Skip to content
Glimpii Doku
Back to home

Privacy Policy

Last updated: 23 October 2026

This is a translation of our German privacy policy for your convenience. In case of any discrepancy, the German version prevails.

1. Overview

This privacy policy applies to the website glimpii-doku.de and to the studio application at app.glimpii-doku.com (together, "Glimpii Doku"). It explains which personal data we process there, for what purpose, on what legal basis, and what rights you have.

The essentials first:

  • Without your consent we set only strictly necessary cookies. Audience measurement (Google Analytics) and advertising tracking (Meta Pixel, TikTok Pixel, Google Ads) run only if you have actively agreed in the cookie banner — each selectable separately — and can be withdrawn at any time.
  • Our servers are operated by Hetzner Online GmbH in their Falkenstein data centre (Germany). Database backups are stored in Hetzner Object Storage in Helsinki (Finland). Both locations are in the EU.
  • Data a studio records in Glimpii Doku about its own customers — in particular the treatment documentation — is processed by us solely on that studio's instructions. The studio, not us, is the controller for that data. See section 12.

2. Controller

The controller for data processing on this website and in the application is:

Glimpii your lash studio assistant UG (haftungsbeschränkt)
Altenberger Straße 148
51381 Leverkusen, Germany

Represented by: Daniela Sciuto
Phone: 01732765844
E-mail: go@glimpii.com

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

We have not appointed a data protection officer; the statutory conditions for doing so do not currently apply to us. For all data protection matters please contact us at the address above.

3. General information and mandatory disclosures

Basics

We treat your personal data confidentially and in accordance with statutory data protection provisions and this privacy policy. Personal data is any data by which you can be personally identified.

Please note that data transmission over the internet — for example when communicating by e-mail — can have security gaps. Complete protection of data against access by third parties is not possible.

Legal bases

We process personal data on one of the following bases:

  • Consent — Art. 6(1)(a) GDPR, and additionally Section 25(1) TDDDG where information is accessed on your device. All marketing and analytics services run on this basis (section 11). You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing carried out until then.
  • Contract and pre-contractual measures — Art. 6(1)(b) GDPR, for example for registration, user account and billing.
  • Legal obligation — Art. 6(1)(c) GDPR, for example for commercial and tax retention duties.
  • Legitimate interest — Art. 6(1)(f) GDPR, for example for secure technical operation, defence against attacks and error analysis. The relevant interest is named at each individual processing activity.

Which basis applies in each case is stated at the relevant processing activity below.

Recipients of personal data

We disclose personal data only where this is necessary to perform a contract, where we are legally obliged to do so, where you have consented, or where another legal basis permits it. Where we use processors, we do so under a contract pursuant to Art. 28 GDPR. Where joint controllership exists, we say so separately (section 11).

The service providers to which personal data may flow are named individually in this policy. We use no others beyond those named.

Transfers to third countries

Some of the services named in section 11, our CRM (section 10) and the communication services in section 14 also process data in the USA. Since 10 July 2023 an adequacy decision of the European Commission is in place for the USA, but it applies only to companies certified under the EU-U.S. Data Privacy Framework (DPF). You can check whether a company is certified in the official participant list: https://www.dataprivacyframework.gov/list.

Where no such certification exists, we base the transfer on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Which basis applies to which service is stated below.

Please note that despite these safeguards US authorities may under certain conditions access personal data, and that legal protection fully comparable to the European standard cannot be guaranteed in every case.

Retention

Unless a more specific period is stated in this policy, your personal data remains with us until the purpose of processing no longer applies. If you assert a legitimate request for erasure or withdraw consent, we delete the data concerned unless other legally permissible grounds for storage exist — for example commercial or tax retention periods. In that case we delete once those grounds cease to apply.

Encryption

The website and the application are available exclusively over a TLS-encrypted connection (recognisable by "https://" in the address bar and the padlock symbol in your browser). Requests over unencrypted HTTP are redirected to HTTPS automatically.

