Privacy Policy

We take the protection of your personal information seriously. This Privacy Policy explains how we collect, use, disclose, and protect information about consumers in connection with this website and online store.

Important structural note – separate businesses: DR. KURT WOLFF GMBH & CO. KG, incorporated and registered in Germany with the commercial register of the local court in Bielefeld, Germany under HRA 11533 and its registered office at Johanneswerkstrasse 34-36 33611 Bielefeld, Germany (“Dr. Wolff”) operates and provides this website and its content.

For all processing activities by Dr. Wolff described in this Privacy Policy (other than the checkout described in Part B), Dr. Wolff USA Distribution Inc., 228 Park Avenue S #25124 New York, NY 10003 USA (“Dr. Wolff US”), a wholly-owned subsidiary registered in the USA, acts as a sub-processor and service provider to Dr. Wolff, assisting with website operation, analytics, marketing, and customer service as described herein.

The checkout of the webshop (including conclusion of the purchase contract, payment, fulfillment) is operated by FIC SHARECO LIMITED incorporated and registered in England and Wales with company number 05016010 whose registered office is at Icon 1, 7-9 Sunbank Lane, Altrincham, WA15 0AF (“THG”), which acts as the seller to customers and as a separate controller for the processing at checkout.

Dr. Wolff and THG act independently unless expressly stated otherwise, and share/receive data as described below to provide customer service and marketing.

Last updated: April, 2026

A. Dr. Wolff – Website, marketing, and customer service

I. Who we are and scope

Business: DR. KURT WOLFF GMBH & CO. KG, Johanneswerkstraße 34–36, 33611 Bielefeld, Germany.
Contact for privacy: dpo@drwolffgroup.com
Scope: personal information collected via our US website and related features (browsing, analytics, marketing, newsletters, embedded content, reviews) and customer service for purchases. Checkout, payment, and fulfillment are handled by THG (see Part B).
In all activities described in this Section, Dr. Wolff US acts as a service provider/sub-processor on behalf of Dr. Wolff.

II. Categories of personal information we collect

Identifiers and contact details: name, email address, postal address, phone number, online identifiers (cookies, device IDs, IP address).
Internet or network activity and device data: pages viewed, clicks, scrolls, referring URLs, timestamps, language, browser/OS, screen resolution, error diagnostics.
Commercial information: order and communications data we may receive from THG to provide customer service and conduct marketing analysis (e.g., order ID, items purchased, delivery status, inquiry history).
Geolocation data: approximate location derived from IP address.
Inferences: inferred preferences/interests.
User‑generated content: product reviews and ratings.
Sensitive personal information: we do not seek to collect sensitive personal information via our website. Payment card data and similar information are handled by THG during checkout.
Wherever this Privacy Policy refers to the collection or processing of your personal information by Dr. Wolff, such collection or processing may also be performed by Dr. Wolff US as a service provider and subsidiary, strictly on behalf of Dr. Wolff.

III. Sources of personal information

Directly from you (forms, newsletter sign‑up, communications, reviews).
Automatically from your device/browser (including through cookies, pixels, SDKs, and similar technologies).
From service providers, partners, and platforms that support our site, advertising, and analytics.
From THG (limited customer/order and communications data to provide customer service and, where permitted, marketing/market analysis).

IV. How we use personal information

Provide, operate, maintain, and improve the website and its features.
Customer service: respond to inquiries about orders, delivery, returns/warranty questions, and related support; communicate with you and keep records of interactions.
Measure, analyze, and optimize site performance and content; detect and fix errors; conduct A/B testing.
Marketing and advertising, including cross‑context behavioral/targeted advertising, where permitted by law and your choices.
Prevent fraud and abuse; ensure security and integrity of our systems.
Comply with legal obligations and enforce our terms.

V. Cookies and similar technologies; consent and controls

We use cookies, pixels, local storage, and similar technologies to operate the site, remember preferences, perform analytics, and support advertising.
You can manage cookies via our cookie banner/settings and your browser settings. If you block cookies, some features may not work.
Global Privacy Control (GPC) and universal opt‑out signals: where required by applicable US state law (e.g., California, Colorado), we honor recognized browser‑based opt‑out signals for sale/sharing/targeted advertising.
We use a consent/choice management platform (OneTrust) to record your preferences (data captured may include IP address, timestamp, a pseudonymous ID, and your selected settings). Consent logs are typically retained for 12 months.

VI. Web analytics, monitoring, and optimization

Purposes: evaluate visits and interactions; identify technical errors; optimize design/content; conduct A/B tests. Data categories may include pseudonymous usage and interaction data, device/technical data, IP address, referrer URL, date/time; where feasible we use IP masking.

Service providers used (examples):

Google services (e.g., Google Analytics, Google Ads, DoubleClick)

International processing may occur. See Google’s privacy information for details.

