Privacy policy

1. Controller

The party responsible for processing personal data on this website is:

Mustermann Beauty, owner Katharina Mustermann
Musterweg 4, 83xxx Musterdorf
Phone 08641 · 0000, email info@mustermann.de

No data protection officer has been appointed, because the legal requirements for one are not met.

2. Visiting the website and server log files

When you visit this website, the hosting provider automatically records information that your browser sends. This is:

• shortened IP address of the requesting device
• Date and time of access
• Name and URL of the file requested
• amount of data transferred and a message on whether the request succeeded
• browser and operating system used
• website from which you came

Purpose: Keeping the site running without problems, investigating misuse and finding errors.
Legal basis: Art. 6(1)(f) GDPR, legitimate interest in running the website securely.
Storage period: The log files are deleted after seven days at the latest.

3. Hosting

This website is hosted by a service provider with servers in Germany. We have a data processing agreement with the provider under Art. 28 GDPR.

4. Appointment requests and contact form

If you send us an appointment request through the form, we process the details you enter. That means your name, phone number, email address if given, the treatment you want, your preferred date and any notes you choose to add.

Purpose: Handling your request and arranging an appointment.
Legal basis: Art. 6(1)(b) GDPR, because the processing is needed to take steps before a contract.
Storage period: Requests that don’t lead to an appointment are deleted after six months. If an appointment is made, the periods in section 5 apply.

5. Information about your skin and health

To treat you safely, we ask about skin conditions, allergies, medication and a possible pregnancy. This is health data and therefore a special category of personal data under Art. 9 GDPR.

Purpose: Choosing a treatment that suits you and avoiding harm to your health.
Legal basis: Art. 9(2)(a) GDPR, your explicit consent. You give it in writing on the skin history form in the studio. Giving this information in the online form is voluntary.
Storage period: We keep skin history forms for as long as you come to us for treatment and for three years after that, so that possible claims can be checked.

You can withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before you withdrew it.

6. Contact by phone and email

If you call or write to us, we process your details to deal with your request. The legal basis is Art. 6(1)(b) GDPR for requests related to a contract, otherwise Art. 6(1)(f) GDPR. Voicemail messages are deleted once they’ve been dealt with.

7. Appointment reminders

If you like, we’ll send you a text message the day before to remind you of your appointment. This is based on your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time without any formalities.

8. Invoices and retention

We keep invoices and accounting records for eight or ten years under § 147 of the German Fiscal Code (Abgabenordnung) and § 257 of the German Commercial Code (Handelsgesetzbuch). The legal basis is Art. 6(1)(c) GDPR, compliance with a legal obligation.

9. Cookies and visitor statistics

This website sets no cookies that require consent. No analytics services, no ad networks and no fonts or scripts from third-party servers are loaded. Every part of the site is delivered from our own server.

10. Recipients of your data

We don’t pass your data on to third parties unless it is needed to fulfil a contract or we are required to by law. Recipients may be the hosting provider, the provider of our email account, our tax advisor and, in case of a dispute, lawyers or courts. Data is not transferred to countries outside the European Union.

11. Your rights

You have the right at any time to:

• Access to the data stored about you under Art. 15 GDPR
• Correction of inaccurate data under Art. 16 GDPR
• Deletion under Art. 17 GDPR, unless a duty to retain the data prevents it
• Restriction of processing under Art. 18 GDPR
• Data portability under Art. 20 GDPR
• Withdrawal of consent you have given under Art. 7(3) GDPR

Right to object: Where we process data on the basis of legitimate interests under Art. 6(1)(f) GDPR, you can object to the processing under Art. 21 GDPR if there are reasons arising from your particular situation.

12. Right to lodge a complaint

You have the right to complain to a data protection supervisory authority. The responsible authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach.

13. Encryption

This website uses SSL or TLS encryption. You can tell by the padlock in your browser’s address bar. This means data you send through the form can’t easily be read by third parties.

14. Last updated

This privacy policy was last updated in January 2026. If the processing or the legal situation changes, we’ll update it.