Social Media Pivacy Policy

Status: 12/2025

We maintain online presences on various social networks and platforms. Below, we would like to inform you about the data collected by these platforms and by us, the purposes of such data collection, the legal basis, recipients, and your rights.

1. PRELIMINARY NOTICE

We would like to point out that you use our content and the interactive features provided (e.g., commenting, sharing, rating) at your own responsibility.

Alternatively, you can find the information/products etc. offered through our social networks on our website at www.malikadams.com.

You are also welcome to contact us at any time for further information via email at info@malikadams.com.

2. CONTROLLERS

Joint controllers within the meaning of Article 26 GDPR and other national data protection laws of the member states as well as other data protection regulations for our social media platforms are:

18ZEHN. GmbH
Marco Volk
Benedikt-Schwarz-Strasse 2
76275 Ettlingen
Email: info@18-zehn.de

and the company named below for each respective network:

Facebook:

Meta Platforms Ireland Limited
4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Supervisory authority: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.
Further information on data protection:
https://www.facebook.com/policies/cookies
https://www.facebook.com/about/privacy

As Facebook’s data protection practices are currently highly controversial, Facebook has provided additional terms for business tools:
https://de-de.facebook.com/terms
https://www.facebook.com/legal/terms/businesstools

Instagram:

Meta Platforms Ireland Limited
4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Supervisory authority: Data Protection Commission, Dublin.
Privacy information:
https://help.instagram.com/519522125107875
https://help.instagram.com/1896641480634370?ref=ig

The business tools from Facebook may also be connected to Instagram.
Additional terms for business tools:
https://www.facebook.com/legal/technology_terms

YouTube:

YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.
YouTube LLC is a subsidiary of Google LLC.
EU controller: Google Ireland Ltd., Gordon House, 4 Barrow St., Dublin, D04 E5W5, Ireland.
Privacy information:
https://policies.google.com/privacy?hl=de
https://policies.google.com/?hl=de
https://policies.google.com/technologies/product-privacy?hl=de

TikTok:

TikTok Technology Limited
10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
Authorized representative (Germany): Fieldfisher Plog Partnerschaft mbB, Hamburg.
Privacy information:
https://www.tiktok.com/legal/privacy-policy?lang=de
https://www.tiktok.com/legal/tiktok-website-cookies-policy?lang=de-DE

3. GENERALLY COLLECTED DATA

By visiting our presence on the respective social network, your IP address and further information are stored. Additional information arises from the data listed in Section 4 (which we process) and the data processed by the respective network (see Section 6). Some data is stored using cookies on your device.

Cookies are small text files stored by your browser on your device, which enable certain information to be sent to us. Cookies cause no damage and contain no viruses.

If you wish to avoid data usage by the social network, you should log out of it, disable “stay logged in”, delete cookies, and restart your browser before visiting our page again.
Please note that without logging in, interactive functions will not be available.

You can also disable cookies through your browser settings, but this may prevent access to our social media page.

4. DATA COLLECTED BY US IN SOCIAL NETWORKS

4.1 Facebook

We have entered into several agreements with Facebook regarding the protection of personal data:

• Joint controller addendum (Art. 26 GDPR)
https://www.facebook.com/legal/terms/page_controller_addendum

• Data processing terms (processor agreement under Art. 28 GDPR)
https://www.facebook.com/legal/terms/dataprocessing

• EU data transfer addendum (standard contractual clauses for controller-to-processor transfers)
https://www.facebook.com/legal/EU_data_transfer_addendum

4.1.1 Page Insights

We use statistical evaluations (Page Insights) provided by Facebook, which cannot be disabled or modified. As a result, we receive anonymized statistical data regarding:

• Page views, broken down by areas, age, gender, city, device
• Post views, subscriptions, tags, recommendations, comments, shares, reactions, clicks
• Negative feedback (e.g., spam reports or hiding content)
• Interactions with shops, events, buttons (route planning, website, phone number, etc.)
• Demographics (estimated from IP or user profile), language, device, user agent, referrer
• Event data including ticket sales or engagement
• Performance data for stories, live videos, posts, etc.

Facebook receives the data in non-anonymized form.

Legal bases:
• Art. 89 GDPR, § 27 BDSG, Art. 9(1), Art. 22(2)(2) GDPR (statistical purposes, anonymized)
• Art. 6(1)(f) GDPR (legitimate interest in marketing and optimization)

Purpose: to analyze user behavior, optimize content, and tailor posts to target groups.