Sentry (Functional Software Inc., San Francisco, USA) for error monitoring and stability.
Microsoft Clarity (Microsoft Corporation, Redmond, USA) for heatmaps and session replays to understand behavior and improve our site. Provider storage typically up to 13 months.

VII. Remarketing and conversion tracking

We use services to present interest‑based ads, analyze interactions, and measure campaign performance on other sites/platforms. Categories include pseudonymous usage data, device information, interests, demographic segments, and location data where enabled.

Service providers used (examples):

Google services (Analytics, Ads, Remarketing, DoubleClick)
TikTok Analytics
Adform
Outbrain Amplify
Taboola
Facebook Custom Audiences (Meta)
Pinterest Conversion Insights Note on state privacy laws: our use of advertising cookies and tags may constitute “sharing” (CA) or “targeted advertising” (CO/CT/VA and others). You can opt out as described under Your Privacy Rights.

VIII. Advertising emails and newsletters

Email delivery and marketing platform: Klaviyo, Inc., 225 Franklin St., Boston, MA 02110, USA. Klaviyo processes your email address and related engagement data (e.g., opens, clicks, unsubscribe events) to deliver and measure our emails.
With your consent or as otherwise permitted by law, we send marketing emails about offers and products. You can unsubscribe at any time via the link in each email or by contacting us.
We may use tracking pixels/unique IDs (via Klaviyo) in emails to understand engagement. If your email client blocks images by default, tracking is limited.
CAN‑SPAM: we include our sender information and an easy unsubscribe in every marketing email.

IX. Data we are granted access to by THG for customer service, marketing, and market analysis

Separation of responsibilities: THG operates checkout, payment, and fulfillment as an independent business. Dr. Wolff provides customer service for purchases; marketing, and market analysis. For that purpose, THG grants access to necessary customer/order and communications data to Dr. Wolff as described below.
Categories accessed (as far as strictly necessary):
- For customer service: identification and contact details (e.g., name, email, postal address, phone), order details (e.g., order ID, items purchased, delivery status, returns/warranty data), and communications history (e.g., prior inquiries and responses).
- For marketing/market analysis (where permitted): identification and contact details and limited purchase metadata (e.g., product categories, purchase date, order value).
Purposes:
- Customer service: respond to and resolve your inquiries about orders, delivery, and product issues; communicate updates; maintain records for quality and compliance.
- Direct marketing by Dr. Wolff (where permitted by law and subject to your choices); market analysis (e.g., aggregate/pseudonymous evaluations to improve offerings).
Your choices:
- Customer service: using your data for customer service is necessary to address your requests and support post‑purchase needs. We do not use customer‑service data for cross‑context behavioral advertising unless you separately allow it.
- Marketing: you can opt out of Dr. Wolff direct marketing at any time (unsubscribe link or email haircoach@usa.alpecin.com). Where applicable state law treats such use as “sale/share” or “targeted advertising,” you can exercise opt‑out rights as described below.

X. Disclosures of personal information We disclose personal information to:

Service providers/contractors who process data on our behalf (e.g., hosting, email delivery via Klaviyo, analytics and advertising technology, security, support).

· Dr. Wolff US, as a wholly-owned subsidiary and sub-processor/service provider, may access or process personal information solely for the purposes and under the instructions of Dr. Wolff, including all activities described above.

Advertising and analytics partners to support measurement and cross‑context advertising subject to your choices and applicable law.
Authorities and others as required by law or to protect rights and safety.
Parties to business transactions (e.g., merger, acquisition).

We do not sell personal information for money. We may “share” personal information for cross‑context behavioral advertising as defined by California law and/or process it for targeted advertising under other state laws. We do not knowingly sell or share personal information of consumers under 16 years of age.

XI. Security We implement reasonable administrative, technical, and physical safeguards to protect personal information. Transmissions are encrypted with TLS/SSL where applicable. No method of transmission or storage is 100% secure.

XII. Data retention We keep personal information only as long as reasonably necessary to fulfill the purposes outlined or as required by law. Illustrative periods:

Web server logs: up to 12 months.
Cookie/analytics data: typically 13–26 months depending on provider settings.
Consent logs (cookie/marketing): 12 months.
Marketing contact data via Klaviyo: until you opt out or after a defined inactivity period.
Customer service records: for the period necessary to resolve the request and comply with legal/operational requirements.
Reviews: for the life of the product page, unless you request deletion. Actual retention may vary depending on legal, operational, and security needs.

XIII. Children’s privacy Our services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided personal information, contact us to request deletion. We do not knowingly sell or share personal information of consumers under 16.

XIV. Your privacy rights (US state laws, including California) Depending on your state of residence, you may have some or all of the following rights. We will honor requests as required by applicable law.