4. Hosting and delivery

Hetzner

We host the website and the application with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany ("Hetzner"). The servers are located in the Falkenstein data centre (Germany). Automatic backups of our databases are stored in Hetzner Object Storage in Helsinki (Finland). No processing outside the EU takes place in this context.

The legal basis is Art. 6(1)(f) GDPR. We have a legitimate interest in the reliable and secure provision of our service. A processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

Details are set out in Hetzner's privacy policy: https://www.hetzner.com/de/legal/privacy-policy/.

Server log files

When you access our pages, our system automatically collects and stores information that your browser transmits:

  • browser type and version
  • operating system used
  • referrer URL
  • host name of the accessing computer
  • date and time of the server request
  • IP address

This data is not merged with other data sources and is not evaluated to identify individuals. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in technically faultless delivery, troubleshooting and defence against attacks. The logs are deleted automatically after seven days.

5. Cookies and consent management

What we store

Cookies are small data packets your browser stores on your device. They cause no damage there. Session cookies are deleted at the end of your visit; persistent cookies remain until they expire or you delete them.

Strictly necessary cookies are set without consent. They are required for operation; the legal basis is Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR, or — where they serve performance of the usage contract — Art. 6(1)(b) GDPR:

  • glimpii-doku-consent — stores your cookie decision. First-party cookie, lifetime 180 days on glimpii-doku.de and 24 hours on app.glimpii-doku.com. It contains the names of the consents granted and, on glimpii-doku.de, a random identifier that lets us evidence your decision (see "Evidence of your decision" below); no user data. The identifier is not handed over to the application.
  • authjs.session-token or __Secure-authjs.session-token — your signed-in session in the user account, lifetime 30 days.
  • authjs.csrf-token, authjs.callback-url, authjs.state, authjs.pkce.code_verifier — protect the sign-in process against manipulation and are no longer needed once it completes.
  • AUTH_SESSION_ID, KEYCLOAK_IDENTITY, KEYCLOAK_SESSION, KC_RESTART — session cookies of our self-hosted sign-in service at auth.glimpii-doku.com (section 6).
  • glimpii_signup_event — a one-off marker after a registration so that conversion measurement counts the event exactly once. Lifetime one hour; without statistics or marketing consent it is never evaluated.

Statistics cookies and marketing cookies are set only after your consent, and you can give the two categories independently of one another. They are listed individually in section 11.

Cookie banner and withdrawal

On your first visit to glimpii-doku.de you receive a notice allowing you to accept or decline optional cookies individually. Already on its first layer it names the services involved, states that Google, Meta and TikTok also process data outside the European Economic Area, and that Meta and TikTok may combine it into usage profiles. On both layers of the notice you can reject all optional cookies with one click. The categories "Leistung und Analytik" (performance and analytics) and "Marketing" are switched off by default; neither a statistics nor a marketing service is loaded without your active choice.

If we later add a new category, we ask for your consent again: the notice reappears with your previous selection pre-filled. A consent given earlier cannot cover a purpose that was not shown to you at the time.

You can change your decision at any time using the "Cookie-Einstellungen" button in the footer of glimpii-doku.de. Withdrawing consent is therefore as easy as giving it. If you withdraw either consent there, two things happen:

  • No further tags of the category concerned are executed; a "denied" signal is transmitted to Google, Meta and TikTok.
  • The cookies of the category concerned are deleted from your device: for "Marketing" _fbp, _fbc, _ttp, _tt_enable_cookie as well as _gcl_au and _gcl_aw; for "Leistung und Analytik" _ga and _ga_XDW6LB2LMG. Cookies that Meta or TikTok set under their own domains (such as _ttp on tiktok.com) are technically beyond our reach; please remove those in your browser settings.