Retention:
• Statistical data for 7 days (actions, views)
• Statistical data for 2 months

If you do not want this, adjust settings at:
https://www.facebook.com/settings

4.1.2 Interactions/Messages

We collect content, communications, and information you provide when you interact with our fan page. This includes:

• Messages, hashtags, comments
• Content and timing of interactions
• Depending on your profile settings, your networks, groups, shared content, photos, posts, etc.

Sensitive data under Art. 9 GDPR may be disclosed by you. We process such data only in anonymized form.

Legal basis for interactions: Art. 6(1)(a) GDPR (your voluntary interaction as consent).
Statistics are stored for 26 months.

Messages sent to us through Facebook are processed under Art. 6(1)(f) GDPR (responding to inquiries) or Art. 6(1)(b) if relating to a contract.

Messages are deleted once a conversation ends, or after legal retention periods if contract-related (usually 10 years).

4.1.3 Use of Facebook Interfaces

If we use Facebook tools (Like button, Facebook Connect, API/SDK/Pixel), the following may be transmitted to Facebook:

• Device info
• Websites visited
• Purchases made
• Ads viewed
• Interaction patterns

We also process:

• Likes/interactions
• Transactions when referred to our shop
• Log data when using Facebook login

Legal basis: Art. 6(1)(a) GDPR (consent).

You can prevent data capture by not using Facebook login, not clicking like buttons, etc.

4.1.4 Events

We use Facebook “Events”. If you have liked our page, we may invite you. You may interact by sharing, liking, commenting, or marking interest.

If events involve external ticket sites (e.g., Eventbrite), these providers also process data.

We evaluate participant numbers and interactions for better event planning.

Legal bases:
• Art. 6(1)(b) GDPR (participation bookings)
• Art. 6(1)(a) (interactions, comments)
• Art. 6(1)(f) (interest analysis, planning)

Data retention: 2 years.

4.1.5 Live Videos

When watching our live videos, Facebook collects whether you watched longer than 3 seconds, interactions, comments, shares, reactions, etc.

We may restrict comments to reduce misuse.

We analyze:

• Viewer counts
• Comments and questions
• Shared content
• Reactions
• Poll responses

Legal bases:
• Art. 6(1)(a) GDPR (interactions, poll participation)
• Art. 6(1)(f) GDPR (target group selection, inquiries)

Messages via Messenger during the live stream fall under Art. 6(1)(f).

4.1.6 Facebook Jobs (Applications)

If you apply via Facebook, email, or post, we process all information necessary for evaluating your application:

• Application documents (CV, cover letter, certificates)
• Photo (not analyzed for sensitive data)
• Contact data (email, phone number, etc.)
• Facebook questionnaire data (education, experience, certifications)

We do not use sensitive data unless legally required (disability, gender for legal compliance).

Legal bases:
• Art. 6(1)(b) GDPR (employment decision)
• Art. 6(1)(f) GDPR (defending claims)
• Art. 6(1)(a) GDPR (voluntarily provided extra info)

Retention:
• Successful applications: duration of employment + up to 3 years
• Rejections: 6 months after refusal; longer if in legal proceedings.

4.1.7 Purchase of Gift Vouchers

If you buy gift vouchers, we forward required data to external platforms (e.g., SumUp, Ecwid, MyTreat).
Legal bases: Art. 6(1)(b), 6(1)(c), 6(1)(f) GDPR.

Retention: 6–10 years depending on legal obligations.

4.1.8 Facebook Stories

You may like, share, or comment on our stories. We process content and timestamps of interactions.

Legal basis: Art. 6(1)(a) GDPR.

Only we as authors see comments, but Facebook also processes the data.

4.1.9 Posts about Offers or Discounts

If you save or interact with an offer, we and Facebook may collect:

• Interest in offer
• Purchases, calls, messages
• Required contract processing data

Legal basis:
• Art. 6(1)(f) GDPR (requests)
• Art. 6(1)(b) GDPR (contract initiation or fulfillment)

Retention according to commercial regulations: 6–10 years.

4.1.10 Other

4.1.10.1 Connection with WhatsApp

If you click a WhatsApp button/ad, we process:

• First name, last name
• Mobile number
• Profile picture
• Status
• Message content

Legal basis: Art. 6(1)(a) GDPR (consent).
If contract-related: Art. 6(1)(b).