Right to know/access: request disclosure of the categories and specific pieces of personal information we collected, the sources, purposes, and categories of third parties to whom we disclosed it.
Right to delete: request deletion of personal information we collected from you, subject to exceptions.
Right to correct: request correction of inaccurate personal information.
Right to portability: request a copy of certain information in a portable format.
Right to opt out of sale/share/targeted advertising: opt out of the “sharing” of personal information for cross‑context behavioral advertising (CA) and of targeted advertising/sale under other state laws.
Right to limit use/disclosure of sensitive personal information (CA): we do not use sensitive personal information for purposes that require a right to limit; if that changes, we will provide a method to limit.
Right to appeal (e.g., CO/CT/VA): if we deny your request, you may appeal by replying to our decision email or contacting dpo@drwolffgroup.com; we will inform you in writing of our decision and how you can contact your state attorney general if you remain unsatisfied.
Non‑discrimination: we will not discriminate against you for exercising your privacy rights.

How to exercise your rights

Submit a request: email dpo@drwolffgroup.com or use our web form (if available on the site). For California, you may also use the “Your Privacy Choices” or “Do Not Sell or Share My Personal Information” link in the site footer to opt out of sale/share.
Verification: we may need to verify your identity (e.g., by matching information you provide with information we maintain). Authorized agents may submit requests on your behalf; we may require proof of authorization and verification of your identity.
Opt‑out preference signals: where required by law, we recognize browser‑based signals such as Global Privacy Control (GPC). If we can associate a signal with your account or device, we will apply it to that browser/device and, where feasible, to your account.
Timing: we aim to respond within the timeframes required by law (e.g., 45 days, extendable as permitted).

California disclosures (CCPA/CPRA)

Categories collected in the past 12 months: identifiers and contact details; internet/network activity; device data; commercial information (including limited order and communications data received from THG for customer service); geolocation (approximate); inferences; user‑generated content.
Categories disclosed for business purposes: all of the above to service providers/contractors and as otherwise described.
Sale/share: we do not sell personal information for money. We “share” identifiers, internet/network activity, device data, and inferences with advertising partners for cross‑context behavioral advertising unless you opt out.
Financial incentives: we do not offer financial incentive programs for personal information. If we introduce such programs, we will provide a separate notice describing the material terms.

Nevada residents

We do not sell “covered information” as defined under Nevada law. You may submit a request directing us not to sell by contacting dpo@drwolffgroup.com.

B. THG – Checkout and fulfillment (Separate controller)

THG acts as the seller to customers and as an independent business for all processing of personal information in connection with checkout, payment, and order fulfillment. THG is responsible for providing its own US privacy disclosures and honoring applicable US state privacy rights for checkout‑related data.

I. Controller and contact

Business name: FIC Shareco Limited
Address: Icon 1, 7-9 Sunbank Lane, Altrincham, WA15 0AF
Contact email: customer.experience@thehutgroup.com
Site: Alpecin US THG
California: See below

II. Scope and purposes of checkout processing (by THG)

We collect personal data from you when you provide it to us directly and through your use of the Site. We also automatically collect personal data related to your use of the Site and interactions with us and others, e.g. using cookies and pixel tags, as well as information we derive about you and your use of the Site. The personal data we process includes the following categories of data: identification and contact data; delivery/billing address; order details; payment method and transaction data; device and network information collected during checkout; fraud/risk signals.
Depending on how you use the Site, your interactions with us, and the permissions you give us, the purposes for which we use your personal data include: Contract execution (performance of a contract); payment processing and delivery (performance of a contract); fraud prevention and security (legitimate interests); and compliance with legal obligations such as tax and record-keeping requirements.

III. Disclosures and state‑law choices (by THG)

We rely on the following legal bases under data protection law to process your personal data:

Recipients: payment processors; logistics/fulfillment partners; IT hosting and infrastructure; fraud/identity verification services; authorities where required by law.
Disclosures to Dr. Wolff: THG provides necessary customer/order and communications data to Dr. Wolff so that Dr. Wolff can perform customer service for purchases and, where permitted, marketing/market analysis (see Section A.IX). THG will present appropriate choices and honor opt‑outs before disclosing data for marketing.
Sale/share and targeted advertising: THG will disclose whether it sells or shares personal information or engages in targeted advertising, and how consumers can opt out (including honoring GPC/universal signals where required).
Retention: THG will disclose retention periods or criteria by category, consistent with applicable laws.
THG will provide methods for consumers to exercise access, deletion, correction, and opt out rights (including “Do Not Sell or Share My Personal Information” where applicable), and an appeals process where required.