In the studio application at app.glimpii-doku.com, statistics and marketing tracking run only for as long as the consent handed over from the website applies there; that hand-over expires after 24 hours at the latest (see below). Cookies the pixels previously stored on app.glimpii-doku.com are, however, not removed by a withdrawal made on glimpii-doku.de — please delete those in your browser.

You can delete cookies already set yourself at any time in your browser settings. You can also configure your browser to notify you about cookies or to reject them entirely; the functionality of our service may be limited as a result.

Evidence of your decision

We must be able to demonstrate that consent was given (Art. 7(1) GDPR). We therefore also store every decision you make in the cookie banner on glimpii-doku.de, or change later, in our database. An entry contains:

  • which optional categories you granted and which you declined ("Marketing", "Leistung und Analytik" and the embedded eRecht24 withdrawal form),
  • whether it is your first decision or a change,
  • the version of the notice and the language it was shown in,
  • the date and time it was stored,
  • a random identifier your browser generates with your first decision and keeps in the glimpii-doku-consent cookie. It links later changes to your first decision; it does not reveal who you are.

We do not store your IP address, details of your browser or device, or the page you visited. To protect against entries submitted in bulk, the server counts in memory, for at most ten minutes, how many entries come from one IP address; that count is not stored anywhere.

The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 5(2) and Art. 7(1) GDPR (accountability and the duty to demonstrate consent). Each entry is deleted after 42 months: a decision applies for up to six months, and its evidence has to cover the three-year limitation period that follows. The entries are held in our database at Hetzner in Germany and in its backups in Helsinki (section 4), which are overwritten after 30 days.

Because the identifier does not let us identify you, we can only find your entries for an access request if you tell us the identifier from the cookie (Art. 11 GDPR).

Handing the decision over to the application

The website and the application are on different domains, so a shared cookie is technically impossible. When you follow a link from glimpii-doku.de into the application, we therefore append your existing decision to the target address as a glimpii-doku-consent parameter. The application stores it there in its own cookie with a lifetime of 24 hours and immediately removes the parameter from the address bar. If you have made no decision, nothing is handed over.

If you have consented to "Marketing" or to "Leistung und Analytik", we use the same route to also hand over the advertising and analytics identifiers your consent covers (parameter glimpii-doku-attribution; details in section 11 under "Attributing registrations to advertisements"). Without one of these two consents no identifier is handed over, only the decision itself.

6. User account and sign-in

A user account is required to use Glimpii Doku. On registration we collect first name, last name and e-mail address, plus a password of your choosing. Where a studio owner creates an account for a member of staff, we collect the same details plus the role in the studio, job titles and form of address.

Accounts are managed by our self-hosted sign-in service (Keycloak) at auth.glimpii-doku.com. It runs on the same infrastructure as the rest of the service (section 4); no additional external recipient arises from it. Passwords are stored only as a cryptographic hash and are not readable by us.

The legal basis is Art. 6(1)(b) GDPR. We store account data for as long as the account exists. If you delete your studio account in the settings, the accounts and the associated studio data are irreversibly removed; statutory retention periods — in particular for invoicing records — remain unaffected.

After registration we use your e-mail address to inform you about material changes to the scope of the service or about technically necessary adjustments.

7. Contract data and billing

Studio and contract data

To establish and perform the usage contract we process the details of your studio (name, street, postal code, city, phone number, e-mail address), the modules you have booked and the status of your subscription. The legal basis is Art. 6(1)(b) GDPR, and additionally Art. 6(1)(c) GDPR for the retention of invoicing records in conjunction with commercial and tax retention periods (generally ten years).

Stripe

Payments are handled by Stripe. The provider for customers within the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe").

To take out a subscription we redirect you to a checkout page operated by Stripe. You enter your payment details — card details, for instance — directly with Stripe; we neither receive nor store them. Stripe reports back to us only a customer number, a subscription number, the status and the term dates. To manage your subscription (change payment method, cancel) we likewise redirect you to Stripe.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR insofar as a smooth and fraud-resistant payment process is concerned. Stripe may transfer data to its US parent company; the transfer is based on the European Commission's Standard Contractual Clauses.