Messages are deleted once no longer needed.

WhatsApp Ireland Limited may transfer data outside the EU (e.g., to the USA). We have no influence over their processing.
Sensitive data should not be sent via WhatsApp.

4.1.10.2 Call-to-Action Buttons

You may request appointments or book services.
We may send confirmations or reminders.
If you request an offer, additional info may be requested (type of service, time, phone number).

Legal basis follows the same rules as for applications and purchases.

4.1.10.3 Lead Generation

Ads may link to forms where we may request:

• Contact details (email, number, address, country)
• User information (name)
• Demographics (DOB, gender, marital status, relationship status, military status)
• Business details (job title, company info)
• ID number

Facebook may auto-fill this if you have filled similar forms before.

Data may be connected to our CRM.

Legal basis: Art. 6(1)(a) GDPR (consent).

You may withdraw consent at any time.

4.2 Instagram

Instagram is a service offered by Facebook. However, in order to avoid confusion, we will continue to use the term “Instagram” below, even when referring to the operator.

4.2.1 Page Insights

We use the statistical analyses (“Page Insights”) provided to us by the social network. We currently cannot deactivate or modify these. As a result, we collect the following data:

• Statistical figures regarding user actions: visits to our profile, our website, our posts, clicks on our buttons or the route planner, interactions with our posts as well as the type of interaction/reaction.

• Interactions include, depending on the type of post, tags, comments, shares or saves of our content, negative feedback such as marking as spam or hiding, likes, exits or tapping to the next stories, clicks on links.

• Further statistics: acquisition of new followers through our posts, reach, average percentage of video content viewed.

Additionally, data about our target group is collected: top locations, average age, gender, most active times, interests, etc.

According to Instagram, no insights are generated in the EU concerning messages.

If we post live videos, stories or other content, performance data is analyzed based on the above-mentioned information.

We receive the evaluations anonymized, while Instagram receives the data non-anonymized. Whether someone is logged in is determined via cookies (see cookie policy: ). Without logging in, most actions are not possible—visiting a page or tapping a photo/video to view it is possible.

Legal basis:
For the collection of the above data by us for statistical purposes: Art. 89 GDPR and, where sensitive data is concerned, § 27 BDSG in conjunction with Art. 9(1) and Art. 22(2)(2) GDPR.
We only receive anonymized data.
An additional legal basis is Art. 6(1)(a) GDPR.
Consent is given by accepting the terms of use of the respective social network and interacting with our content there.

Purpose:
We use the data to understand which posts you interact with (or not). This enables us to build and expand our target audience and provide relevant events, information and optimized content. Reach and post statistics show which posts performed best; action and post statistics help us encourage more interaction; call statistics help tailor content to our audience.

Deletion:
The data is available for up to 2 years. As noted, we currently have no ability to opt out of statistical data collection. If you do not want this, you may adjust the settings at: https://www.instagram.com/accounts/privacy_and_security/.
Otherwise, please contact Instagram directly.

4.2.2 Interactions/Messages (“Instagram Direct”)

We collect content, communications and information you provide when visiting our page and interacting with us. We therefore process the contents you send (hashtags, messages, etc.) and the type of interaction. We process the message content and the timestamp.

If you have an Instagram account, your interaction may allow us to view your network (subscriptions), connections and content posted by you (posts, etc.). Sensitive data under Art. 9 GDPR may be disclosed.

If we use this data, it is to learn more about our customer base and tailor our marketing/products accordingly. We may mention your username, posts or interactions in our posts (e.g. stories) if they serve as reviews for us.

Your data may be visible to us, Instagram, connected partners/companies, subscribers, users who share/comment, and anyone who views our page or the pages of those interacting with us.

Legal basis: Art. 6(1)(a) GDPR.
Consent is provided by voluntarily interacting with our page and by accepting Instagram’s terms.

Data is normally deleted when our page is deleted or deactivated. You may remove your connections by removing likes, etc. If we receive a withdrawal of consent and can delete your data, we will do so.
Statistics are stored for 24 months.

You may limit data collection via Instagram privacy settings:
https://www.instagram.com/accounts/privacy_and_security/.

