Skip to content

Privacy Policy

The protection of your personal data is an important concern for us. With this privacy policy, we inform you about which personal data we collect in connection with your use of our website, for what purposes we use it, and what rights you have.

We have designed our website to collect as little data as possible. In principle, visiting our website is possible without providing personal data. Only when you use certain services (e.g. contact form, newsletter registration, registration in the professional area) does the processing of personal data become necessary. We adhere to the principle of data minimisation.

The processing of personal data is carried out exclusively in accordance with the General Data Protection Regulation (GDPR), the Telecommunication-Digital Services-Data Protection Act (TDDDG), as well as the relevant national data protection laws.

1. Definitions

The terms used in this privacy policy have the following meanings in accordance with the GDPR:

  • Personal data: All information relating to an identified or identifiable natural person (e.g. name, email address, IP address).
  • Processing: Any operation relating to personal data, e.g. collection, storage, use, transmission, or deletion.
  • Controller: The natural or legal person who alone or jointly with others determines the purposes and means of processing.
  • Processor: A person or entity that processes personal data on behalf of the controller.
  • Consent: Any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2. Controller

Controller within the meaning of the GDPR is: 

Ceres Heilmittel GmbH
Schloss Türnich
50169 Kerpen
Germany

Telephone: +49 2237 63803-0
Email: info@ceresheilmittel.de
Website: www.ceresheilmittel.de

Commercial register: HRB 69994, Cologne district court
VAT ID No.: DE274014467

Authorised managing director: Christoph Kalbermatten

 

3. Data Protection Officer

In accordance with Article 37 GDPR, we have appointed a data protection officer. You can reach them as follows:

Riccardo Loffreda
Ceres Heilmittel GmbH
Schloss Türnich
50169 Kerpen
Email: datenschutz@ceresheilmittel.de

4. General information on data processing

We process personal data only if there is a legal basis:

  • Article 6(1)(a) GDPR: Consent of the data subject
  • Article 6(1)(b) GDPR: Performance of a contract or pre-contractual measures
  • Article 6(1)(c) GDPR: Compliance with a legal obligation
  • Article 6(1)(f) GDPR: Protection of legitimate interests 

4.2 Data transfer to third countries

Some of the services we use transmit personal data to countries outside the EU (third countries). If these countries do not provide an adequate level of data protection recognised by the European Commission, we base the transfer on appropriate safeguards, in particular the standard contractual clauses of the European Commission (SCC) pursuant to Art. 46(2)(c) GDPR. Where a provider is certified under the EU-US Data Privacy Framework (DPF), the transfer to the USA is considered data-protection-compliant.

4.3 Storage period

Personal data will be deleted or blocked as soon as the purpose of storage ceases. Further storage takes place only insofar as European or national legal provisions require it.

5. Hosting and server log files

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The technical delivery is provided via the Vercel platform and the Vercel Edge Network. Depending on the user's location, content may be delivered via different data centre or edge locations; for accesses from Germany, delivery usually occurs via European edge locations (e.g. Frankfurt). The IP address 216.150.1.1 visible during technical checks is assigned to the Vercel network.

We have a data processing agreement with Vercel in the form of the Vercel Data Processing Addendum. If Vercel Inc. or subcontractors engaged by Vercel process personal data in third countries, especially in the USA, the transfer is based on appropriate guarantees pursuant to Art. 44 ff. GDPR, particularly the EU-U.S. Data Privacy Framework and/or the EU standard contractual clauses.

Each time our website is accessed, our system automatically records data and information from the calling computer:

  • IP address of the calling computer
  • Date and time of access
  • Name and URL of the retrieved file
  • Website from which access is made (referrer URL)
  • Used browser and operating system
  • Transferred data volume and HTTP status code

Note: According to the case law of the European Court of Justice (judgment of 19.10.2016, C-582/14 – Breyer), IP addresses are considered personal data.

Purpose of processing: Server log files
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and availability of the website)
Storage period: Max. 14 days

These data are not merged with other data sources.

For processing orders (checkout), we also use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. All data collected during the order process are processed on the servers of this provider. We have concluded a data processing agreement with the provider.

6. Contact form and email contact

If you contact us via the contact form or email, the data you transmit will be processed to handle your request.

Purpose of processing: Contact form / email inquiries
Legal basis: Art. 6(1)(b) GDPR (contract initiation) or Art. 6(1)(f) GDPR (legitimate interest)
Storage period: 6 months after final processing; statutory retention periods remain unaffected

Your data will not be passed on to third parties without your consent.

