Privacy­policy

1. Controller

The party responsible for data processing on this website is
Mustermann Hair Salon, owner Lena, Musterstraße 1, 83xxx Musterdorf
Phone 08641 0000, e-mail info@mustermann.de

We have not appointed a data protection officer, because the legal requirements for one don’t apply to us. If you have questions, please contact us directly at the address above.

2. Hosting and server log files

This website is hosted by a provider with servers in Germany. Each time a page is opened, the server automatically records data that your browser sends. These are:

• Shortened IP address
• Date and time of access
• Name and address of the requested file
• Amount of data transferred and whether the request was successful
• Browser type and operating system

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in running the website without technical errors and keeping it secure. The log files are deleted after seven days. We have a data processing agreement with the hosting provider under Article 28 GDPR.

3. Encryption

This site uses SSL or TLS encryption. You can tell by the padlock in your browser’s address bar. It means that data you send us can’t be read by third parties along the way.

4. Cookies, fonts and visitor statistics

This website sets no cookies other than those that are technically necessary. We don’t use Google Analytics, advertising networks, social media plugins or external fonts that send data to third parties when the page loads. All fonts come from your own device. That’s also why you won’t see a cookie banner here.

5. Appointment requests via the form

If you send us a request using the form on the Appointment page, we process the details you enter. That means your name, phone number, your e-mail address if you choose to give it, the service you want, the person you’d like, your preferred day and time, and any note you add.

We use this data only to answer your request and arrange the appointment. The legal basis is Art. 6(1)(b) GDPR, because the processing is needed to take steps before entering into a contract.

If no appointment comes about, we delete the request after three months. If it does, the retention periods under tax and commercial law apply to the billed data, which is six to ten years.

6. Enquiries by phone, e-mail or answering machine

If you call us, leave a message on the answering machine or send an e-mail, we store your details so we can deal with your request. We don’t pass this data on without your consent. The legal basis is Art. 6(1)(b) GDPR for enquiries about appointments, and otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in answering you. We delete answering machine messages as soon as we’ve called you back.

7. Client records in the salon

For regular clients we keep a record card with name, phone number and the details that matter for the next treatment. That includes, for example, the color formula we used, the processing time and notes on any intolerances.

Details about intolerances or skin conditions are health data under Article 9 GDPR. We only store them if you expressly allow us to. The legal basis is then Art. 9(2)(a) GDPR. You can withdraw this consent at any time. Just tell us at your next appointment.

The records are kept in the salon and are not accessible to anyone else. We delete your entry once you haven’t been in for three years, or sooner if you ask us to.

8. Allergy test before color treatments

Before your first color or bleaching treatment we do an allergy test and document the result. This is for your safety and so we can show we did it. The legal basis is Art. 6(1)(c) and (f) GDPR in conjunction with the requirements of the EU Cosmetics Regulation.

9. Photos of hairstyles

If we’d like to photograph a result and show it on this site or on social media, we ask you first and get your written consent. The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent for the future at any time, and we’ll take the picture down. Without consent, nothing gets published.

10. Recipients of data

We only pass on your data if it’s needed to fulfill the contract or because the law requires it. Possible recipients are our hosting provider, our tax advisor and, for card payments, the payment service provider. No data is transferred to countries outside the European Union.

11. Your rights

You have the right at any time to:

• Access to the data stored about you under Article 15 GDPR
• Correction of inaccurate data under Article 16 GDPR
• Erasure under Article 17 GDPR, unless a retention obligation stands in the way
• Restriction of processing under Article 18 GDPR
• Data portability under Article 20 GDPR
• Object to processing under Article 21 GDPR
• Withdraw consent you have given, with effect for the future

A phone call or an e-mail is enough, we don’t need a form. We’ll reply within one month.

12. Right to complain to a supervisory authority

If you believe that the processing of your data violates the GDPR, you can complain to a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority), Promenade 27, 91522 Ansbach.

13. External links and maps

We currently don’t embed a map on the Contact page. If a map service is added in a later version, it will only load after you click on it, and there will be a separate notice in this section.

14. Changes to this policy

We update this privacy policy when our website or the law changes. The version published on this page always applies. Version date: January 2026.