Online Learning Platform

Last updated: 20 August 2026

This Privacy Policy applies to our online learning platform hosted on Thinkific at beautymasters.thinkific.com. Our main website at beautymasters.com is covered by a separate Privacy Policy.

1. Controller

The controller responsible for the processing of personal data described in this Privacy Policy within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR) is:

BeautyMasters GmbH
Maximilianstrasse 36
80539 Munich
Germany

Represented by Managing Director: Frederic Westerberg
Commercial register: Amtsgericht München, HRB 302666
Email: [email protected]
Telephone: +49 89 55293446
VAT identification number: DE454967950

We have not appointed a Data Protection Officer, as the conditions of Art. 37 GDPR and §38 BDSG are not met.

2. Scope

This Privacy Policy explains how we process personal data when you visit our learning platform, create or use a learner account, purchase or access our courses and digital products, participate in course activities, contact us, or subscribe to our communications.

We use Thinkific Labs Inc. ("Thinkific"), 369 Terminal Avenue, Vancouver, British Columbia, Canada, to host and operate the learning platform. Thinkific processes personal data on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR.

3. Categories of Personal Data

Depending on how you use the platform, we process the following categories of personal data:

• Account data: name, email address, password authentication data, account status.
• Professional data: professional designation, specialty, country of practice, where you provide it.
• Purchase and billing data: order details, products purchased, invoice data, billing address, VAT information, payment status. We do not receive or store your full payment card details.
• Course and learning data: enrolments, lesson completion and progress, quiz and assessment results, certificates issued, comments and discussion contributions.
• Communication data: support requests, correspondence and their content.
• Technical and log data: IP address, browser type and version, operating system, device data, referring URL, date and time of access, pages accessed.
• Marketing data: subscription status, records of consent and consent withdrawal, and interaction with our emails where applicable.

Special categories of personal data. Our courses are directed exclusively at qualified medical and healthcare professionals and industry representatives. We do not require or request health data concerning you. Please do not submit patient data, patient images, or other third-party health information through the platform, its comment functions, or support channels. Where such data is submitted despite this, we will delete it unless retention is legally required.

4. Purposes and Legal Bases

a) Operating and securing the platform

We process technical and log data to deliver the platform, ensure its stability and protect it against misuse and attack.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and functional provision of the platform.

b) Account creation and course delivery

We process account, professional and learning data to establish and administer your account, enrol you in purchased courses, deliver content, record progress and issue certificates.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures).

c) Orders, payment and invoicing

We process purchase and billing data to process orders, issue invoices, handle refunds and comply with commercial and tax retention obligations.
Legal bases: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR in conjunction with §257 HGB and §147 AO.

d) Support and correspondence

We process communication data to answer enquiries and provide support.
Legal basis: Art. 6(1)(b) GDPR where the enquiry relates to an existing or prospective contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

e) Email communications

Where you have given consent, we use your name and email address to send information about our courses, dates and offers.
Legal basis: Art. 6(1)(a) GDPR (consent), and §7(2) no. 2 UWG.

You may withdraw your consent at any time with effect for the future, using the unsubscribe link in any such email or by writing to [email protected]. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Transactional messages relating to your account, your purchases and the courses you are enrolled in are sent on the basis of Art. 6(1)(b) GDPR and are not marketing communications; they cannot be unsubscribed from while your account is active.

5. Recipients and Processors

We disclose personal data to the following categories of recipients, who act on our instructions under data processing agreements or, where they act as independent controllers, under their own privacy policies:

• Thinkific Labs Inc. (Canada) — learning platform hosting and operation.
• Stripe Payments Europe, Ltd. / PayPal (Europe) S.à r.l. et Cie, S.C.A. payment processing. These providers act as independent controllers for payment data under their own privacy policies.
• Tax advisors, auditors and legal advisors — where required for accounting, statutory audit or the establishment and defence of legal claims.

We otherwise disclose personal data only where we are legally obliged to do so, where it is necessary for the establishment, exercise or defence of legal claims, or where you have consented.

6. International Transfers

Canada. Thinkific is established in Canada. The European Commission has recognised that Canada ensures an adequate level of protection for personal data transferred to recipients subject to PIPEDA, so transfers to Thinkific take place on the basis of Art. 45 GDPR.

You may request a copy of the applicable safeguards by writing to [email protected].

7. Retention

We retain personal data only for as long as necessary for the purposes described above or for as long as statutory retention obligations require.

• Account and learning data: for the duration of your account and for one year thereafter, unless you request earlier deletion and no retention obligation applies.
• Order, invoice and accounting records: for the statutory retention periods under §257 HGB and §147 AO. 10 years
• Support correspondence: 90 days after resolution.
• Marketing data and consent records: until consent is withdrawn. Records evidencing consent and its withdrawal are retained thereafter for the purpose of demonstrating compliance under Art. 7(1) GDPR.
• Server and security logs: generally up to 90 days, unless longer retention is necessary to investigate a security incident, prevent fraud, establish or defend legal claims, or comply with a legal obligation.

8. Cookies and Similar Technologies

We use cookies and similar technologies that are strictly necessary to operate the platform, maintain your login session, secure the service and deliver functions you have requested. These are used on the basis of §25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.

We do not use analytics, advertising or third-party tracking technologies on this platform. 

9. Your Rights

Subject to the statutory conditions, you have the following rights in relation to personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent at any time with effect for the future, where processing is based on consent (Art. 7(3) GDPR)

You are not subject to any decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

To exercise your rights, write to [email protected].

10. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. Where we process personal data for direct marketing purposes, you have the right to object at any time to that processing, without needing to give reasons. If you object to processing for direct marketing purposes, we will no longer process your personal data for those purposes.

To object, write to [email protected].

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
https://www.lda.bayern.de/

12. Provision of Data

Providing the account and billing data indicated as mandatory at registration and checkout is necessary for the conclusion and performance of the contract for access to our courses. Without this data we cannot create your account, process your order or grant course access. Providing professional data and consenting to marketing communications is voluntary and has no effect on your ability to purchase or access courses.

13. Account Deletion

You may request deletion of your learner account by writing to [email protected]. Following deletion we may continue to retain data where necessary to comply with statutory retention obligations, to establish, exercise or defend legal claims, or to prevent fraud. Certificates issued and the underlying records evidencing course completion may be retained for 2 yeara to allow verification of qualifications obtained.

14. Age

Our courses and this platform are directed exclusively at qualified medical and healthcare professionals, trainees in those fields, and industry representatives. They are not directed at children, and we do not knowingly process personal data of persons under the age of 16 through this platform.

15. Changes to this Privacy Policy

We may amend this Privacy Policy to reflect changes in our processing activities, the services we use, or legal requirements. The current version is always published on this page, with the date of the most recent update stated at the top.

16. Contact

BeautyMasters GmbH
Maximilianstrasse 36
80539 Munich, Germany
Email: [email protected]