Information on data protection

2 Responsibility for data processing

pharma mall Gesellschaft für Electronic Commerce GmbH (hereinafter also referred to as “pharma mall” or “we”)
Westerwaldstr. 10–12
53757 Sankt Augustin
Tel.: +49-(0)2241-2543-0
Email: info[at]pharma-mall.de

 

3 Contact details of the Data Protection Officer

pharma mall Gesellschaft für Electronic Commerce GmbH
Data Protection Officer
Westerwaldstr. 10–12
53757 Sankt Augustin
Tel.: +49-(0)2241-2543-0
Email: dsb[at]pharma-mall.de

 

4 Data processing on these web pages

4.1 Provision & log files

Each time these web pages are accessed or used, we process the IP address, user agent, timestamp (including date and time), request method, files requested, data volume and status code, and store these access events in the log files of our own web servers for monitoring purposes. The legal basis for this is Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring and monitoring the availability, technical functionality and security of our website. The log files are automatically deleted after 7 days.

We process the same data when you use the pharma mall careers pages. In this case, your data is received by Personio GmbH & Co. KG, Seidlstraße 3, 80335 Munich, and Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. In principle, when using these careers pages, traffic is routed to AWS data centres in the EU. However, in this context, the processing of personal data worldwide, including in the USA, cannot be ruled out, as Amazon Web Services, Inc. has its headquarters in the USA. Any transfer of personal data to the USA takes place in accordance with Article 45 of the GDPR on the basis of the Data Privacy Framework.

 

4.2 Use of cookies

Cookies are small files that are automatically created and stored in the web browser of visitors’ devices when they visit a website. These cookies may store information about preferred user settings, such as language preferences, regional settings or display modes. Furthermore, cookies serve as a load-balancing mechanism to distribute traffic evenly across different servers, thereby optimising the efficiency and availability of these websites. Similarly, the storage and transmission of certain cookies (so-called ‘XSRF tokens’) provide additional protection against unauthorised access and the manipulation of requests. Furthermore, cookies can check the browser’s settings regarding cookies, record when the cookie banner has been dismissed, and help maintain the current session, particularly in the context of the login process. The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring the website functions properly. The following cookies are stored in connection with these websites:

Name	Retention period	Purpose
PMSHOPPOOL	Session	To maintain the current session
language	1 year	To select the language on these web pages
testIfCookiesEnabled	Session	Checks the browser settings regarding cookies
acceptedCookieInfo	1 year	Records that the cookie banner has been dismissed
PMSESSIONID	Session	To maintain the current session, in particular for the login process

In the context of the careers pages, it is necessary to store a session cookie named “locale” on your device in order to maintain the current session. The legal basis for this is Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring the website functions properly. If you configure your browser so that no cookies at all – including those that are technically necessary – are stored on your device, many functions of the careers pages will be available to you only to a limited extent, or possibly not at all.

 

5 Contact & Communication History

If you contact pharma mall (e.g. by email, telephone or via the contact form) and provide personal data in the process, we will process the information you have sent to the extent necessary to respond to your enquiry and to carry out any requested actions. The legal basis for this is Article 6(1)(b) of the GDPR.

Where your enquiry is not necessary for the performance of a contract with pharma mall or for the implementation of pre-contractual measures, the legal basis for the processing of your data is Article 6(1)(f) of the GDPR. The legitimate interest lies in the final processing of the message received.

The legal basis for the processing of your data is Article 6(1)(a) of the GDPR, provided that you have consented to the data processing.

Your message will be stored until processing is complete. It will only be stored for a longer period if we are authorised or obliged to do so in individual cases.

For its social media recruitment, pharma mall operates pages on various networks, including XING and LinkedIn. You can contact pharma mall via www.xing.com, www.linkedin.com, www.facebook.com, www.instagram.com. In this case, New Work SE, Am Strandkai 1, 20457 Hamburg; LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; or Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are responsible for processing your data, such as your IP address, user agent, device information, browsing history, location, search queries and usage times. Depending on the situation, we will process the message you send via the relevant platform.

 

6 Account management and ongoing contractual relationships

In order to use the pharma mall online shop, you must create and manage a personal account. During the registration process, we process the personal data you provide on these web pages, as entered in the relevant input fields. The legal basis for this is Article 6(1)(b) of the GDPR. The verification of a valid pharmacy operating licence and proof of authorisation to supply controlled substances (BTM) serves to confirm authorisation to procure certain products available only from pharmacies and is required as proof of identity in accordance with statutory provisions. The processing of this personal data is carried out in accordance with Article 6(1)(c) of the GDPR; without the provision of this data, it is not possible to conclude a user agreement.

