Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Collection and Storage of Personal Data

We collect personal data when you voluntarily provide it to us as part of your booking, when contacting us, or when using our website.

2.1 Automatically Collected Data

When using our website, the following data is automatically collected:

• •IP address (anonymized)
• •Date and time of request
• •Browser type and version
• •Operating system
• •Referrer URL

2.2 Contact Form

When you use our contact form, the following data is collected: name, email address, phone number (optional), your message. This data is used to process your inquiry and deleted after completion of the inquiry or after expiration of legal retention periods.

2.3 Appointment Booking

When booking an appointment, the following data is collected: name, email address, phone number (optional), desired treatment, date and time. This data is used to conduct and manage your appointment.

3. Cookies

Our website uses cookies. Cookies are small text files that are stored on your device.

3.1 Technically Necessary Cookies

These cookies are required for the operation of the website and cannot be switched off in our systems. They are usually only set in response to actions made by you, such as language settings or cookie preferences.

3.2 Analytics Cookies

With your consent, we use analytics cookies (Vercel Analytics) to understand how visitors use our website. This data helps us improve our website.

4. External Services

4.1 Hosting (Vercel)

Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes technical data that is generated when accessing the website. We have concluded a Data Processing Agreement (DPA) with Vercel.

4.2 Vercel Analytics

We use Vercel Analytics to analyze user behavior on our website. No personal data such as IP addresses is stored. The analysis is carried out anonymously.

4.3 Supabase

We use Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992 for storing appointment bookings. Supabase processes the data provided during booking. We have concluded a Data Processing Agreement with Supabase.

4.4 WhatsApp Link

Our website contains a link to WhatsApp. When you click this link, you will be redirected to WhatsApp. Data processing is carried out by WhatsApp Ireland Limited. We do not receive any data by clicking the link.

4.5 Instagram Link

Our website contains a link to our Instagram profile. When you click this link, you will be redirected to Instagram. Data processing is carried out by Meta Platforms Ireland Limited.

5. Legal Basis

The processing of your personal data is based on the following legal grounds:

• •Art. 6 para. 1 lit. a GDPR (Consent) – for analytics cookies and marketing
• •Art. 6 para. 1 lit. b GDPR (Contract performance) – for appointment bookings and contact requests
• •Art. 6 para. 1 lit. f GDPR (Legitimate interest) – for providing the website and technically necessary cookies

6. Retention Period

We store your personal data only for as long as necessary to fulfill the respective purpose or as required by legal retention periods. Booking data is stored for the duration of the business relationship and thereafter in accordance with legal retention obligations (up to 10 years).

7. Your Rights

You have the following rights regarding your personal data:

• •Right of access (Art. 15 GDPR)
• •Right to rectification (Art. 16 GDPR)
• •Right to erasure (Art. 17 GDPR)
• •Right to restriction of processing (Art. 18 GDPR)
• •Right to data portability (Art. 20 GDPR)
• •Right to object (Art. 21 GDPR)

8. Withdrawal of Consent

If you have given consent to data processing, you can revoke this at any time with effect for the future. The lawfulness of the processing carried out on the basis of the consent until the revocation remains unaffected. You can change your cookie settings at any time via the link in the footer of our website.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR. The supervisory authority responsible for us is:

10. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy to ensure that it always complies with current legal requirements or to implement changes to our services.