Source: https://www.mytheresa.com/euro_en/service/privacy-policy/
Timestamp: 2019-04-25 19:43:44+00:00

Document:
The personal data of the data subject is deleted or blocked, as soon as the purpose for which it was stored no longer applies. Storage can also be effected if this was required by the European or national legislators in European Union regulations, laws or other stipulations that the person responsible is subject to. The data is also blocked or deleted if a statutory storage period prescribed by the cited standards expires, unless there is a need for continued data storage for the purposes of a conclusion or performance of a contract.
Within the framework of the balancing of interests pursuant to Art. 6 paragraph 1 senteince1 lit. f GDPR we have taken into account and weighed up our interest in provision and your interest in the processing of your personal data in compliance with data protection requirements. As the data below is necessary for the technical provision of our service in order to be able to offer you access to our website and also to ensure stability and security, in particular to offer protection against misuse, we have come to the conclusion that this data - in conjunction with an assurance of data security based on the state of technology - can be processed, whereby your interest in processing in compliance with data protection requirements is adequately taken into account.
The user is asked as part of the registration process to consent to the processing of this data. After registration has been completed you receive a personal access protected by password and can view and manage the registration data. Registration is effected on a voluntary basis, but may be a precondition for using our services.
In this connection your data is forwarded to our email service provider Emarsys so that we can send you an email confirming your registration.
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected.
This is the case for the data collected during the registration process if the registration on our internet site is cancelled or modified.
Insofar as the data collected during the registration process is required to perform a contract or to take steps prior to entering into a contract, this is only the case when the data is no longer required to perform the contract. Even after conclusion of the contract it may still be necessary to store personal data in order to fulfil contractual or statutory obligations.
Personal data is stored as a measure to prevent fraud.
The deletion deadline for the purposes of fraud prevention is 6 months, for actual attempts of fraud 6 months.
You can send an email to privacy@mytheresa.com requesting the deletion or modification of your data.
You can inform us of your revocation of consent as well as your objection to storage of your personal data by sending an email to privacy@mytheresa.com.
If we have received your email address in connection with your order and you have not objected to this, we reserve the right to send you regular offers by email for products similar to those you have already purchased from our product range.
You can object to the use of your email address and the processing and use of data to create user profiles at any time without giving reasons, simply by sending a message to privacy@mytheresa.com or via the unsubscribe link in the email newsletter, without incurring any costs other than the transmission costs according to the basic tariffs defined in, for example, your existing Internet service contract.
We would like to point out that we evaluate your user behaviour when we send you the newsletter. For this evaluation the emails sent contain so-called web beacons, also called tracking pixels. These are one pixel image files that link to our website and thus enable us to evaluate your user behaviour. This is effected by collecting web beacons assigned to your email address and are linked with a unique ID. Links contained in the newsletter also have them. We use the data obtained in this way to devise a user profile in order to make available the newsletter tailored to your interests. When you read our newsletter we record which links you click on and conclude from this your personal interests. We link this data with the actions made by you on our website.
You can object to the use of your data for advertising and data analysis purposes at any time. Please send your objection to privacy@mytheresa.com.
To prevent unauthorised access to your personal data, in particular financial data, the order process is encrypted by hybrid encryption protocol for the secure data transmission "Secure Socket Layer" (SSL).
BS Payone (BS PAYONE GmbH Lyoner Straße 9 D-60528 Frankfurt/Main) is our payment service provider through which the card transaction as well as EPS payments is processed.
For card transactions we use iFrame which is made available by BS Payone and is integrated in our web shop. Therefore, customers do not have to share any card details with us. We also receive from BS Payone no other personal data. However, the following data is transmitted to Payone when this payment method is used: amount, order number, name (both of the invoice as well as the delivery address), address (both of the invoice as well as the delivery address), email, telephone number, pseudocardpan. The data from card payments is in turn forwarded by Payone to our acquiring banks (Elavon, American Express) so that the card can be debited by the card-issuing bank. The purpose of the data processing is the execution of your payment via card transaction. Legal basis is Art. 6 paragraph 1 sentence 1 lit. b GDPR. The data transmission described is effected simultaneously also for the purposes of fraud prevention at BS Payone. Therefore, the additional legal basis Art. 6 paragraph 1 sentence1 lit. f GDPR applies. Insofar as you effect payment by card, a right of objection is excluded as the processing of your data is absolutely essential.
