of a contract and pre-contractual measures pursuant to Art. 6 paragraph 1 lit. b of the GDPR - Processing is necessary for the fulfillment of a contract to which the data subject is a party or for the implementation of pre-contractual measures.
Legal obligation pursuant to Art. 6 paragraph 1 lit. c of the GDPR - Processing is necessary for the performance of a legal obligation.
Protection of vital interests pursuant to Art. 6 paragraph 1 lit. d of the GDPR - Processing is necessary to protect the vital interests of the data subject or of another natural person.
Reasonable interests pursuant to Art. 6 paragraph 1 lit. f of the GDPR - The processing is necessary to protect the legitimate interests of the controller or of a third party unless the interests or fundamental rights and freedoms of the data subject prevail.
Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our home country.
Transfer of personal data
Your personal data will not be transferred to third parties for purposes other than those listed in this Privacy Policy.
We will only transfer your personal data to third parties if:
you have given your express consent in accordance with Art. 6 paragraph 1 lit. a of the GDPR,
the transfer pursuant to Art. 6 paragraph 1 lit. f of the GDPR is necessary to safeguard reasonable interests, as well as to assert, exercise or defend legal claims and there is no reason to assume that you have a prevailing interest worthy of protection by not disclosing your data,
there is a legal obligation to transfer the data in accordance with Art. 6 paragraph 1 lit. c of the GDPR, as well as this is legally permissible and / or
it is required according to Art. 6 paragraph 1 lit. b of the GDPR for the processing of contractual relationships with you.
Cooperation with processors
We carefully select our service providers who process personal data on our behalf. If we commission third parties to process personal data on the basis of a data processing agreement, this is done in accordance with Art. 28 of the GDPR.
Transfer to third countries
If we process data to a third country or if this is done in the context of using the services of third parties or disclosure or transfer of data to other persons or companies, this is only done on the legal basis described above for the transfer of data.
Subject to express consent or contractual necessity, we process or allow data to be processed only in third countries in accordance with Art. 44 - 49 of the GDPR with a recognized level of data protection or on the basis of special guarantees, such as contractual obligations through so-called standard contractual clauses of the EU Commission, the existence of certifications or binding corporate rules.
Data transfer to the U.S.
We would like to explicitly point out that as of July 10, 2023, the EU Commission has issued an adequacy decision on the EU-US data protection framework (Data Privacy Framework) pursuant to Art. 45 paragraph 1 GDPR. Accordingly, organizations or companies (as data importers) in the US that are registered in a public list as part of the self-certification of the Data Privacy Framework provide an adequate level of protection for data transfers. Whether the specific provider of a service is already certified can be found here: https://www.dataprivacyframework.gov/s/participant-search
The Data Privacy Framework provides a valid legal basis for the transfer of personal data to the USA. This creates binding guarantees to comply with all ECJ requirements; for example, it provides that access by U.S. intelligence services to EU data is limited to a necessary and proportionate level and that a data protection review court is created to which individuals in the EU also have access.
If a transfer of data by us to the US takes place at all or if a service provider based in the US is used by us, we refer to this explicitly in this Privacy Policy (see in particular the description of the technologies used on our website).
It should be noted that aside from significant improvements, the Data Privacy Framework is only partial and only applies to data transfers to those data importers in the U.S. that appear on the public list of certified organizations/companies.
What can the transfer of personal data to the US mean for you as a user and what risks are involved?
Risks for you as a user as far as data importers in the USA are concerned, which are not covered by the Data Privacy Framework, are in any case the powers of the US secret services and the legal situation in the U.S., which currently, according to the European Court of Justice, no longer ensure an adequate level of data protection. Among others, these are the following:
Section 702 of the Foreign Intelligence Surveillance Act (FISA) does not provide for any restrictions on the surveillance measures of the secret services or guarantees for non-US citizens.
Presidential Policy Directive 28 (PPD-28) does not provide effective remedies for those affected against actions by U.S. authorities and does not provide barriers to ensuring proportionate measures.
The ombudsman provided for in the Privacy Shield does not have sufficient independence from the executive; he cannot issue binding orders to the U.S. secret services.
Legally compliant transfer of data to the U.S. on the basis of the standard contractual clauses for data importers not covered by the Data Privacy Framework?