Details: https://stripe.com/de/privacy.

8. E-mail delivery

System messages — such as confirming your e-mail address, resetting your password and confirming an invoice — are sent via the transactional e-mail service of Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France. In doing so Scaleway processes your e-mail address, the content of the message and the technical delivery data. Delivery takes place within the EU; no transfer to a third country occurs.

The legal basis is Art. 6(1)(b) GDPR where the message is necessary to perform the contract, otherwise Art. 6(1)(f) GDPR (reliable delivery of operationally necessary messages).

9. Error and performance analysis in the application

While you use the application, a script we operate ourselves (Grafana Faro) reads technical information in your browser and sends it to our own servers: the address of the page called, error messages, load-time measurements, and the family of your browser and operating system.

When it loads, the script only checks whether your browser's storage is available; the test entry it creates for this holds no information about you and is deleted immediately. Beyond that, nothing is stored on your device, no cookie is set, and no identifier is created that could recognise you across visits.

This access is strictly necessary to provide the application free of errors (§ 25 (2) no. 2 TDDDG). The further processing is based on our legitimate interest in stable and fast operation (Art. 6 (1)(f) GDPR). The data stays on our servers, is not passed to third parties, and is deleted after seven days.

10. Customer relationship management (CRM)

When a studio registers with us or the status of its subscription changes, we transfer the associated contact details to our CRM system, GoHighLevel. The provider is HighLevel LLC, 5473 Blair Rd Ste 100, PMB 383313, Dallas, Texas 75231-4227, USA (a subsidiary of GoHighLevel Inc.).

Transferred are: first name, last name, e-mail address, studio name, the treatment categories booked, and the contract and customer status. Treatment documentation and data about studio customers are not transferred.

The purpose is servicing our business customers and administering the contractual relationship. The legal basis is Art. 6(1)(b) GDPR in conjunction with Art. 6(1)(f) GDPR (efficient customer service). A processing agreement pursuant to Art. 28 GDPR is in place with HighLevel. HighLevel is certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is based on the European Commission's adequacy decision.

Details: https://www.gohighlevel.com/privacy-policy.

11. Audience measurement and advertising tracking

We base all services described in this section exclusively on your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG; we expressly do not rely on legitimate interest for this processing. They are embedded through Google Tag Manager, which we load only after you have agreed to the marketing category in the cookie banner. Your consent can be withdrawn at any time (section 5).

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Tag Manager is an administration tool through which the services named below are embedded. It creates no user profiles of its own and sets no cookies of its own. It does, however, record your IP address, which may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework.

Google Analytics 4

We embed Google Analytics 4 through Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the property "glimpii-doku" with measurement ID G-XDW6LB2LMG, which is used exclusively for glimpii-doku.de and app.glimpii-doku.com.

Google Analytics records event data on every page view and on completion of a registration, and transmits it to Google. This includes the page called up, date and time, referrer, technical details about browser and device, and your IP address. According to Google, the IP address is used only to derive an approximate location and is not stored permanently in Google Analytics 4. The purpose is evaluating the use of our service and measuring the success of our advertising.

Google Analytics is loaded only if you have allowed at least one of the two optional categories. What happens then depends on your selection:

  • With consent to "Leistung und Analytik", Google Analytics sets the cookies _ga and _ga_XDW6LB2LMG on your device. They contain a randomly generated identifier through which repeat visits are combined into a session and a usage history; only that makes statistics beyond the single page view possible. The lifetime is 24 months from the most recent visit.
  • Without that consent — that is, if you allowed only "Marketing" — we transmit to Google the signal that analytics storage is denied. Google Analytics then places no cookie and does not recognise you beyond a single page view; the access data described above nevertheless reaches Google.
  • If you allowed neither category, Google Analytics is not loaded at all.

