Privacy Policy

Preamble

This Privacy Policy informs you, in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG), about the nature, scope and purpose of processing personal data on our website www.beauty-laser.at and in connection with our services.

The data we need and the basis on which we process it depend on your particular request. We handle health data from medical histories and voluntary photographic documentation separately; accepting the Terms and Conditions or advertising cookies does not constitute consent for these purposes.

Last updated: 24 October 2026

Contents

Controller within the meaning of the GDPR

Legal Notice: View Legal Notice

Overview of processing

We process various categories of your personal data:

• Master data (e.g. names, addresses)
• Contact data (e.g. email addresses, telephone numbers)
• Content data (e.g. text entered in forms, messages to our AI chat)
• Contract and appointment data (e.g. booked treatments, quotation requests, prospect/lead data)
• Medical history data, treatment-related health information, records of information and consent, digital signatures and voluntary documentation photos
• Usage data (e.g. pages visited, interest in content, access times)
• Metadata/communication data (e.g. device information, IP addresses)

Applicable legal bases

In accordance with Article 13 GDPR, we inform you of the legal bases for our data processing. We rely on the following legal bases:

• Consent (Article 6(1)(a) GDPR): You have given us consent to process your personal data for one or more specific purposes. You may withdraw this consent at any time with effect for the future.
• Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR): Processing is necessary to perform a contract to which you are a party or to take steps at your request before entering into a contract.
• Legal obligation (Article 6(1)(c) GDPR): Processing is necessary to comply with a legal obligation to which we are subject (e.g. tax retention obligations).
• Legitimate interests (Article 6(1)(f) GDPR): Processing is necessary to safeguard our legitimate interests or those of a third party, unless your interests or fundamental rights and freedoms override them. Our legitimate interests include, in particular, operating and improving our website, securing our IT systems, direct marketing and customer care.

Retention periods

Retention depends on the purpose, statutory retention obligations and what is necessary for legal claims. An expiring form link or expired session cookie does not delete a record already submitted.

• Invoices and tax-related receipts: Generally seven years under § 132 BAO, starting at the end of the relevant calendar year; longer where necessary for pending proceedings. This obligation does not apply indiscriminately to all health data.
• Customer, contract and appointment data: For managing the business relationship and outstanding credit. Afterwards, only where a statutory obligation or a justified evidential need exists.
• Medical histories, consents and treatment records: For preparing and performing treatment and for continuation covered by your consent. Thereafter, any limited evidential need depends on the type and date of treatment, documented reactions or complaints and possible claims. Under § 1489 ABGB, compensation claims generally become time-barred three years after knowledge of the damage and the person responsible; a 30-year period applies in cases specified by law. This does not mean that all health data is retained indiscriminately for 30 years. For legal claims, we retain only the information necessary for that purpose.
• Voluntary photos: As long as they are needed for the agreed documentation purpose and your consent remains in place. Withdrawal ends this purpose; further retention is only possible on an independent legal basis, particularly where evidence is needed for legal claims.
• Contact, consultation and quotation requests: Until processed and resolved, and afterwards only for necessary follow-up questions, a subsequent business relationship or a specific evidential need. Unconfirmed requests are not handled further as confirmed treatment orders.
• Technical logs and backups: According to the technical configuration of the services used and the necessary security or recovery purpose. Deletions in customer management must also be taken into account when managing backups. The studio initiates deletions; there is currently no automatic deletion of all records after a fixed period.
• Cookie choices: One year in the consent cookie and its local mirror; your choice is then requested again. Analytics and advertising data are also subject to the respective providers’ settings and retention rules.

When the purpose no longer applies and no other necessary legal basis exists, data must be deleted or anonymised. You may request review and deletion of your data at info@beauty-laser.at.

Security measures

We protect the website using encrypted transmission (HTTPS/TLS), studio access using login and permission checks, and medical history forms using time-limited personal access and additional verification. Customer data is accessed on the server side; direct public database access is not provided. Backups support recovery after technical failures.

