03
Data protection officer
Our data protection officer:Annett LangeEmail: datenschutzbeauftragte@apotheke-fortuna.de 05
Types of data processed
Within our online offering, we process in particular the following categories of personal data:- master data (e.g. name, address),- contact data (e.g. email address, telephone number),- content data (e.g. the content of your messages),- usage data (e.g. pages visited, access times),- meta and communication data (e.g. IP address, device information).In the context of services customary for pharmacies, special categories of personal data may also be processed, in particular health data within the meaning of Art. 9 GDPR. 06
Categories of data subjects
Data processing concerns in particular:- customers,- prospective customers,- business partners,- visitors and users of our online offering. 08
Legal bases for processing
Processing is based on the following legal bases:- Art. 6(1)(a) GDPR (consent),- Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures),- Art. 6(1)(c) GDPR (legal obligation),- Art. 6(1)(f) GDPR (legitimate interest),- Art. 9(2)(h) GDPR in conjunction with Section 22 of the German Federal Data Protection Act (BDSG) (health data),- Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) (technically necessary storage in your browser, e.g. for the saved list). 09
Security measures
We take appropriate technical and organisational measures in accordance with Art. 32 GDPR to ensure a level of protection appropriate to the risk.This website uses SSL encryption (HTTPS).
13
Cookies and storage in your browser
This website does not set any cookies. It does not use a cookie consent tool, Google Analytics or any third-party tracking or marketing services.The only entries stored in your browser are those described below for visitor statistics (localStorage) and for the saved list on the own-brand pages (sessionStorage). The language switcher does not store any data in your browser. 14
Visitor statistics (Onepage)
This website uses the visitor statistics integrated into the website system of Onepage GmbH. A randomly generated identifier together with a list of the pages visited is stored in your browser’s local storage (localStorage) for 30 days, and page views are transmitted to Onepage’s statistics service. No cookies are set for this. We do not link this information to you personally.The legal basis for the processing is our legitimate interest in designing our online offering to meet demand (Art. 6(1)(f) GDPR). You can remove the stored data at any time by deleting the website data in your browser. 15
Saved list on the own-brand pages
On our own-brand pages, you can add products and sets to a saved list (“My saved list”) using the heart symbol. The saved list is stored exclusively locally in your browser (sessionStorage) and only for the duration of the session; it is deleted automatically when you close the browser window or tab. Only the identifiers of the saved products and sets are stored, no personal data; no cookies are set for this. Storage is technically necessary to provide the saved list you have expressly requested (Section 25(2) no. 2 TDDDG). The saved list is not transmitted to us or to third parties. A PDF of the list is created exclusively on your device; if you share the list, this is done via the app or email program you choose. You can remove the list at any time via “Clear list” or by deleting the website data in your browser.
16
Videos and program libraries
Some videos on this website are delivered via an external content delivery network (Amazon CloudFront of Amazon Web Services). When these videos are loaded, your IP address is transmitted to the operator of this network for technical reasons. In addition, individual program libraries (e.g. icon graphics) are loaded via the public service esm.sh; your IP address is also transmitted in this process.The legal basis is our legitimate interest in a technically reliable presentation of our website (Art. 6(1)(f) GDPR).Embedded maps (e.g. Google Maps), YouTube videos, Google Fonts or social media plug-ins are not used on this website. 18
Prescriptions for medical aids
If we offer to accept prescriptions for medical aids, we, as the controller, collect your name, address, telephone number and, where applicable, your email address, as well as all information about your state of health that arises from your prescription.The data are deleted as soon as the supply of the medical aid has been completed and no statutory retention obligations apply.If we cannot supply a prescription for a medical aid ourselves, we recommend supply by one of our medical supply store partners. Legal basis: your express consent (Art. 6(1)(a), Art. 9(2)(a) GDPR). Your consent can be withdrawn until the supply has taken place. 19
Processing for laboratory diagnostics
If you send in your sample for analysis, you agree that MVZ GANZIMMUN GmbH, Erich-Dombrowski-Straße 3, 55127 Mainz will carry out the relevant analysis. The laboratory provides its own information on its data processing.You have the option of making the laboratory report available to your pharmacy for consultation purposes and of booking an appointment digitally to discuss it. You can view the status of your order in your customer account. 20
Transfer of data to third countries
Personal data may be transferred to countries outside the European Union or the European Economic Area in particular when videos are delivered via Amazon CloudFront and after you click on links to providers such as Google, Meta or Apple. Such transfers take place only in compliance with the legal requirements of Art. 44 et seq. GDPR, in particular on the basis of the EU-US Data Privacy Framework or appropriate safeguards such as standard contractual clauses.
22
Rights of data subjects
You have the right to:- access (Art. 15 GDPR),- rectification (Art. 16 GDPR),- erasure (Art. 17 GDPR),- restriction of processing (Art. 18 GDPR),- data portability (Art. 20 GDPR),- object to processing (Art. 21 GDPR),- withdraw consent given, with effect for the future (Art. 7(3) GDPR),- lodge a complaint with a supervisory authority (Art. 77 GDPR).To exercise your rights, please contact the controller named above or our data protection officer. 24
Updates to this privacy policy
This privacy policy will be amended as soon as legal, technical or organisational changes make this necessary. The current version published on this website applies in each case.Last updated: October 2026 