A transfer to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission's adequacy decision. A processing agreement pursuant to Art. 28 GDPR is in place with Google. Google deletes user-level event data after 14 months at the latest — the longest retention period configurable in Google Analytics 4.

Details: https://policies.google.com/privacy?hl=en.

Google Ads

The Google Analytics property named above is linked to our Google Ads account (conversion ID AW-18402983610). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The link serves advertising performance measurement only: Google Analytics reports to Google Ads that a registration took place after an ad click. That transmission happens at Google, between the two services, not through an additional script on our website.

If you arrive through one of our ads, Google appends a click identifier to the destination address (the gclid parameter, known as auto-tagging). With your marketing consent this identifier is stored in the cookies _gcl_au or _gcl_aw (lifetime 90 days) and associated with the registration. Without marketing consent it is not stored.

No remarketing takes place. We embed no Google Ads remarketing tag and build no advertising audiences from your visit; the Google addresses required for that are technically blocked on our website.

The legal basis is your consent under section 25(1) TDDDG and Art. 6(1)(a) GDPR.

Meta Pixel

We embed the Meta Pixel (Facebook Pixel) through Tag Manager. The provider for users in the EU is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The pixel is loaded on every page you call up after giving consent and reports a page view to Meta each time. It additionally reports the completion of a registration as a conversion. Transmitted are the address called up, date and time, your IP address, details about browser and device, and the identifiers from the pixel cookies. Meta can thereby associate your visit with your Meta account if you are signed in there. The purpose is measuring the success of our advertisements.

The pixel sets the cookies _fbp (lifetime up to 90 days) and, when you arrive via an advertisement, _fbc.

Joint controllership: For the collection of this data and its transmission to Meta, we and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR). The joint controllership is limited to collection and transmission; Meta's subsequent processing is not part of it. The joint obligations are set out in an agreement: https://www.facebook.com/legal/controller_addendum. Under it, we are responsible for the privacy information and for the data-protection-compliant integration, and Meta for the security of the Meta products. You may assert data subject rights regarding data processed by Meta directly with Meta; if you assert them with us, we forward them to Meta.

Meta transfers data to the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework; in addition, Meta bases the transfer on the European Commission's Standard Contractual Clauses: https://www.facebook.com/legal/EU_data_transfer_addendum.

Details: https://www.facebook.com/privacy/policy/.

TikTok Pixel

We embed the TikTok Pixel through Tag Manager. The provider for the European Economic Area is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

Like the Meta Pixel, the TikTok Pixel is loaded on every page you call up after giving consent and reports a page view; it additionally reports the completion of a registration as a conversion. Transmitted are the address called up, date and time, your IP address, details about browser and device, and the identifiers from the pixel cookies. The purpose is measuring the success of our advertisements on TikTok.

Among others, the pixel sets the cookies _ttp (lifetime up to 13 months) and _tt_enable_cookie.

Joint controllership: For the collection of the event data and its transmission to TikTok, we and TikTok Technology Limited are joint controllers (Art. 26 GDPR). Here too the joint controllership is limited to collection and transmission.

TikTok also transfers personal data to recipients outside the European Economic Area, including to the USA, Singapore and the People's Republic of China. TikTok bases these transfers on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR; there is no certification under the EU-U.S. Data Privacy Framework. A level of protection fully equivalent to European standards cannot be guaranteed for these countries in every case. If you do not want this, do not give consent to marketing cookies, or withdraw it via "Cookie-Einstellungen"; the TikTok Pixel is then not loaded.

Details: https://www.tiktok.com/legal/page/eea/privacy-policy/en.

Attributing registrations to advertisements

So that we can measure which advertisement led to a registration, we store the advertising and analytics identifiers you arrived with when a studio account is registered – in each case only as far as your consent covers them:

  • with consent to "Marketing": the click identifiers an advertisement appends to the website's address (fbclid, ttclid, gclid, gbraid, wbraid), and the identifiers from the cookies _fbp, _fbc and _ttp;
  • with consent to "Leistung und Analytik": the identifiers from the cookies _ga and _ga_XDW6LB2LMG.

