1. Data Controller

Long-Living GmbH
Lorettostraße 38
40219 Düsseldorf
Germany
E-Mail: info@long-living.de

2. General Information on Data Processing

We process personal data exclusively in accordance with the GDPR and the German Federal Data Protection Act (BDSG).

Our core processing activities include:

• Operating the website and customer account
• Processing orders
• Generating personalised analysis and product reports
• Processing health-related information based on consent
• Sending emails (reports, product recommendations, newsletters – where consent was given)

3. Data We Process

3.1 Customer Data

(Name, address, email, password hash, orders)
→ Purpose: Contract fulfilment, customer account, shipping
→ Legal basis: Art. 6(1)(b) GDPR

3.2 Health and Lifestyle Data

(e.g. skin, hair, nail conditions, sleep, hydration, lifestyle habits)
→ Purpose: Creation of personalised analysis report
→ Legal basis: Art. 9(2)(a) GDPR (explicit consent)

3.3 Pseudonymised Data for AI Processing

We use AI-based systems to generate your personalised wellness report.
The following AI providers may be involved:

• Mistral AI (EU – France)
• OpenAI
• Google Gemini
• Anthropic Claude

Only pseudonymised health-related information is processed.
**No identifying personal data is transmitted.**

Not transmitted:

• Name, email, address
• IP address
• Customer ID
• Payment data
• Order information

Legal basis:
• Art. 6(1)(a) GDPR
• Art. 9(2)(a) GDPR
• Art. 28 GDPR (data processing agreement)

3.4 Technical Data

(IP, browser type, device data)
→ Purpose: security, functionality, error analysis
→ Legal basis: Art. 6(1)(f) GDPR

3.5 Cookies / Tracking

(Statistics only with consent, e.g. Google Analytics)
→ Legal basis: Art. 6(1)(a) GDPR + TTDSG

4. Use of Your Data

4.1 Personalised Analysis Report

• Processing of health-related information
• Evaluation using AI systems
• Creation of PDF/Web report

4.2 Product Recommendations

Only with your explicit consent.
→ Legal basis: Art. 6(1)(a) GDPR

4.3 Email Communication

• Reports
• Product recommendations
• Follow-up information
• Newsletters (requires separate opt-in)

4.4 Orders & Shipping

Payment provider: SumUp
Shipping partners receive only necessary information (name, address).
→ Legal basis: Art. 6(1)(b) GDPR

5. Storage Duration

• Health data & analysis information: 1 year
• Order data: statutory retention periods (6–10 years)
• Newsletter data: until withdrawal

6. Your Rights

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to object
• Right to data portability
• Right to withdraw consent at any time

7. Data Security

We store data on servers located in Germany.
All AI providers operate exclusively under data processing agreements according to Art. 28 GDPR.

8. Contact

For any questions:

info@long-living.de
or via our contact form.