7. Newsletter

Newsletter subscription is done via double opt-in: After signing up, you will receive a confirmation email in which you must confirm your subscription by clicking a link.

Purpose of processing: Newsletter dispatch and recipient management
Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 7(2) no. 3 UWG
Storage period: Until revocation of consent (unsubscribe)

Purpose of processing: Double opt-in log (to prove consent)
Legal basis: Art. 6(1)(c) GDPR
Storage period: 3 years after unsubscribe

7.2 Brevo

We use Brevo (Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany) to send our newsletters.

We have concluded a data processing agreement with Brevo according to Art. 28 GDPR. Brevo processes your data exclusively on our behalf and according to our instructions.

Our newsletters contain a tracking pixel that records whether and when an email was opened and which links were clicked. We use this data exclusively to analyse and optimise our newsletter communication. Legal basis: Art. 6(1)(a) GDPR.

You can unsubscribe from the newsletter at any time — via the unsubscribe link in the newsletter or by email to info@ceresheilmittel.de.

Brevo Privacy Policy: https://www.brevo.com/de/legal/privacypolicy/

8. Professional area and DocCheck login

Our website has a password-protected professional area accessible exclusively to healthcare professionals. Access is via a dedicated CERES account or via the DocCheck service.

8.1 Registration and own account

During registration, we collect personal data such as name, professional title, and email address to verify professional status and manage access.

Purpose of processing: Registration and management of professional area account
Legal basis: Art. 6(1)(b) GDPR (professional area usage contract)
Storage period: Until account deletion upon request; then max. 3 years for evidential purposes

8.2 DocCheck

Alternatively, you can verify and log in via DocCheck. Provider: DocCheck AG, Im Mediapark 8, 50670 Cologne, Germany.

When using DocCheck, the following cookies are set:

Cookie: doccheck_user_id
Purpose / storage period: Single sign-on for all DocCheck logins / 1 session

Cookie: doccheck_scu_data
Purpose / storage period: Provision of suitable content based on pseudonymised key data (profession, country, language) / 1 year 

The information generated by DocCheck cookies is transmitted exclusively to DocCheck servers. There is no disclosure to third parties or data transfer outside the EU.

DocCheck Privacy Policy: https://more.doccheck.com/de/privacy/

9. Cookies and consent (TDDDG)

Our website uses cookies. Cookies are small text files stored in the cache of your browser that enable the recognition of your browser.

9.1 Technically necessary cookies

Technically necessary cookies are required for the operation of the website. They are set on the basis of § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR and do not require prior consent.

Cookies that are not technically necessary are only set with your explicit consent in accordance with § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You give your consent via our cookie consent banner on your first visit to the website.

You can revoke your consent at any time with effect for the future by accessing the cookie settings on our website.

Below we document the cookies and comparable storage technologies used on the website:
Cookie table

You can configure your browser so that cookies are only accepted on request or rejected entirely. Please note that disabling cookies may limit the functionality of this website.

10. Embedded YouTube videos

Our website embeds videos provided on YouTube. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you open a page with an embedded YouTube video, your browser establishes a connection to YouTube servers. YouTube is informed which page you visited. Assignment to your Google Account is possible if you are logged in.

Purpose of processing: Embedding YouTube videos
Legal basis: Art. 6(1)(a) GDPR (consent via cookie banner)
Storage period: According to Google's privacy policy; until revocation

YouTube videos are only loaded if you have consented to the use of services requiring consent in the cookie banner.

Google is certified under the EU-US Data Privacy Framework (DPF), ensuring an adequate level of data protection for transfers to the USA. EU standard contractual clauses (SCC) are also used.

Google/YouTube Privacy Policy: https://policies.google.com/privacy

11. Instagram content on our website

Our website includes content from the social network Instagram. Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

When loading Instagram content, a connection is made to Meta servers. Data may be transmitted to Meta even without an Instagram account.

Purpose of processing: Instagram feed on the website
Legal basis: Art. 6(1)(a) GDPR (consent via cookie banner)
Storage period: According to Meta's privacy policy; until revocation 

Instagram content is only loaded if you have consented to the use of services requiring consent in the cookie banner.

Meta is certified under the EU-US Data Privacy Framework (DPF). EU standard contractual clauses (SCC) are also used.

Meta/Instagram Privacy Policy: https://privacycenter.instagram.com/policy/

12. Therapist directory and interactive map

Our website features a therapist directory with an interactive map. The map is displayed using the Leaflet library (open source, no external data transfer). OpenStreetMap is used as the map service.

