Privacy policy

Privacy Policy – essence Club

April 2026

This Privacy Policy supplements the general website privacy policy and cookie policy of essence and takes precedence over it insofar as it concerns the processing of personal data in connection with the essence Club.

1. Controller & Data Protection Officer

Controller: cosnova GmbH, Am Limespark 2, 65843 Sulzbach, info@cosnova.com ("we")

Data protection officer: Moritz Görmann, CTM-COM GmbH, Marienburgstraße 27, 64297 Darmstadt, www.ctm-com.de

2. Processing for registration and administration of your membership in the essence Club

We process the personal data you enter during registration and elsewhere on the website (in particular your email address, name, date of birth, address, details of products you have purchased, and the beauty content you have submitted) for the purpose of managing your membership in the essence Club, managing your points account, and processing orders for rewards. For this purpose, we also create a customer ID for each account. The legal basis for this is Article 6(1)(b) GDPR, the performance of the contract between you and us.

3. Processing based on your consent

If you have consented to the use of your personal data for advertising purposes, we will process your email address for advertising purposes. In order to be able to offer you appealing and relevant topics, we collect your interests based on your approximate location (via your IP address) and on your clicks and the display of content using individualized links, cookies, and similar technologies. We also store log data such as the IP address of your device and the date and time of your consent so that we can prove your consent if necessary. The legal basis for this is Article 6(1)(a) GDPR. Your consent is voluntary and not a prerequisite for your participation in the essence Club. You can revoke your consent at any time, e.g., via the unsubscribe link, the preference center in your account, or by emailing essenceclub@essence.eu.

4. Other processing

We process personal data to combat fraud and behavior that violates the terms and conditions of participation in the essence Club. The legal basis for this is Article 6 (1) (f) GDPR. Our legitimate interest is to combat abuse and assist prosecution of criminal and administrative offenses.

The processing of data collected using cookies and similar technologies is explained in more detail in our Cookie Policy. As a rule, this processing is based on your consent, Article 6(1)(a) GDPR, unless the cookies are absolutely necessary for us to provide a digital service that you have expressly requested, Section 25 TDDDG. As described in more detail in the Cookie Policy, you can change your cookie settings at any time and/or delete the cookies on your device.

We use processors bound by instructions, Article 28 GDPR, in particular for hosting the website and providing certain technical services necessary for the provision of the essence Club.

5. Transfers to third countries

Transfers to third countries are made on the basis of adequacy decisions by the European Commission, on the basis of the EU-US Data Privacy Framework (if the recipient in the third country is certified accordingly) or on the basis of the so-called EU Standard Contractual Clauses (SCC); we will be happy to provide you with details on request.

6. Storage period

We only store your personal data for as long as it is necessary to fulfill the purpose for which it was collected. Once the purpose no longer applies, your personal data will be deleted unless further storage is required by law for commercial or tax reasons. In this case, your data will be blocked and archived and finally deleted after the legal requirements have expired.

7. Your rights

You have the rights described in the essence privacy policy under section 9.

8. Updates

Changes to our service may make it necessary to also change this privacy policy. Therefore, please check the content of our privacy policy regularly. We will also inform you as soon as the changes require action on your part (e.g., consent) or other individual notification.