Privacy Policy

The information below explains, in accordance with Arts. 13 and 14 GDPR, what personal data we process. The German version at /datenschutz/ is the legally binding original; this English version is provided for the convenience of non-German-speaking visitors. In case of conflict, the German text governs.

Controller

Visiting the website

When you visit this website, server log files record your IP address, the time of access, the referrer, your user agent, and the requested URL; the logs are kept for a maximum of 14 days. The legal basis is Art. 6(1)(f) GDPR (security and stable operation).

Cookies, analytics and maps

We store on your device only what the features you use require (Section 25(2) No. 2 TDDDG). Stripe sets its own cookies on the payment page to prevent fraud. We compile traffic statistics without cookies (Art. 6(1)(f) GDPR). Google Maps views load only once you agree, and your browser remembers that choice (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Forms

When you use our forms, we process the details you enter, along with your IP address and the time of submission, which we record to prevent abuse. The legal basis is Art. 6(1)(b) GDPR (pre-contractual inquiry or performance of the contract), Art. 6(1)(f) GDPR for abuse prevention, and otherwise your consent (Art. 6(1)(a) GDPR). The fields marked as mandatory are the ones we need in order to answer your inquiry or perform the contract; all other details are optional.

Voucher purchase and payment

When you make a purchase, we process your order and billing details to perform the contract (Art. 6(1)(b) GDPR) and to meet retention obligations under tax and commercial law (Art. 6(1)(c) GDPR). Payment is handled by Stripe and, if you pay with PayPal or Klarna, by that provider too. If you give a voucher as a gift, we process the recipient’s name and email address to send them the voucher on the date you choose (Art. 6(1)(b) and (f) GDPR).

Redeeming a voucher and booking an appointment

When you redeem a voucher and book your appointment, we process the details you provide on the basis of Art. 6(1)(b) GDPR. Appointments are managed on a booking platform and in an online spreadsheet.

Online withdrawal

You can withdraw from your contract at /en/withdrawal/. We process the details you provide, together with your IP address, browser identifier and the time of submission. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 356a of the German Civil Code.

Wheel of Fortune

To take part in the Wheel of Fortune at /en/wheel-of-fortune/, we need your first and last name and your email address. Every entry is stored with its result; to prevent abuse we also process your IP address. If you win, we send you a personal discount code. If you don’t win, we send you a consolation offer only if you have agreed to marketing emails. The legal basis is your consent (Art. 6(1)(a) GDPR); for abuse prevention, it is Art. 6(1)(f) GDPR. You can withdraw your consent at any time with future effect by emailing hamburg@beauty-shots.de.

Reviews

After your session, we ask you by email to leave a review. We collect reviews through a review platform and show a selection of them on our website with your name and, where given, your photo; as a thank-you, we email you a voucher code. The legal basis is Art. 6(1)(f) GDPR, and your consent for publication (Art. 6(1)(a) GDPR).

Phone and WhatsApp

Calls to our studio number are first answered by Heidi, an AI assistant provided by our phone provider. Your phone number and the call are processed for this; we receive a summary and a transcript and store both in our customer database to handle your request (Art. 6(1)(b) and (f) GDPR). If you message us on WhatsApp, WhatsApp Ireland Limited also processes your message and phone number.

Customer records and email marketing

We keep records of customers and inquirers in our customer database, including the services purchased, vouchers, appointments, calls, and the emails we have sent you. We use these records to manage the contractual relationship, to prevent misuse, and—for existing customers—to send direct email marketing for our own similar services. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 7(3) of the German Unfair Competition Act, and otherwise your consent (Art. 6(1)(a) GDPR). In marketing emails, we record whether they are opened and whether links in them are clicked (Art. 6(1)(f) GDPR). You can object to marketing at any time, free of charge—via the unsubscribe link in every marketing email, or informally by emailing hamburg@beauty-shots.de.

Recipients and data transfers

These service providers receive personal data; they act on our behalf (Art. 28 GDPR):

Where data is transferred to the United States, we rely on the EU-US Data Privacy Framework or, as an additional safeguard, on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); for the United Kingdom and Switzerland, adequacy decisions apply (Art. 45 GDPR). You can request a copy of the Standard Contractual Clauses by emailing hamburg@beauty-shots.de.

Payments, messages and maps

When you pay through these providers, message us on WhatsApp or load the map, they also process your data on their own responsibility; their own privacy notices apply:

Retention periods

We keep your data only for as long as the relevant purpose requires: server log files for 14 days, and inquiries sent through our contact forms for no more than 12 months. Voucher data is kept until redemption or until the limitation period expires; withdrawal declarations for at least 3 years; invoices and other accounting vouchers for 8 years, and books and records for 10 years (§ 147 of the German Fiscal Code); call records for 90 days; Wheel of Fortune entries for 12 months; and review rewards for 12 months after the code was used or expired. Customer records are kept for the duration of the business relationship, and marketing consent until you withdraw it. We delete encrypted backups within 90 days.

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing that we base on a legitimate interest (Art. 6(1)(f) GDPR). Where processing is for direct marketing, you may object at any time without giving reasons, and we will then stop processing your data for that purpose. An email to hamburg@beauty-shots.de is sufficient.

Your rights

You have the rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20). Where processing is based on your consent, you can withdraw it at any time with future effect (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before withdrawal. An email to hamburg@beauty-shots.de is sufficient. You may also lodge a complaint with a supervisory authority—in our case, the Hamburg Commissioner for Data Protection and Freedom of Information.

Updated: October 2026 · Legal Notice · Privacy · Right of Withdrawal · Terms