12.1 OpenStreetMap

Provider of the map service is the OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

When loading the map, your browser establishes a connection to servers of the OpenStreetMap Foundation. Your IP address is transmitted. The data processing takes place on servers within the EU or EEA.

Purpose of processing: Loading map material (OpenStreetMap)
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning map view in the therapist directory)
Storage period: According to OpenStreetMap privacy policy; no permanent storage by us

 OpenStreetMap Privacy Policy: https://osmfoundation.org/wiki/Privacy_Policy

12.2 Data in the therapist directory

The therapist directory contains personal data of therapists (name, professional title, location). This data is published only with the explicit consent of the respective person.

Purpose of processing: Publication of therapist data in the directory
Legal basis: Art. 6(1)(a) GDPR (consent of the registered person)
Storage period: Until revocation by the registered person

13. SSL encryption

This website uses SSL encryption for security reasons. You can recognise an encrypted connection by "https://" in the address bar and the padlock symbol in your browser.

 

14. Disclosure of personal data to third parties

Your personal data will only be disclosed to third parties if:

  • You have given your explicit consent (Art. 6(1)(a) GDPR)
  • The disclosure is necessary for the performance of a contract (Art. 6(1)(b) GDPR)
  • There is a legal obligation (Art. 6(1)(c) GDPR), or
  • The disclosure is necessary to safeguard legitimate interests (Art. 6(1)(f) GDPR).

Where we engage service providers in the context of order processing, we have concluded data processing agreements with them according to Art. 28 GDPR.

15. Your rights as a data subject

a) Right of access (Art. 15 GDPR)

You have the right to request information about whether and which personal data we process about you. 

b) Right to rectification (Art. 16 GDPR)

You have the right to request correction of incorrect personal data.

c) Right to erasure (Art. 17 GDPR)

You have the right to request deletion of your stored data, provided there is no statutory retention obligation.

d) Right to restriction of processing (Art. 18 GDPR)

You have the right to request restriction of the processing of your personal data, e.g. if you dispute the accuracy of the data or have objected to processing.

e) Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format.

f) Right to object (Art. 21 GDPR)

YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA BASED ON ARTICLE 6(1)(F) GDPR (LEGITIMATE INTERESTS). AFTER AN OBJECTION WE NO LONGER PROCESS THESE DATA, UNLESS THERE ARE COMPELLING LEGITIMATE GROUNDS WHICH OVERRIDE YOUR INTERESTS.

If processing is based on your consent, you have the right to withdraw it at any time with effect for the future. The lawfulness of the processing carried out until withdrawal remains unaffected.

h) Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for our company headquarters is:

Data Protection Officer of North Rhine-Westphalia (LDI NRW)

PO Box 20 04 44
40102 Düsseldorf
Telephone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de 

To exercise your rights, please contact us by email at info@ceresheilmittel.de or in writing at our address.

16. Reporting of adverse medicinal product effects (vigilance)

As a manufacturer of approved and registered medicinal products, Ceres Heilmittel GmbH is legally obliged to record, process, and if necessary forward reports of adverse medicinal product effects to the competent authorities (pharmacovigilance).

If you inform us about adverse effects of a CERES medicinal product – by contact form, email, or other means – we process the personal data required exclusively for this purpose. 

Purpose of processing: Recording and processing of reports of adverse medicinal product effects (pharmacovigilance)
Legal basis: Art. 6(1)(c) GDPR in conjunction with § 63c AMG, § 19 AMWHV (legal obligation for pharmacovigilance)
Storage period: At least 10 years after expiration of the last batch of the affected medicinal product placed on the market 

The categories of data that may be processed in the context of a report include: name and contact details of the reporting person, information about the affected person (initials, age, gender), described symptoms and effects, used medicinal product, concomitant medication.

If a report creates an official reporting obligation, the necessary data are forwarded in pseudonymised form to the competent authority (e.g. Federal Institute for Drugs and Medical Devices, BfArM). Personal data of the reporting person are not disclosed.

The processing of these data is subject to a legal obligation. An objection to this processing is therefore not possible if the legal requirements are met.

 

17. References and links to third-party websites

Our website contains links to external third-party websites. We have no influence on the content of these sites and their handling of personal data. This privacy policy applies exclusively to our website ceresheilmittel.de. We recommend you read the respective privacy policy before entering personal data on third-party sites.

 

18. Currency of this privacy policy

This privacy policy is current as of May 2026. Updates may be necessary due to modifications to our website or changes in legal requirements.