Once you have registered on this website, we process the data specified in section 4.1 for IT security reasons. The legal basis for this is Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring and monitoring the availability, technical functionality and security of our website.

If the details you have provided are complete, we will check whether you meet the requirements for concluding a user agreement. If this is the case, you must then apply in your account for the additional authorisation required to place an order, which must be granted by the relevant manufacturer. Subsequently, all data you provided during registration on these websites, including your pharmacy operating licence and proof of authorisation to supply controlled substances, will be automatically transmitted to the relevant manufacturer. The legal basis in this case is Article 6(1)(f) of the GDPR. Our legitimate interest and that of the relevant manufacturer is to optimise the workflow and improve the user experience. This transfer takes place either as soon as you apply for activation of the relevant manufacturer’s shop, or – irrespective of an application for activation – on the basis of an agreement between pharma mall and the relevant manufacturer, in order to further speed up the activation processes.

During the term of the contractual relationship, we will process your contact details in accordance with Article 6(1)(b) of the GDPR in order to provide you with important manufacturer information as part of the email information service. This information includes, amongst other things, ‘Blaue Hand’ and ‘Rote Hand’ notices, mandatory information approved by the Federal Institute for Drugs and Medical Devices (BfArM), product recalls, stock availability, as well as warnings regarding the risk of mix-ups or other risks (danger to life and limb). The email information service does not contain any advertising from pharma mall or the manufacturers and cannot be deactivated, as it forms part of the service provided under the terms of use.

pharma mall will send you information relevant to specific circumstances as part of the ongoing contractual relationship. This may include, for example, information about newly launched manufacturer shops, new features on these websites, or changes to the Terms and Conditions or updates to the privacy policy. The legal basis for this is Article 6(1)(f) of the GDPR. The legitimate interest lies in maintaining and further developing the existing business relationship, as well as in providing information about contract-related changes or extensions to the range of services.

To send the email information service and emails based on pharma mall’s legitimate interests, we use the systems of rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg im Breisgau. To measure deliverability, the emails contain so-called tracking pixels. Provided these tracking pixels are not already blocked by your email client’s system settings, they enable log file analysis. The data collected by pharma mall via tracking pixels is processed exclusively in aggregated and statistical form in order to optimise the information service. The analysis options provided by tracking pixels are limited to determining what percentage of recipients have opened an email from the information service and whether important emails, such as manufacturer warnings, have been successfully delivered. The legal basis for this is Article 6(1)(f) of the GDPR. Our legitimate interest lies in optimising the information service. The data is deleted 30 days after dispatch.

 

7 Recruitment Process

We process your application data to assess your suitability and qualifications for the role you are applying for. The data we process depends on the information you provide (e.g. voluntary information about your GitHub repository, details of your personal profile on professional networking sites such as LinkedIn, XING, etc.). We use your contact details solely to keep you informed about the progress of the application process. We use all other information in your application documents exclusively to assess your suitability for the vacancy. The legal basis is Article 6(1)(b) in conjunction with Article 88 of the GDPR and Section 26 of the BDSG
If your application documents contain special categories of personal data, e.g. information relating to health or ethnic origin, we also base the processing on Article 9(2)(b) of the GDPR and Section 26(3), first sentence, of the BDSG.

Access to your application data is restricted to the relevant HR managers and the IT administration team at pharma mall.

 
Retention period
Your application data will be deleted in accordance with the requirements of the purpose for which it was collected. Should the application process result in your being offered a job, apprenticeship, work placement or other form of employment, the data will initially be retained and transferred to your personnel file. Otherwise, your application process will end upon receipt of a rejection letter. In the event of a rejection, we will retain your data for a period of six months from the date the rejection decision is sent, unless a longer retention period is necessary to defend legal claims.

Candidate Pool
If you wish, we can include you in a subsequent selection process following the rejection of your application. To be included in the applicant pool, we require your consent (Article 6(1)(a) of the GDPR). Your consent is voluntary and may be withdrawn at any time.

 

8 Page Insights on Facebook / Instagram

We operate fan pages on Facebook and Instagram, and we are jointly responsible with Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for the processing of data within the framework of ‘Page Insights’. Full details regarding the division of responsibilities and information on ‘Page Insights’ or ‘Facebook Insights’ can be found in the following agreement: www.facebook.com/legal/terms/page_controller_addendum

By using Page Insights, page administrators can obtain information about target audiences, demographic characteristics and statistics on post engagement.

