The German version is legally binding; this translation is provided for convenience.

Privacy policy

Here we explain which personal data is processed on rauhbein-cosmetics.com, for what purpose and for how long. We only collect what we need for orders, shipping, invoicing and queries.

1. Controller

TM Merch GmbH, Karl-Heinrich-Str. 8, 37235 Hessisch Lichtenau, Germany
Managing directors: Hendrik Simon, Marcel Hofsommer
Email: info@tm-merch.de · Phone: PLATZHALTER

We have not appointed a data protection officer because the legal requirements for doing so are not met. Please send any data protection queries to the email address above.

2. Hosting and server logs

The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Ionos processes the data on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place.

Each time the site is accessed, the server stores technical information: IP address, date and time, page accessed, status code, amount of data transferred, referrer and browser identifier. We need this to deliver the site and to detect attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The logs are deleted after PLATZHALTER days.

To protect against automated mass requests, we also store a hash of your IP address (for IPv6 only of the network part) for forms and for the partner login; the hash is created with a secret key. We do not store the plain IP address for this purpose. We delete these entries after two days at the latest.

3. Orders

When you pre-order the beard oil, we process the data required for the contract, shipping and invoicing (Art. 6(1)(b) GDPR):

  • name, delivery and billing address
  • email address and, if provided, phone number
  • order number, quantity, price, chosen payment method, time of order
  • for PayPal: transaction number and payment status
  • for partner shop orders, additionally: company name, VAT ID and contact person

We store the order data as a file on the server and delete it there 90 days after the order. We keep invoices and accounting records for ten years because commercial and tax law require this (§ 147 AO, § 257 HGB; Art. 6(1)(c) GDPR). For shipping, we pass your name and delivery address to the shipping company we use.

4. Sending emails via Resend

We send confirmations and invoice notices via Resend (Resend Inc., USA). For this purpose Resend receives your email address and the content of the message. We use Resend’s EU region (eu-west-1, Ireland). As Resend is a US company, access from the USA cannot be ruled out; we have therefore agreed standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(b) GDPR, and for partner requests point (f).

5. Payment via PayPal

Only if you choose PayPal as your payment method do we redirect you to PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. We transmit the order number and amount; you enter your login details exclusively at PayPal. We receive the payment confirmation and the transaction number from PayPal. The legal basis is Art. 6(1)(b) GDPR. PayPal is itself responsible for its own processing; details can be found in PayPal’s privacy statement.

If you pay by bank transfer, there is no redirection and no data is transmitted to PayPal.

6. Partner requests from barbershops

In the “Become a partner” form we ask for the shop name, city, address, contact person, mobile number, email, Instagram profile and your message. We use this information to call you back and discuss working together (Art. 6(1)(b) GDPR, pre-contractual measures). If no partnership results, we delete the request no later than six months after the last contact.

7. Cookie in the partner area

We do not set any cookies on the sales page. Only when a barbershop enters its partner code in the partner area do we set a session cookie. It contains a random identifier so that the server knows the code has been checked. Without this cookie we could not display the partner terms in a protected way. It is therefore strictly necessary and does not require consent (§ 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act; for the processing, Art. 6(1)(b) and (f) GDPR). The cookie expires when you close the browser, after two hours of inactivity or when you log out.

8. No tracking

We do not use any analytics or advertising tools or social media plugins, and we do not load fonts or scripts from third-party servers. Videos and images are hosted on our own web space.

9. Your rights

You have the following rights towards us at any time:

  • access to your stored data (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR), unless a statutory retention obligation applies
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection to processing based on legitimate interest (Art. 21 GDPR)

An informal email to info@tm-merch.de is sufficient.

10. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany, datenschutz.hessen.de.

11. Data security

All pages and forms are transmitted encrypted via TLS (HTTPS). Order data is stored outside the publicly accessible directory. You are not obliged to provide us with any data; however, without the required fields in the form we cannot accept an order. No automated decision-making takes place.

Last updated: 23 September 2026