Privacy Policy

We process personal data only where it is necessary to provide our services, and we use no tracking cookies. The information below is given in accordance with Art. 13 GDPR. The German version at /datenschutz/ is the legally binding original; this English version is provided for the convenience of non-German-speaking visitors. In case of conflict, the German text governs.

Controller

Visiting the website

When you visit this website, server log files record your IP address, the time of access, the referrer, your user agent, and the requested URL; the logs are kept for a maximum of 14 days. The legal basis is Art. 6(1)(f) GDPR (security and stable operation).

Cookies, analytics and maps

We set only strictly necessary cookies—no tracking, marketing, or analytics cookies. For anonymous traffic statistics we use self-hosted GoatCounter, which stores neither cookies nor IP addresses. Stripe may set its own cookies on the payment page. Google Maps views load only when you click to load them.

Forms

When you use our forms, we process the details you enter, along with your IP address and the time of submission, which we record to prevent abuse. The legal basis is Art. 6(1)(b) GDPR (pre-contractual inquiry or performance of the contract), or otherwise your consent (Art. 6(1)(a) GDPR). The fields marked as mandatory are the ones we need in order to answer your inquiry or perform the contract; all other details are optional.

Search on this website

We process what you type into the site search to show results and answers. Recognisable personal details – e-mail addresses, phone numbers, bank details and postal addresses – are automatically removed from the input. If the site has no prepared answer, the cleaned input is sent together with excerpts from our own pages to an external AI service in the United States, which generates a short answer from them; no IP address, cookie or other identifier is transmitted. Answers produced this way are labelled in the search as made with the help of AI. We keep the cleaned search terms without identifiers for up to 90 days to improve our content. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in a working search).

Voucher purchase and payment

When you make a purchase, we process your order and billing details to perform the contract (Art. 6(1)(b) GDPR) and to meet retention obligations under tax and commercial law (Art. 6(1)(c) GDPR). Payment is handled by Stripe; you enter your payment details directly with Stripe, and we never store them (Stripe privacy policy).

Redeeming a voucher and booking an appointment

When you redeem a voucher and book your appointment, we process the details you provide on the basis of Art. 6(1)(b) GDPR. Appointments are managed on the booking platform operated by etermin GmbH (Austria, privacy policy).

Online withdrawal

You can withdraw from your contract at /en/withdrawal/. We process the details you provide, together with your IP address and the time of submission. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 356a of the German Civil Code.

Wheel of Fortune

To take part in the Wheel of Fortune at /en/wheel-of-fortune/, we need your first and last name and your email address. Every entry is stored together with the result and a hash of your IP address to prevent abuse; we also set a short-lived cookie. If you win, we send you a personal discount code. The legal basis is your consent (Art. 6(1)(a) GDPR); for abuse prevention, it is Art. 6(1)(f) GDPR. You can withdraw your consent at any time with future effect by emailing hamburg@beauty-shots.de.

Customer records and email marketing

We keep records of customers and inquirers in our own database on our server, including the services purchased, vouchers, appointments, and the emails we have sent you. We use these records to manage the contractual relationship, to prevent misuse, and—for existing customers—to send direct email marketing for our own similar services. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 7(3) of the German Unfair Competition Act, and otherwise your consent (Art. 6(1)(a) GDPR). You can object to marketing at any time—via the unsubscribe link in every marketing email, or informally by emailing hamburg@beauty-shots.de—at no cost beyond basic transmission rates.

Recipients and data transfers

We do not share personal data with third parties for advertising purposes. The following processors act for us under Art. 28 GDPR:

Where data is transferred to the United States, we rely on the EU-US Data Privacy Framework or, as an additional safeguard, on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the Standard Contractual Clauses by emailing hamburg@beauty-shots.de.

Retention periods

We keep your data only for as long as the relevant purpose requires: server log files for 14 days, and inquiries sent through our contact forms—including messages classified as spam—for no more than 12 months. Voucher data is kept until redemption or until the limitation period expires; withdrawal declarations for at least 3 years; and invoices for 10 years (§ 147 of the German Fiscal Code). Customer records are kept for the duration of the business relationship, and marketing consent until you withdraw it.

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing that we base on a legitimate interest (Art. 6(1)(f) GDPR). Where processing is for direct marketing, you may object at any time without giving reasons, and we will then stop processing your data for that purpose. An email to hamburg@beauty-shots.de is sufficient.

Your rights

You have the rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20). Where processing is based on your consent, you can withdraw it at any time with future effect (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before withdrawal. An email to hamburg@beauty-shots.de is sufficient. You may also lodge a complaint with a supervisory authority—in our case, the Hamburg Commissioner for Data Protection and Freedom of Information.

Updated: August 2026 · Legal Notice · Privacy · Right of Withdrawal · Terms