For EPS payments customers are transferred by Payone to their own bank after they have selected their bank. There they must confirm the payment process in the same way as a transfer needs to be confirmed when using online banking services. We receive from BS Payone no other personal data. However, the following data is transmitted to Payone when this payment method is used: amount, order number, name (both of the invoice as well as the delivery address), address (both of the invoice as well as the delivery address), email, telephone number. The purpose of the data processing is the execution of your payment via EPS payment. Legal basis is Art. 6 paragraph 1 sentence 1 lit. b GDPR. Insofar as you effect payment by EPS payment, a right of objection is excluded as the processing of your data is absolutely essential.
Wirecard (Wirecard Bank AG, Einsteinring 35, 85609 Aschheim) is our payment service provider for processing iDEAL payments. For EPS payments customers are transferred by Wirecard to their own bank after they have selected their bank. There they must confirm the payment process in the same way as a transfer needs to be confirmed when using online banking services. Should you use this payment methods the following data is transmitted: We send no personal data to Wirecard. However, we receive from Wirecard a payment confirmation as well as the following data: account holder, IBAN, BIC, account number. The purpose of the data processing is the execution of your payment via iDEAL payment. Legal basis is Art. 6 paragraph 1 sentence 1 lit. b GDPR. Insofar as you effect payment by iDEAL payment, a right of objection is excluded as the processing of your data is absolutely essential.
Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden) is our service provider for the payment method SOFORT Überweisung. Should you use this payment method the following data is transmitted: We send no personal data to Klarna. However, we receive from Klarna payment confirmation as well as the following data: account holder, IBAN, BIC, account number. The purpose of the data processing is the execution of your payment via SOFORT Überweisung. Legal basis is Art. 6 paragraph 1 sentence 1 lit. b GDPR. Insofar as you effect payment by SOFORT Überweisung, a right of objection is excluded as the processing of your data is absolutely essential.
Most browsers accept cookies automatically. If you would like to prevent the acceptance of cookies, you can select the setting "accept no cookies" in the browser settings. How this works in detail can be found in the instructions of your browser manufacturer. Cookies already stored on your computer can be deleted at any time. However, we would like to point out this may restrict the functionality of our web presence.
Our website likewise uses flash cookies. The flash cookies used are not recorded by your browser, but by your flash plug-in. Furthermore, we use HTML5 storage objects, which are stored on your end device. These objects store the required data irrespective of the browser you are using and have no automatic expiry date. If you no longer wish flash cookie processing, you must install a corresponding add-on, e.g. "Better Privacy" for Mozilla Firefox (https://addons.mozilla.org/de/firefox/addon/betterprivacy/) or the Adobe flash killer cookie for Google Chrome. You can also partially prevent the use of flash cookies by changing the settings of your flash player. You can prevent the use of HTML5 storage objects by employing the private mode in your browser. Additionally, we recommend manually deleting your cookies and the browser history on a regular basis.
The data is collected on a pseudonymised basis. The storage period according to Criteo GmbH is 13 months. There is no data transfer to third countries.
The legal basis for the processing of the data using Criteo is Art. 6 paragraph 1 sentence 1 lit. f GDPR.
Our aim is to display products that are as relevant as possible for you and thus also to constantly improve our advertising content and our advertising efficiency. These purposes are also our legitimate interest in the sense of Art. 6 paragraph 1 sentence1 lit. f GDPR.
Should you no longer wish to be shown any personalised advertising material, you can unsubscribe from Criteo advertising here.
A so-called tracking pixel (also: 1x1 pixel, web beacon or pixel tag) is a 1x1 gif loaded when our website is called up. This tracking pixel allows us and our partners to record statistical data for our marketing and web analysis. By employing appropriate analysis tools we can use this data for various purposes. The different marketing instruments are explained more thoroughly in the next section. It is not possible to identify your person.
Our provider CommandersAct, Fjord Technologies Head Office | Commanders Act | 3/5 rue Saint-Georges | 75009 Paris | France, provides a solution for the central management and control of our marketing tags as well as the data transfer interface to our service providers. In addition, it support us in the analysis and optimisation of our offers.
Data is forwarded to third parties, however only under the condition of a contractual agreement in accordance with Art. 28 paragraph 2 - 4 GDPR. Data is not transferred to third countries.
