Email: hello@cardasun.com
Website: www.cardasun.com
Data protection is of a particularly high priority for the management of Cardasun GmbH in Gründung (i.Gr.). The use of our website is generally possible without providing personal data. However, if a data subject uses certain services via our website, such as our contact form, processing of personal data may become necessary.
The processing of personal data shall always be in line with the General Data Protection Regulation (GDPR) and in accordance with the data protection regulations applicable to Cardasun GmbH in Gründung (i.Gr.). By means of this Privacy Policy, we inform data subjects of the nature, scope and purpose of the personal data we collect, use and process, as well as of the rights to which they are entitled.
Controller for the purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:
Cardasun GmbH in Gründung (i.Gr.)
Rudower Chaussee 29
12489 Berlin
Germany
This website is created and hosted using the services of Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, the Netherlands ("Framer"). When our website is accessed, technical data required to deliver the website and to ensure the security and stability of the service may be processed. This may include, in particular, the IP address, date and time of access, the requested page or file, referrer information, browser type and version, and operating system.
The processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and technically reliable provision of our website.
Framer uses Amazon Web Services (AWS) infrastructure. Personal data may therefore be processed outside the European Economic Area. Where personal data is transferred to a third country, such transfer takes place in accordance with Chapter V GDPR, in particular on the basis of an adequacy decision, including the EU-U.S. Data Privacy Framework where applicable, or the Standard Contractual Clauses of the European Commission.
We may use Framer's built-in analytics functions to obtain statistical information about the use of our website. Framer Analytics is designed as a privacy-first analytics service and does not use cookies or persistent identifiers. The information provided may include, for example, page views, referring sources, countries, device types, browsers, operating systems and estimated session duration.
The processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the statistical evaluation and improvement of our website. We do not use Google Analytics or comparable third-party tracking tools unless separately stated.
Our website provides a contact form. If you contact us using this form, the personal data entered by you (Name, Email and Message) will be transmitted to us and processed for the purpose of handling and responding to your request.
Where your request relates to the performance of a contract or to steps prior to entering into a contract, the legal basis for the processing is Article 6(1)(b) GDPR. In all other cases, the processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in responding to enquiries addressed to our company and communicating with interested parties, business partners and other contacts.
The data will not be disclosed to third parties without a legal basis. Technical processing by service providers used to operate the website and contact form may take place on our behalf.
If you contact us by email, the personal data transmitted with your email will be processed for the purpose of handling and responding to your request. Depending on the subject of the communication, the processing is based on Article 6(1)(b) GDPR or Article 6(1)(f) GDPR. Our legitimate interest lies in responding to enquiries and maintaining business communication.
We process and store personal data only for the period necessary to achieve the purpose of the processing or for as long as storage is required by applicable law. If the purpose of storage no longer applies or a statutory retention period expires, the personal data will be routinely erased or restricted in accordance with the legal requirements.
Under the GDPR, data subjects have, subject to the respective legal requirements, the following rights:
the right of access pursuant to Article 15 GDPR;
the right to rectification pursuant to Article 16 GDPR;
the right to erasure pursuant to Article 17 GDPR;
the right to restriction of processing pursuant to Article 18 GDPR;
the right to data portability pursuant to Article 20 GDPR;
the right to object pursuant to Article 21 GDPR; and
where processing is based on consent, the right to withdraw consent at any time pursuant to Article 7(3) GDPR, without affecting the lawfulness of processing based on consent before its withdrawal.
Where the processing of personal data is based on Article 6(1)(f) GDPR, the data subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her.
Without prejudice to any other administrative or judicial remedy, each data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data relating to him or her infringes the GDPR.
The supervisory authority responsible for Cardasun is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany
Email: mailbox@datenschutz-berlin.de
We reserve the right to amend this Privacy Policy where this becomes necessary due to changes to our website, the services we use or applicable legal requirements. The current version of the Privacy Policy is available on our website.
Get in touch.
Developing next-generation sun care? Looking to invest in novel UV technology or explore a strategic partnership? Get in touch with us.
@ CARDASUN 2026