When you visit www.facebook.com / www.instagram.com, the data you generate whilst using the service – including your IP address, user agent, device information, browsing history, location, search queries, preferred usage times, last login, likes and interests – is processed by the Meta Platforms Group. Meta Platforms, Inc. is initially the recipient of the data and processes it for its own purposes. The data is also passed on to third parties under the responsibility of Meta Platforms, Inc., for the purposes of interest-based advertising tracking, data analysis and automated profiling for personalised adverts.

If you are logged in to Facebook or Instagram, a cookie containing your identifier is stored on your device. This enables Meta Platforms, Inc. to track that you have visited a particular page and how you have used it. This also applies to all other services provided by Meta Platforms, Inc., such as WhatsApp and Facebook Connect. Through services embedded in websites, such as ‘Meta Pixel’, Meta Platforms, Inc. can track your visits to external websites and link them to your profile in order to learn more about you and your interests.

Meta Platforms, Inc. processes data globally and across the group. In doing so, data from the use of various services is automatically combined. The more Meta Platforms, Inc. services you use, the more comprehensive and detailed the profiling becomes.
In certain situations, you can influence the nature, scope and manner of data processing by the Meta Platforms Group, for example by using ad and web tracking blockers, deleting cookies after your session, avoiding the use of services such as Facebook Connect, not publishing private information on such platforms, and by not granting Meta Platforms, Inc. permanent access to your personal data (contact and calendar details, photos, location data, etc.).

The Meta Platforms Group is an international software group. When using Meta services, your data may be transferred to the USA.

With regard to data transfers to the US, the European Commission has adopted the Adequacy Decision for the EU-US Data Privacy Framework. This Adequacy Decision may since then be used for the transfer of personal data to participants in the EU-US Data Privacy Framework. Meta Platforms, Inc. is a certified participant.

 

9 LinkedIn

We maintain a page on LinkedIn. LinkedIn is a service provided by LinkedIn Corp, 1000 West Maude Avenue, Sunnyvale, CA 94085, USA.

The data controller for the processing of personal data relating to individuals located in the EU is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland: “If you are located in the ‘designated countries’, LinkedIn Ireland Unlimited Company (‘LinkedIn Ireland’) becomes the data controller for your personal data that is provided to, collected for or by, or processed in connection with our services”, de.linkedin.com/legal/privacy-policy

We process data as soon as you contact us via LinkedIn.

When you visit LinkedIn, the data and information collected about you whilst using the service (including, amongst other things, your IP address, user agent, browsing history and location [geotargeting]) is processed by LinkedIn, which uses cookies and other web tracking technologies for this purpose. The recipient of this data is initially LinkedIn, where it may be passed on to third parties for LinkedIn’s own purposes and under LinkedIn’s responsibility, as LinkedIn and its partners collaborate globally and use cookies, for example for statistics, personalisation, adverts/offers/content tailored to you, and profiling. You are free to visit our LinkedIn page and carry out further actions, such as leaving comments or messages, contacting us or following our page. Alternatively, you can access all further information on our website.

LinkedIn is a certified participant in the EU-US Data Privacy Framework, ensuring an adequate level of data protection.

 

10 XING

We maintain a XING profile. The controller responsible for the processing of personal data is New Work SE, Am Strandkai 1, 20457 Hamburg. We process data when you contact us via XING or leave comments. When you visit our XING page, XING collects, in particular, your IP address and user agent, and processes data independently via cookies.
In accordance with XING’s privacy policy, data is transferred to third countries. These transfers are based on the EU Standard Data Protection Clauses.

In accordance with Article 15 of the GDPR, you have the right to request information about your personal data that we process.

Should inaccurate personal data be processed, you have the right to have it rectified in accordance with Article 16 of the GDPR.

Where the legal conditions are met, you have the right to erasure or restriction of processing of the data in question (Articles 17 and 18 of the GDPR).

Subject to the conditions set out in Article 20 of the GDPR, you have the right to data portability.
You have the right to withdraw your consent at any time, without this affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

Under Article 21 of the GDPR, you have the right to object at any time to the processing of data relating to you on grounds relating to your particular situation.

There is no automated decision-making or profiling as defined in Article 22 of the GDPR.

In accordance with Article 77(1) of the GDPR, you have the right to lodge a complaint. You may exercise this right with the competent supervisory authority: https://www.ldi.nrw.de/

Last updated: 23 March 2026