The legal basis for the processing of the data with the use of Commanders Act is Art. 6 paragraph 1 sentence1 lit f GDPR. CommandersAct is used to simplify and to constantly improve marketing activities. These purposes are also our legitimate interest in the sense of Art. 6 paragraph 1 sentence1 lit. f GDPR.
The personal data collected via this system is not used for anything other than the cited purposes. You are also entitled to object to this processing. If you object to this processing, the processing via this system will be prevented in the future. In order to object to the processing, please use the possibility to set an opt-out cookie created by CommandersAct.
To do this use https://www.commandersact.com/de/datenschutz/ function. In addition, you can find further information about data recording, use and security on the CommandersAct website.
On this website we use a plug-in of the website analysis service of New Relic (188 Spear Street, Suite 1200 San Francisco, CA 94105, USA). It enables statistical evaluations of the speed of the website to be recorded and is used to optimise the website.
When a user calls up a website of this offer containing such a plug-in his or her browser establishes a direct connection with the New Relic server. The integration of the plug-in provides New Relic with the information that a user has called up on the corresponding page of the offer.
According to New Relic no additional personal data is collected.
We were not informed of the storage period by New Relic. There is data transfer to the USA. Guarantees pursuant to Art. 44ff GDPR exist by means of EU standard contractual clauses. Should you wish to view the standard contractual clauses, please send us an email to privacy@mytheresa.com.
If you want to object to the transfer of data, send us an email to privacy@mytheresa.com.
We were not informed of the storage period by Monetate. There is data transfer to the USA. Guarantees pursuant to Art. 44ff GDPR exist as Monetate is subject to the Privacy Shield, which you can find here.
Legal basis for the processing of the data is Art. 6 paragraph 1 sentence 1 lit. f GDPR. Our legitimate interest resides in the usage analysis and the ongoing optimisation of our internet site connected with this.
For more information regarding Monetate data protection, please consult the Data Protection Notice of Monetate.
In the mytheresa.com app we use the services of Localytics (Char Software, Inc. d/b/a Localytics, 2 Centre Plaza Boston, MA 021058, United States) Localytics is a Marketing und Analyse Service app. The service enables us to understand the function and use of our mobile content on your device. Furthermore, we use Localytics in order to send you tailored promotions and information on our products per push notification or in-app message. We also inform you via Localytics about items you have forgotten in your shopping bag.
Legal basis for the processing of the data is Art. 6 paragraph 1 sentence 1 lit. f GDPR. Our legitimate interest resides in the analysis of the efficacy of our advertising and goes hand in hand with the constant improvement of our advertising efficiency.
There is data transfer to the USA. Guarantees pursuant to Art 44ff GDPR exist by means of the EU standard contractual clauses with Localytics. If you would like to view these clauses, please send an email to privacy@mytheresa.com.
If you want to object to the transfer of the data, please send us an email to privacy@mytheresa.com.
Device-related data such as device type and model, operating system and browser type and version.
A data transfer to the USA takes place. Guarantees pursuant to Articles 44 et seq. GDPR are provided by means of an order data processing contract between us and Certona, which contains standard EU contract clauses. To view the standard contractual clauses, please send us an email to privacy@mytheresa.com.
The legal basis for processing of data is Article 6 (1) sentence 1f of the GDPR. Our justified interest lies in usage analysis and the related continuous optimisation of our website as well as in the offer of personalised web content.
Everest Tech (AdobeSystem Ireland Ltd.) is an advertising solution that enables companies to optimise their online advertising in search engines. Therefore, Adobe sets a cookie as soon as you have bought something on mytheresa.com after clicking in the Google search engine or have placed something in the shopping cart.
Only information such as keyword, orderID, productID and turnover is transmitted to Adobe.
According to Adobe no additional personal data is collected. Personal data is not forwarded to the USA.
Legal basis for the processing of the data is Art. 6 paragraph 1 sentence 1 lit. f GDPR.
We use the service provider Adobe in order to optimise our search engine campaigns on Google and thus to improve our advertising efficiency. These purposes are also our legitimate interest in the sense of Art. 6 paragraph 1 sentence 1 lit. f GDPR.
We use the following technology of Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, which is a part of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google“.