Messages sent via Instagram Direct:
We store name/username, profile picture, and—if you send videos, audio or images—the information contained therein (image, voice, etc.).
Legal basis: Art. 6(1)(f) GDPR (responding to inquiries).
If the message aims at contract conclusion: Art. 6(1)(b) GDPR.
Messages are deleted when the conversation ends; if related to a contract, they are stored per legal retention periods (usually 10 years).

4.2.3 Use of Instagram Interfaces

If we use Instagram tools that integrate with Instagram (Like-Button, API/Pixel, shop-related tools), information is shared with Instagram such as visited websites, purchases, and usage—regardless of login status.

We process:

• Type of interactions (likes)

• Transaction info when redirected to our shop

Purpose: learn more about our customer base, tailor advertising/products, measure ad effectiveness, and promote products.

Data is visible to us, Instagram, partners, and people interacting with our page.

Legal basis: Art. 6(1)(a) GDPR.
You consent by voluntarily interacting with the tools and accepting Instagram’s terms.

Data collection may be avoided by making purchases directly on our website or disabling likes.

4.2.4 Live Videos

We use “Live Videos”/“Live Rooms”. If you view them, your data is collected, including whether you watched more than 3 seconds. We see viewer numbers and likes.

Live videos may include fundraising features; proceeds go 100% to the nonprofit.

Comments during live videos are visible to all viewers and linked to you.

We may invite viewers to join the live video.

We collect: viewer count, comment content, number/type of reactions.

Purpose: learn about viewers, tailor content, generate donations.

Legal basis:
Art. 6(1)(f) GDPR for marketing interest.
Viewer count is collected anonymously.
Likes and comments are processed on basis of Art. 6(1)(a) GDPR (implicit consent via interaction).
Fundraising: Art. 6(1)(f) GDPR (legitimate interest in charitable purpose).

Data is visible to Instagram, partners and people interacting.

You may avoid data collection by not commenting. Data is removed upon account deletion.
Privacy settings may reduce data collection.

4.2.5 Shop

We use Instagram’s “Shop” tool.

You may be redirected to our website (https://mica-shop.de) to make purchases. For data processed there, see our website privacy policy.

If you message us about a product, we collect: name, possibly company, address.

You may save, share, view or forward products.

We collect, store and process this data for contract performance, customer identification, order processing, correspondence, invoicing, and claims management.
If logged in to Instagram, we also receive Instagram interaction data (clicks, actions) and your message information. If not logged in, we receive only anonymized product interaction statistics.

Legal basis:
Messages: Art. 6(1)(f) GDPR (inquiry), or Art. 6(1)(b) GDPR (contract).
General data processing: Art. 6(1)(f) GDPR (marketing).
Product interactions (likes, shares, etc.): Art. 6(1)(a) GDPR.

We may share contract-related data with:
a) shipping providers,
b) debt collection/lawyers (legitimate interest),
c) tax consultants.

Instagram also collects data about product interests.

Contract-related data is stored for 6/8/10 years depending on commercial law. Longer storage is possible due to legal obligations or explicit consent.

4.2.6 Instagram Stories

We use “Stories”. You may like, share, comment, and interact.

We process the content of your messages/interactions and timestamps to understand our followers and tailor marketing/products.

Only we see your reactions/comments, but Instagram processes the data as well.

We may link stories with:

• Polls (shows who voted for what)

• Question stickers

• Quizzes

• Donations (we see amount donated and total sum)

• Challenges

• Countdowns

• Music

• Location

• Hashtags

• Time/weather

• Mention stickers

Legal basis: Art. 6(1)(a) GDPR via voluntary interaction and acceptance of Instagram terms.

Consent may be withdrawn; data is deleted where possible.

4.2.7 Other

4.2.7.1 Contact & Action Buttons

Our profile may include call, SMS or email buttons. By clicking, you contact us through the chosen medium.

Action buttons allow booking or reservations via Instagram partners.

Legal basis:
Art. 6(1)(f) GDPR (inquiry).
If contract-related: Art. 6(1)(b) GDPR.

Data is deleted when the conversation ends or after legal retention periods if contract-related.

4.2.7.2 Reels and Guides

We use Reels (up to 30s videos) and Guides (recommendations). We can see interactions.

Legal basis: Art. 6(1)(a) GDPR.

4.2.7.3 Branded Content

We use branded content to tag business partners. We receive compensation.
All related interaction data is transmitted to partners.