In June 2021, the European Commission adopted new Standard Contractual Clauses (SCC) in Decision 2021/914/EU. These create a new legal basis for data transfers where the level of data protection is not the same as in the EU.
Legally compliant transfer of data to the U.S. based on consent?
If a data transfer to a service provider based in the U.S. takes place that is not covered by the Data Privacy Framework and this data transfer is based on explicit consent, we provide explicit information about this in this privacy policy, in particular in the description of the technologies used on our website.
What measures do we take to ensure that data transfers to the U.S. are legally compliant?
Where US providers offer the option, we choose to process data on EU servers. This should technically ensure that the data is located within the European Union and that access by US authorities is not possible.
Storage periods in general
If no explicit storage period is specified during the collection of data (e.g. in the context of a declaration of consent), we are obliged to delete personal data in accordance with Art. 5 paragraph 1 lit. e of the GDPR as soon as the purpose for processing has been fulfilled. In this context, we would like to point out that legal storage obligations represent a legitimate purpose for the further processing of affected personal data.
Personal data will be stored and retained by us in principle until the termination of a business relationship or until the expiry of any applicable guarantee, warranty or limitation periods, in addition, until the end of any legal disputes in which the data is required as evidence, or in any event until the expiry of the third year following the last contact with a business partner.
Storage periods in particular
As part of the description of individual technologies on our website, there are specific references to the storage period of data. In our cookie table, you will be informed about the storage period of individual cookies. In addition, you always have the possibility to ask us directly about the specific storage period of data. To do so, please use the contact data listed in this Privacy Policy.
Rights of data subjects
Data subject have the right:
(i) in accordance with Art. 15 of the GDPR, to request information about your personal data processed by us. In particular, you may request information on the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned duration of storage, the existence of a right of rectification, deletion, restriction of processing or opposition, the existence of a right of appeal, the origin of your data, if not collected by us, as well as the existence of automated decision making including profiling and, where applicable, meaningful information on the details thereof;
(ii) in accordance with Art. 16 of the GDPR, to demand without delay the correction of incorrect or incomplete personal data stored by us;
(iii) in accordance with Art. 17 of the GDPR, under specific circumstances to demand the deletion of your personal data stored with us, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;
(iv) in accordance with Art. 18 of the GDPR, to demand the (temporary) restriction of the processing of your personal data, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you refuse to delete it and we no longer require the data, but you require it for the assertion, exercise or defense of legal claims or you have lodged an objection to the processing in accordance with Art. 21 of the GDPR;
(v) in accordance with Art. 20 of the GDPR, to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request that it be transferred to another controller; However, this only covers those of your personal data that we process with the help of automated processes after your consent or on the basis of a contract with you;
(vi) in accordance with Art. 21 of the GDPR, if your personal data are processed on the basis of our legitimate interest, to object to the processing of your personal data for reasons arising from your specific situation or if the objection is directed against direct advertising. In the latter case, you have a general right of objection, which we will implement without indicating a specific situation.
(vii) in accordance with Art. 7 paragraph 3 of the GDPR, you may at any time revoke your consent to us. As a result, we may no longer continue the data processing based on this consent in the future. Among other things, you have the option of revoking your consent to the use of cookies on our website with effect for the future by calling up our Cookie Settings.
(viii) in accordance with Art. 77 of the GDPR to complain to a data protection authority regarding the illegal processing of your data by us. As a rule, you can contact the data protection authority at your usual place of residence or workplace or at the headquarters of our company.
The responsible data protection authority for Biocannovea Produktions & Vetrtriebs GmbH is:
Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien, Österreich
Tel.: +43 1 52 152-0, dsb@dsb.gv.at
Assertion of rights of data subjects
You yourself decide on the use of your personal data. Should you therefore wish to exercise one of your above-mentioned rights towards us, you are welcome to contact us by email at service@biocannovea.com or by post, as well as by telephone.
Please assist us in specifying your request by answering questions from our responsible employees regarding the specific processing of your personal data. If there are reasonable doubts about your identity, we may request a copy of your identification.
For questions regarding data protection, you can reach us at service@biocannovea.com or at the other contact details stated in this Privacy Policy.
Wien, on 28. August 2025
Download as PDF
