Data processing and service providers

Who is responsible?

Rima Srapyan – Beauty Laser Wien determines the processing for customer management and cosmetic services. Technical providers may process data on the studio’s instructions. This requires a data processing agreement (DPA) under Article 28 GDPR. Customers do not enter into a DPA with the studio for their treatment.

This page explains the roles. It does not constitute acceptance of a contract or proof that a provider has signed a model agreement. A DPA also does not provide independent permission for advertising, health data processing or international transfers.

Technical services

• Google Cloud / Firebase: Website operation, database, files and technical authentication. Customer records and digital evidence may contain health data. The Cloud data processing termsagreed for the product actually used are decisive.
• Google Drive and Calendar: Studio backups and appointment organisation. Contractual terms depend on the specific Google account and service; a private Google account and a managed Workspace account are not equivalent.
• ALL-INKL.COM – Neue Medien Münnich: Email mailbox, sending and receiving. The data processing agreement must match the email/hosting contract actually booked. Provider privacy information.
• helloCash / mRaP GmbH: Cash register and receipt data and associated customer data. The distinction between processing on behalf of the studio and the provider’s own contractual obligations follows from the helloCash contract. helloCash and the GDPR.
• Google Gemini API: Website chat, email drafts requested by the team, service suggestions from pasted enquiry text and the WhatsApp assistant’s limited selection of public replies. The product-specific API Terms and the agreements incorporated there apply, rather than automatically the cloud terms of all other Google products.

Other provider roles

SumUp may act as a controller in its own right for payment services and statutory checks. Treatwell handles platform and booking processing under its terms. WhatsApp/Meta and Google/Meta advertising services may act as processors, joint controllers or independent controllers depending on the processing stage. A blanket DPA for all these roles would be inaccurate. Where applicable, agreements under Article 26 GDPR govern joint collection and transmission through Meta Business Tools.

What a DPA must cover

Subject matter, duration, purposes, types of data and data subjects; documented instructions; confidentiality; appropriate technical and organisational measures; approved subprocessors; assistance with data subject rights, security incidents and data protection impact assessments; return or deletion at the end of the contract; evidence and audit rights. The provider must flag unlawful instructions. Access from outside the EEA additionally requires the conditions of Chapter V GDPR to be met.

The studio maintains contractual and security records for each service. Publicly available terms do not establish acceptance in a particular account, selected regions, individual deletion periods or certifications.

Information and contact

You can obtain information about recipients used for processing your data and transfer safeguards at info@beauty-laser.at. Please address your access, rectification, erasure and other data subject rights to the studio. The Privacy Policy explains individual processing activities, legal bases and retention criteria.