Legal basis: Art. 6(1)(b) GDPR.

4.2.7.4 Promotion

We use Instagram Ads for more profile views, website visits or messages. Ads target groups based on location, interests, age, gender.

Legal basis: Art. 6(1)(a) GDPR.

4.2.7.5 Nametags

We use Nametags (QR codes). Scanning them has the same effects as following our profile.

4.3 YouTube

We upload videos to our YouTube channel and use its statistical analyses.

We collect:

• number of views and subscribers

• traffic sources

• interactions (watch time, top videos)

• audience insights (viewers, returning viewers, activity times, demographics, other watched videos/channels, countries, languages)

We receive anonymized statistics.

Additionally, for fans, non-fans (“dislikes”), commenters, sharers, we receive usernames, profile images, timestamps, ratings, and publicly visible account information.

Subscribing results in YouTube notifying you of new uploads.

Purpose: evaluate effectiveness of videos, optimize content.

Legal basis: Art. 6(1)(a) GDPR (consent via YouTube use).

Videos may be promoted to audiences chosen by YouTube; we may link videos to Google Ads for remarketing and measurement.

Legal basis (Ads): Art. 6(1)(f) GDPR.

Statistical data is available for 5 years; interaction data is deleted when our page is deleted.

4.4 TikTok

4.4.1 Page Insights

We collect:

• interactions (comments, likes, video views, profile views, shares, followers)

• demographic follower data (gender, location, activity) if >100 followers

Stats are anonymized for us; TikTok receives raw data.

Legal basis: Art. 89 GDPR (statistics), Art. 6(1)(a) GDPR (consent).

Purpose: understand interactions, build audience, optimize posts.

Data is available for up to 60 days.

4.4.2 Interactions/Messages

We collect content and interactions such as likes, comments, mentions, follows, duets, stitches.
We can view your public profile and linked profiles.

We may mention you, duet with your videos or reuse them via stitch.

Data is visible to TikTok, partners, commenters, viewers.

Legal basis: Art. 6(1)(a) GDPR.

Messages:
Name/username, profile image, videos you send, etc.
If necessary for contract: Art. 6(1)(b) GDPR; otherwise: Art. 6(1)(f) GDPR.

Retention: 60 days in stats; messages kept until conversation ends or per contract law.

5. RIGHTS OF DATA SUBJECTS TOWARD US

We note that most data reaches us anonymized; only data we directly collect can be matched to you.

You have the following rights:

5.1 Rights toward us

• Access (Art. 15 GDPR)

• Rectification (Art. 16 GDPR)

• Erasure (Art. 17 GDPR)

• Restriction (Art. 18 GDPR)

• Data portability (Art. 20 GDPR)

• Withdrawal of consent

• Objection (Art. 21 GDPR)

Requests must be sent to the controller indicated under section 2.

You may complain to the Berlin Commissioner for Data Protection:
Friedrichstr. 219, 10969 Berlin, www.datenschutz-berlin.de.

5.2 Facebook

We forward requests concerning Insights data to Facebook Ireland as required.
Facebook Ireland is responsible for processing Insights data.

5.3 Other networks

Other networks have not fully implemented mechanisms; please assert rights directly there as well.

6. PROCESSING BY THE SOCIAL NETWORK & DATA TRANSFERS

Social networks process extensive data. We cannot state scope, recipients, retention, purposes; please refer to each network’s privacy policy.

Transfers may occur outside the EU, including the USA, currently considered inadequate per the ECJ.

You also have GDPR rights toward each network.

6.1 Facebook

Privacy: see and .
Facebook stores data until account deletion or until no longer needed. Disabled accounts may be stored for a year.

Data is transferred to the USA; we rely on available agreements.

6.2 Instagram

Privacy: https://help.instagram.com/519522125107875 and others.
Instagram may link IP addresses to users despite anonymization.
Data is stored until account deletion or required otherwise.

Transfers to USA occur as part of Meta.

6.3 YouTube

Privacy: see Google policies.
Retention varies by data type.

Transfers to the USA occur under Google’s structure.

6.4 TikTok

Privacy: see TikTok policies.
Data may be stored in China and the USA.

7. CHANGES TO THIS PRIVACY POLICY

We may update this policy in line with legal changes or to better meet your needs. Please refer to the version date.