Click identifiers in the address of a page you open are kept by the website in your browser's session storage until the end of the browser session, for as long as your consent to "Marketing" stands; withdrawing it deletes them there immediately. When you follow a link into the application, the identifiers are handed over as described in section 5, held there in a cookie for at most 24 hours until registration, and stored in our database at registration together with your consent at that moment. If you have withdrawn your consent in the meantime, we store nothing.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The identifiers are deleted 90 days after registration, and immediately when the account is deleted. At present we do not pass them on to anyone. Before we transmit them to Meta, TikTok or Google to measure advertising success, we will update this privacy policy.

12. Processing on behalf of studios

Glimpii Doku is software for hygiene and treatment documentation. Studios record in it data about their own customers — name, contact details, information about allergies and intolerances, treatment histories, hygiene checks and signatures.

For that data the individual studio is the controller, not us. We process it exclusively on the studio's instructions as a processor pursuant to Art. 28 GDPR and do not use it for our own purposes. Information about allergies and treatment histories is health data within the meaning of Art. 9 GDPR; the legal basis for processing it is the studio's responsibility — as a rule your explicit consent pursuant to Art. 9(2)(a) GDPR.

If you are a customer of a studio, please direct requests for access, rectification or erasure to the studio that treated you. Only the studio can decide about that data; without its instruction we may neither disclose nor delete it. We are happy to forward your request to the studio.

Signature page

To confirm a treatment record, a studio may show you a one-time link on app.glimpii-doku.com, usually as a QR code. On the page it opens you enter your name and sign on screen. We store your name, the signature image, the timestamp and a checksum over the signed content; the checksum later proves that the document has not been altered after the fact. The link is valid for one hour and expires once signed.

This processing likewise takes place on the studio's behalf. No sign-in is required, and no marketing services are loaded on that page.

Erasure

If a studio deletes its access, we remove the associated customer data and treatment documentation in full. A studio can anonymise individual customer records: the personal details are removed while the treatment history is retained without any personal reference, because the studio needs it to meet its documentation obligations.

13. Withdrawal button

We embed a withdrawal button ("Widerrufsbutton") on our website to comply with consumer law requirements. It is provided by eRecht24 GmbH & Co. KG, Lietzenburger Straße 93-95, 10719 Berlin ("eRecht24"). eRecht24 processes incoming withdrawals exclusively on our behalf and does not use the data for its own purposes; a processing agreement pursuant to Art. 28 GDPR is in place.

By default the button is a plain link to the withdrawal form hosted by eRecht24, which opens in a new tab — merely visiting our page establishes no connection to eRecht24. Only if you agree to the corresponding option in the cookie banner do we additionally load a script from eRecht24 that opens the form directly on our page. The legal basis for this is Art. 6(1)(a) GDPR and Section 25(1) TDDDG; consent can be withdrawn at any time.

As sub-processors, eRecht24 uses Friendly Captcha GmbH, Am Anger 3–5, 82237 Wörthsee, Germany (securing the form) and MailPace Ltd., Unit G32, 111 Power Rd, Chiswick, London W4 5PY, United Kingdom (sending the confirmation e-mails). The processing of submitted withdrawals is based on Art. 6(1)(c) GDPR (compliance with a legal obligation) and Art. 6(1)(b) GDPR (contract).

14. Contacting us and communication

Enquiries by e-mail and telephone

If you contact us by e-mail or telephone, we process your details in order to handle your request. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or its initiation, otherwise Art. 6(1)(f) GDPR (effective handling of enquiries).

We store this data until you ask us to delete it or the purpose ceases to apply — for example once your request has been dealt with. Mandatory statutory retention periods remain unaffected.