In order to attract attention to our services, we place Google Adwords adverts and use as part of this the Google conversion tracking for the purpose of providing personalised online advertising that takes into consideration interest and location. The option to anonymise the IP addresses is regulated at Google Tag Manager via an internal setting that is not visible in the source of this page. This internal setting is set so that the anonymisation of the IP address required by the Federal Data Protection Act is achieved.
A cookie is set by Google when an advert is clicked on the computer of the user. For more information on the cookie technology used, please consult the information provided by Google on Website Statistics and in the Data Protection Provisions.
With the aid of this technology Google and we as a customer receive information on when a user has clicked on an advert and which websites he or she was forwarded to. The information obtained by this is solely used for a statistical evaluation for advertising optimisation purposes. We receive no information with which visitors can be personally identified. The statistics made available to us by Google contain the total number of users that have clicked on our adverts, and, if applicable, whether they were forwarded to a webpage of our web content furnished with a conversion tag. We can use these statistics to track which search terms occur particularly frequently when our advert is clicked and which adverts lead the user to establishing contact via the contact form.
If you would not like this, you can prevent the storage of the cookies required for this technology, for example, via your browser settings. In this case your visit does not flow into the user statistics.
d) by permanent disabling in your browsers Firefox, Internetexplorer or Google Chrome under the link http://www.google.com/settings/ads/plugin. We point out that in this case you may not be able to use all the functions of this content to its full extent.
Legal basis for the processing of your data is Art. 6 paragraph 1 sentence 1 lit. f GDPR. Our legitimate interest are the evaluation of the statistics obtained from the findings on user behaviour and the efficacy of our advertising. This in turn serves to continually improve our web content and our web presence.
You can find more information concerning Google data protection here: http://www.google.com/intl/de/policies/privacy and https://services.google.com/sitestats/de.html.
Alternatively, you can visit the website of the Network Advertising Initiative (NAI) on http://www.networkadvertising.org. Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
Nevertheless, we and Google continue to receive the statistical information regarding how many users visited the site and when they did this. If you would not like to be included in these statistics, you can prevent this with the aid of additional programs for your browser (for example with the Add-on Ghostery).
This website uses Google Analytics, an advertising analysis service of Google Inc. ("Google"). Use takes place based on Art. 6 paragraph 1 sentence 1 lit. f. GDPR Google Analytics uses so-called "cookies", text files that are stored on your computer and enable an analysis of the use of the website by you.
is as a rule transmitted to a Google server in the USA and stored there. The IP address transmitted as part of Google Analytics from your browser is not amalgamated with other Google data. We have also added the code "anonymizeIP" to Google Analytics on this website. This ensures that your IP address is masked so that all data is collected anonymously. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.
For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework.
On behalf of the operator of this website, Google uses this information to evaluate your use of the website, to collate reports on website activities and to render further services to the website operator connected with the website use and internet use. This represents a legitimate interest in the sense of Article 6, paragraph 1 sentence 1 lit. f GDPR.
You can prevent the storage of the cookies by means of an appropriate setting in your browser software; however, we would like to point out that in this case you may not be able to use all the functions of this website to their full extent.
You can also prevent the recording of the data related to your use of the website (incl. your IP address) by Google as well as the processing of this data by Google by downloading and installing a browser plug-in available on the following link: http://tools.google.com/dlpage/gaoptout?hl=de. An opt-out cookie is set that prevents the future collection of your data when you visit this website. The opt-out cookie only applies for this browser and only for our website and is saved on your device. If you delete the cookies in this browser, you must set the opt-out cookie afresh.
This website additionally uses Google Analytics for a cross-device analysis of visitor flows carried out via a User-ID. You can deactivate in your customer account under "My Data", "Personal Data" the cross-device analysis of you use.
User terms: http://www.google.com/analytics/terms/de.html, data protection overview: http://www.google.com/intl/de/analytics/learn/privacy.html, as well as the data protection declaration: https://www.google.com/policies/privacy/.
mytheresa.com uses Google AdWords and Google Analytics Remarketing Lists for Search Ads (RLSA) Users that visit mytheresa.com via are collected via a Google tag and the behaviour recorded. You appear on the list for a standard period of 30 days and for a maximum period of 540 days.
Mytheresa.com uses Google Shopping Reviews, which allows shoppers to write a review of mytheresa.com after they have placed an order. These reviews are visible to potential future customers.