IV. Recipients and categories of recipients

We may share your personal data with third parties, for the purposes described above, in the following circumstances:

With other companies in our group of companies.
With our suppliers and service providers who process the data on our behalf, e.g., payment processors.
With our professional and legal advisors.
With third parties engaged in fraud prevention and detection.
With third party platforms, providers and networks. We may disclose or make available personal data to third party platforms and providers that we use to provide the Site and its features. We may also make personal data available to third parties in support of our marketing, analytics, advertising and campaign management.
With law enforcement or other governmental authorities, e.g., to report a fraud or in response to a lawful request.
To comply with legal obligations. We may share personal data with third parties to comply with our legal and compliance obligations and to respond to legal process e.g. in response to subpoenas, court orders, and other lawful requests by regulators and law enforcement and government bodies. This may include responding to national security or law enforcement disclosure requirements and disclosures that we are required to make under applicable laws, such as the names of sweepstakes and contest winners.
Otherwise, where we have your consent or are legally permitted to do so.

V. International data transfers

We use service providers, and have group companies, in countries around the world. Your personal data may therefore be processed in countries outside of Europe, including in countries where you may have fewer legal rights in respect of your data than you do under local law. If we transfer personal data outside your territory we will ensure that your privacy rights are adequately protected by appropriate safeguards. Please contact us if you would like more information about these safeguards.

VI. Retention

We will keep your personal data in line with our data retention policy, for as long as we need it for the purposes set out above, so this period will vary depending on your interactions with us.

VII. Security

We implement appropriate technical and organisational security safeguards to protect your data from loss, misuse, and unauthorised access, disclosure, alteration and destruction. We also maintain ISO 27001 and PCI DSS (Payment Card Industry - Data Security Standard) security certifications.
However, please be aware that it is impossible for any company to guarantee the absolute security and integrity of the information that has been transmitted to its website.

VIII. Children

The Site is not intended for, and should not be used by, children under the age of 18. We do not knowingly collect personal data from children under 18.

IX. Data subject rights vis‑à‑vis THG

You have choices regarding our processing of your personal data as described in this section.
Your rights under GDPR include the rights of access, rectification, erasure, restriction, portability, objection. Common rights include the right to:
- Ask for a copy of your personal data, make corrections to your personal data, and in some cases e.g. where our purposes for processing have come to an end, ask us to delete it.
- Object to our use of your personal data in certain situations, including where we use your personal data for direct marketing.
- Transfer your personal data, in certain circumstances, to another provider, in a commonly used format.
- Complain to the data protection regulator in your country.
We will comply with any requests to exercise your rights in accordance with applicable law.
You can exercise your rights by contacting customer.experience@thehutgroup.com.

X. Cookies and Personalisation

Cookies and tracking technologies. We and our third party service providers use cookies, pixels, local storage objects, log files, APIs, and similar technologies to automatically collect browsing activity, device and similar information within the Site.
We use this information to provide functionality on the Site, to understand and measure Site performance, to understand how users access, use and interact with others, and to deliver targeted advertising and content on our Site and third party sites.
We also use it to identify and resolve bugs and errors in the Site and to assess, secure, protect, optimise and improve the performance of the Site.
Manage your preferences. You can manage your preferences for cookies and personalisation used by us as explained below.
Cookie preference tool. You can review and update your cookie preferences for the Site and opt out of most cookies and trackers on the Site (other than those that are strictly necessary) within the Cookie Preference Tool. Your preferences are browser and device specific so you need to set the preference for each browser and device you use to access the Site. If you delete or block cookies, you may need to reapply these preferences.
Please note that opting out of cookies and trackers on the Site does not mean that you will no longer see ads from us. You may continue to see generic or “contextual” ads.

XI. Changes to this Notice

This Notice is current as of the Effective Date stated above. We may change this Notice from time to time, so please be sure to check back periodically. If we make material changes we will alert you e.g. by posting a prominent notice on the Site or via email.

XII. Contact Us

If you have any queries on any aspect of our Privacy Notice, please contact us at customer.experience@thehutgroup.com.

California Privacy Supplement

Consumers residing in California have additional rights in relation to their personal information under California privacy law, including the California Consumer Privacy Act (“CCPA”). If you are a California resident, this section applies to you. This section does not address or apply to our handling of publicly available information or other personal information that is exempt under the CCPA.

Categories of personal information collected and disclosed. Whilst our processing of personal information varies based upon our relationship and interactions with you, the table below identifies, generally, the categories of personal information (as defined by the CCPA) that we may collect, and have in the past twelve months collected, about California residents, as well as the categories of third parties to whom we may disclose this information for a business or commercial purpose.

Categories of Personal Information and Third Party Disclosures

1. Identifiers

Description
Includes direct identifiers, such as name, alias, user ID, username, account number or unique personal identifier; email address, phone number, address and other contact information; IP address and other online identifiers.