We do not offer a contact form, a newsletter or a chatbot on this website.

WhatsApp

For communication with prospects and customers we also use WhatsApp, in the "WhatsApp Business" variant. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Communication is end-to-end encrypted, so WhatsApp cannot read the content of the messages. WhatsApp does, however, have access to the metadata of the communication — in particular your mobile number, the other party's number and the timestamps. By its own account, WhatsApp shares personal data with its US parent company, Meta.

The legal basis is Art. 6(1)(b) GDPR where the exchange serves the initiation or performance of a contract, otherwise Art. 6(1)(f) GDPR (fast and straightforward communication). You are under no obligation to use WhatsApp — e-mail and telephone are equally available to you.

WhatsApp Ireland bases the transfer to the USA on the European Commission's adequacy decision (WhatsApp LLC is certified under the EU-U.S. Data Privacy Framework) and, in addition, on the European Commission's Standard Contractual Clauses: https://www.whatsapp.com/legal/business-data-transfer-addendum.

The messages exchanged with you remain with us until you ask us to delete them or the purpose ceases to apply. Details of WhatsApp's processing: https://www.whatsapp.com/legal/#privacy-policy.

Microsoft Teams

We use Microsoft Teams for video and telephone conferences — for instance consultation and onboarding appointments. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

We process the details you provide in order to take part (such as name and e-mail address), the metadata of the conference (start, end, duration, number of participants) and the technical connection data (including IP address, device type, operating system, client version). Video and audio are transmitted for the duration of the conference. We do not record conferences. Any content exchanged in the chat is stored on Microsoft's servers.

The legal basis is Art. 6(1)(b) GDPR where the conference serves the initiation or performance of a contract, otherwise Art. 6(1)(f) GDPR (simple and fast communication). We have no influence over the processing Microsoft carries out for its own purposes; details are set out in Microsoft's privacy statement: https://privacy.microsoft.com/en-gb/privacystatement.

A processing agreement pursuant to Art. 28 GDPR is in place with Microsoft. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework; any transfer to the USA is based on the European Commission's adequacy decision.

15. Your rights

You have the following rights against us at any time:

  • Access (Art. 15 GDPR) — free information about the data stored about you, its origin, recipients and the purpose of processing. In the application, signed-in studio owners can additionally export their data as a file themselves at any time.
  • Rectification (Art. 16 GDPR) — correction of inaccurate data or completion of incomplete data.
  • Erasure (Art. 17 GDPR) — deletion of your data, unless a retention obligation stands in the way.
  • Restriction of processing (Art. 18 GDPR) — in particular while the accuracy of your data is being verified, in place of erasure where processing is unlawful, where you need the data to pursue legal claims, or while an objection is still being decided.
  • Data portability (Art. 20 GDPR) — release of the data processed automatically on the basis of your consent or a contract in a common, machine-readable format; on request, and where technically feasible, directly to another controller.
  • Withdrawal of consent (Art. 7(3) GDPR) — at any time with effect for the future, without affecting the lawfulness of processing carried out until then.
  • Complaint to a supervisory authority (Art. 77 GDPR) — in particular in the Member State of your residence, your place of work or the alleged infringement. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.

An informal message to the contact details in section 2 is enough to exercise these rights. If your request concerns data a studio has recorded about you, please contact that studio (section 12).

Right to object (Art. 21 GDPR)

IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE RESPECTIVE LEGAL BASIS IS SET OUT IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO PROCESSING FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS CONNECTED WITH SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (ART. 21(2) GDPR).

16. Further information

No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

Service for adults

Our service is aimed at studios and their staff, and therefore exclusively at adults. We do not knowingly collect data from children.

Objection to promotional e-mails

We hereby object to the use of contact details published as part of our legal-notice obligation for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising being sent.

Changes to this privacy policy

We update this privacy policy whenever the processing activities described here or the legal situation change. The version published here applies; the date above states its status.