Our legitimate interest lies in your consent to participate in the survey. This data must be collected so that Google Shopping Reviews, the third party commissioned by us, can provide you with an independent survey if you have consented to the delivery of your order.
Your data will be stored for a 12-month period.
We use Crashlytics (a service of Google Ireland Ltd., Gordon House, Barrow St, Dublin 4, Ireland) in the mytheresa.com app for the purpose of measuring quality as well as evaluating the use behaviour of our app user. Crashlytics focuses on measuring technical crashes of the app with the intention of making the app more stable and to avoid errors in the app source code for improved user friendliness. Furthermore, we can use Crashlytics to track which app version the user has and whether a user regularly updates the app. The information collected by us in the analysis software is not linked to personal data.
There is data transfer to the USA. Guarantees pursuant to Art. 44ff GDPR exist as Crashlytics is subject to the Privacy Shield, which you can find here.
In the Android app we likewise use the services of Firebase Cloud Messaging Server (a service of Google Ireland Ltd., Gordon House, Barrow St, Dublin 4, Ireland). The Firebase Cloud Messaging Server allows us to ascertain whether you agree to the receipt of push notifications or not. This enables us to ascertain whether you want to receive push notifications via the app or not.
Legal basis for the processing of the data is Art. 6 paragraph 1 sentence 1 lit. f GDPR. Our legitimate interest resides in the sending of advertising messages only if consent has been forthcoming.
There is data transfer to the USA. Guarantees pursuant to Art. 44ff GDPR exist as Firebase is subject to the Privacy Shield, which you can find here.
We use Return Path, a service from Return Path, Inc. 3 Park Avenue, 41st Floor, New York, NY 10016, to optimise our email delivery and increase the profitability of email channels. Return Path used web beacons to track user behaviour.
Return Path has not communicated to us that the data is stored. A data transfer to the USA takes place. The guarantees required by Articles 44 et seq. GDPR exist because Return Path is subject to Privacy Shield, which you can find here.
The legal basis for processing of data is Article 6 (1) sentence 1f of the GDPR. Our legitimate interest is to maximise the response and conversion rates of our marketing campaigns using optimised, customised emails.
If you wish to object to the transmission of the data, please send us an email at privacy@mytheresa.com.
For the exceptional cases in which personal data is transferred to the USA, Microsoft has submitted to the EU-US Privacy Shield which you can find hier.
(1) This website uses Facebook Custom Audience with the so-called pixel function ("Facebook Pixel") provided by Facebook Ireland Ltd. ("Facebook"). This allows users of the site to view interest-based advertisements ("Facebook Ads") when visiting the Facebook social network or other sites that also use the process. Our interest in pursuing this route is to show you advertisements which are of interest to you in order to make our website more interesting for you.
(2) We do not actively transmit personally identifiable information to Facebook. However, due to the use of Facebook Pixel, your browser automatically establishes a direct connection to the Facebook server. We have no influence on the extent and further use of the data collected through the use of this tool by Facebook and therefore inform you according to our state of knowledge: Through the integration of Facebook Custom Audiences, Facebook receives the information that you have accessed the corresponding website of our website or clicked on an advertisement from us. If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are not registered on Facebook or have not logged in, the provider may collect and store your IP address and other identifiers.
(3) The legal basis for the processing of personal data using cookies is Article 6(1) sentence 1f GDPR.
(4) Using Facebook Pixel, Facebook can on the one hand determine the visitors to our online offering as a target group for the presentation of ads (so-called "Facebook ads"). Accordingly, we use Facebook Pixel to display Facebook ads placed by us only to Facebook users who have shown an interest in our online offering or who have certain features (for example, interests in certain topics or products that are determined on the basis of the websites visited) that we transmit to Facebook (so-called "custom audiences"). Using Facebook Pixel, we also want to ensure that our Facebook ads correspond to the potential interest of users and do not have an annoying effect. Facebook Pixel also enables us to track the effectiveness of Facebook ads for statistical and market research purposes by seeing if users were referred to our site after clicking on a Facebook ad (known as "conversion"). These purposes also constitute our legitimate interest within the meaning of Article 6(1) sentence 1f GDPR.
(5) In the event that Facebook transmits data to the USA, Facebook is certified under the Privacy Shield Agreement and thus guarantees a level of data protection comparable to European law (Articles 44 et seq. GDPR). (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).
