Privacy policy

Controller

The controller for the processing of personal data on this website is:

Company

Mitterhuber & Schäfer GmbH

Salon

Zeitlos Schön

Management

Andrea Mitterhuber

Address

Siebensterngasse 32-34, 1070 Vienna, Austria

Phone

+43 660 352 16 26

Email

info@zeitlos-schoen.eu

In short

This is a static website. It sets no cookies and uses no tracking techniques. Fonts are served from our own server, not from Google. Third-party content such as the map is loaded only after you explicitly click. The map on the home page and on “Contact & directions” is the only such embed.

The language switch remembers your choice in your browser only (local storage, key “zs-lang”). That information never leaves your device and never reaches us.

Visiting the website and server logs

This website is hosted by Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA). When you open a page, Cloudflare processes technically necessary data: your IP address, date and time, the address requested, the status code returned, the volume of data transferred and details of your browser and operating system.

This processing is required to deliver the website and protect it against attacks. The legal basis is our legitimate interest in secure and stable operation under Art. 6(1)(f) GDPR.

Cloudflare acts as our processor under a contract pursuant to Art. 28 GDPR. Any transfer to third countries is safeguarded by the European Commission’s standard contractual clauses. Cloudflare stores these log data only briefly and not permanently in personally identifiable form.

Audience measurement

There is currently no audience measurement on this website. Should we introduce one, it will work without cookies and without personal profiles, and we will update this policy beforehand.

Booking through Treatwell

You do not book appointments on this website but on the Treatwell platform. When you click “Book now”, you leave our website and arrive at buchung.treatwell.at. Your data is collected there by Treatwell as a separate controller, under its own privacy policy.

Treatwell passes on to us the details we need to carry out your treatment, in particular your name, contact details, the service booked and the appointment. We process this data to perform the treatment contract under Art. 6(1)(b) GDPR.

Contact by phone or email

If you call or write to us, we process the details you provide in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR where a treatment or its preparation is concerned, otherwise our legitimate interest in answering your enquiry under Art. 6(1)(f) GDPR.

Job applications are processed solely for the relevant selection procedure; we delete the documents no later than seven months after it ends, unless you have agreed to longer storage.

Appointment request for Perchtoldsdorf

For our Perchtoldsdorf location this website offers a request form. When you submit it, we process the details you enter (name, phone number, optional email address, preferred time, requested treatment, how you found us, your message) in order to call you back and arrange the appointment. The legal basis is the initiation of a contract (Art. 6(1)(b) GDPR).

The form is received by our hosting provider Cloudflare and delivered as an email to our mailbox at our email provider Active24 (ACTIVE 24, s.r.o., Prague, EU); nothing is stored on the web server. To prevent abuse we check how quickly the form was submitted and limit the number of requests per internet connection; your IP address is processed briefly for this purpose and is not included in the email. We delete the request once the appointment has taken place or does not come about, at the latest after twelve months.

Health-related details in the salon

Some treatments require information about your skin or health, such as allergies or contraindications for laser hair removal. We collect such data exclusively in the salon, never through this website. It falls under Art. 9 GDPR, is processed only with your explicit consent under Art. 9(2)(a) GDPR, treated in strict confidence and never passed on.

Google Maps

On the “Contact & directions” page you can load a map. It is deliberately embedded only after you click. Before that there is no connection to Google whatsoever.

If you select “Load content”, data is transferred to Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), in particular your IP address; a transfer to Google LLC in the USA is possible. The legal basis is your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future by using the page without loading the map.

You can also find us without the map: the link “Open directly at Google Maps” takes you to Google’s own page without embedding anything in ours.

Instagram and links to product partners

We link to our Instagram profile and to our product partners’ shops. These are plain links, not embedded content: data is transferred to those providers only once you click the link and open their site. Their own privacy policies then apply.

Links to our product partners’ shops may contain an identifier through which the partner attributes a later purchase to our salon. This attribution happens at the partner, not on our website.

Recipients of your data

We do not pass your data on for advertising purposes. The only recipients are the service providers we need in order to run the salon, such as our hosting provider, our booking platform, our point-of-sale system and our tax advisers. All are contractually bound to confidentiality.

Retention obligations under commercial and tax law, in particular the seven-year period under § 132 of the Federal Fiscal Code, remain unaffected.

Your rights

You have the following rights in relation to us:

• Access to whether and which data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Complaints

If you believe we are not processing your data lawfully, we would welcome a message to info@zeitlos-schoen.eu. Independently of that, you may contact the supervisory authority: Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.

No automated decision-making

We use neither automated decision-making nor profiling within the meaning of Art. 22 GDPR.