(6) Information about the third-party provider: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland; Board of Directors: Gareth Lambe, Shane Crehan; registered with the Companies Registration Office of the Republic of Ireland; company number 462932.
For more information about Facebook data processing, please visit https://www.facebook.com/about/privacy.
(7) You may opt out of data collection via Facebook Pixel and the use of your information to display Facebook ads by using the opt-out below. To set what types of ads you see within Facebook, you can go to the following page set up by Facebook and follow the instructions there about the settings for usage-based ads: https://www.facebook.com/settings?tab=ads. The settings are platform-independent, that is, they are adopted for all devices, such as desktop computers or mobile devices.
Note: If you use opt-out, an opt-out cookie is stored on your device. If you delete the cookies in this browser, then you must make the selection again. Furthermore, the opt-out only applies within the browser you are using, and only within our web domain where the box was unchecked.
In addition, we collaborate with affiliate networks, such as Commission Junction/Zanox/etc.
An affiliate network is a service provider from the online advertising sector and an agent between advertisers (mytheresa.com) and publishers (website operators). Publishers can enter into a partnership via the affiliate network with mytheresa.com and thus take part in special promotions. Therefore, the publisher integrates a mytheresa advertisement/promotion code/hyperlink in the content on its website and thus leads the customer to our online shop through, for example, an editorial text.
As soon as the user buys on mytheresa.com, the publisher receives an appropriate commission. Only the information on the sale, such as order ID, product ID and the prices of the products sold, is transferred to the network. No personal data are collected or transferred.
We use the email address collected at the purchase of goods on our website for direct advertising for our own and similar products. If you no longer wish to receive any direct advertisements, you can object to the use of your email address at any time. To this end, you will find a corresponding link in each newsletter. Unsubscribe here.
For the administration of payments or to fight fraud in credit card payments, we share rare data with Riskified Ltd (34 W 27th St, Suite 502, New York, USA), which are processed only for this purpose.
Riskified uses the transferred data only in suspicious cases to compare these with their databank and to then provide an estimate of the risk of fraud.
The legal basis for the use of the data for fighting fraud is Art. 6, Para.1, P. 1, lit. f, GDPR.
Personal data are transferred to the USA. There are guarantees pursuant to Art. 44 et seq. GDPR through EU standard contract clauses. If you wish to view the standard contract clauses, please send us an email at privacy@mytheresa.com.
To combat credit card fraud, we occasionally share information with Whitepages (Whitepages, Inc., 1301 Fifth Avenue, Suite 1600, Seattle, WA 98101, USA) that is processed solely for this purpose.
Whitepages uses the provided data only in suspicious cases, to check it against their database and then to make an assessment of the risk of fraud.
The legal basis for processing of data is Article 6 (1) sentence 1f of the GDPR. As part of the weighing of interests pursuant to Art. 6(1)(f) GDPR, we have considered and weighed our interest in the service of Whitepages and your interest in processing your personal data in compliance with data protection regulations, and have come to the conclusion that our legitimate interests prevail, namely the intention to make a profit, the reduction of our default rate and protection against credit risks.
There will be no transfer of your personal data to a third party apart from for the specified purposes.
this is legally permissible and required for implementing the contractual relationships with you.
Fundamentally, the high European level of data protection does not apply to data transfer outside the European Union. For a transfer, it can be that there is currently no adequacy decision by the EU Commission in the sense of Art. 45, Para. 1, 3 GDPR. This means that the EU Commission has not yet positively determined that the country-specific level of data protection corresponds to the level of data protection of the European Union based on GDPR, which is why we have created the abovementioned suitable guarantees.
your personal data could possibly be dealt with beyond the actual purpose.
Moreover, there is a possibility that you cannot sustainably assert and implement any of your legal data protection rights, such as, for example, your right to information, correction, deletion or data portability.
There may also be a higher probability that there could be incorrect data processing and the personal data do not quantitively and qualitatively meet or not fully meet the requirements of GDPR.
Our web pages may contain links to other providers. We point out that this data protection declaration applies exclusively to the web pages of mytheresa.com. We have no influence on and do not control whether the other providers adhere to the data protection provisions.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 6
 Art. 44
 Art. 44
 Art. 6
 Art. 6
 Art 44
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 44
 Art. 6
 Art. 44
 Art. 6
 Art. 44
 Art. 6
 Art. 45