Please keep personal links confidential, use a protected device and store your downloaded copy securely. Form submissions and PDF downloads are not made available in a public cache.

Data transfers and recipients

In the course of our business, we may transfer personal data to the following categories of recipients:

• Hosting providers: We use Google Firebase / Firebase App Hosting (Google Cloud) to operate our website and store data collected through it. Treatment data and digital records are stored in our Firestore database. We also use the studio’s Google Drive connection for backups; these may contain customer and treatment data. Provider details are given under “Hosting”.
• Email delivery providers: We use the mail server of our provider ALL-INKL.COM – Neue Medien Münnich (Germany) to send transactional emails (e.g. appointment and booking confirmations, reminders, personalised quotations), using the sender address info@beauty-laser.at.
• Web analytics: Google Analytics (Google Ireland Limited) – cookies only after your consent through the cookie banner.
• Advertising & conversion measurement: Google Ads (Google Ireland Limited) and Meta Pixel (Meta Platforms Ireland Limited) – only after your consent to advertising cookies; see “Google Ads & conversion measurement” and “Meta Pixel”.
• AI assistance: Google (Gemini API) for the website chat, email drafts requested by the team and the limited selection of public WhatsApp replies; see the separate sections.
• Booking platforms: Treatwell for online appointment booking
• Communication providers: WhatsApp Ireland Limited for customer communication; a digital assistant answers simple general enquiries, while the team handles personal matters – see “WhatsApp & digital assistant”.
• Social media platforms: Instagram, Facebook (Meta)
• Payment and cash register services: SumUp and helloCash; see “Payments, cash register and receipts” for scope and legal bases.
• Tax advisers and accountants: For tax purposes

Transfers to third countries

Google, Meta and other international providers may process or access data outside the EU/EEA, particularly in the USA. Applicable adequacy decisions (including the EU–US Data Privacy Framework for covered certified recipients) or standard contractual clauses may provide a basis for these transfers. The providers’ applicable terms describe these bases. You may request information about the safeguards applicable to our processing at info@beauty-laser.at.

Hosting & Content Delivery Networks (CDN)

Our website is hosted by an external service provider (host). Personal data collected on this website is stored on the host’s servers. This may include, in particular, IP addresses, contact enquiries, metadata and communication data, website accesses and other data generated through a website.

We use Google Cloud / Firebase App Hosting to host our website. For paid Cloud/Firebase services with an Austrian billing address, Google generally identifies Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; the entity named in the specific product contract remains decisive. Google also processes data in the USA. The Google Cloud data processing terms apply to processing on our behalf. Further information is available in the Google Cloud Data Processing Addendum.

Quotation data: If you request a personalised quotation through our website, it is created as a PDF and emailed to you; your request is stored in our database. Details are provided under “Online quotation requests (quotation by email)”.

The legal basis for hosting is our legitimate interest in providing our online services securely and quickly (Article 6(1)(f) GDPR).

Data collection on our website

Cookies and local storage

Our website uses cookies. These are small text files stored by your browser. They do not cause damage. We use technically necessary cookies to make our services user-friendly.

Through the cookie banner you can allow necessary storage and select analytics and marketing purposes separately. Your versioned choice and its timestamp are stored in the bl_consent cookie and in Local Storage for one year. Necessary session cookies are used for studio login and verified form access. Separate, time-limited cookies protect access to digital medical history forms and the short-term download of your copy. Details are provided under “Digital medical history”.

Analytics and advertising are optional: We activate statistics (Google Analytics) and marketing (Google Ads, enhanced conversions and Meta Pixel) only after your respective consent. “Necessary only” rejects both categories. Without a choice, they remain off. Withdrawal applies to the future; it does not retrospectively undo processing already carried out. Details of names, purposes, storage types and lifetimes are provided in our Cookie Information.

Our AI-powered chat assistant and the digital assistant on WhatsApp operate on the server side and place no additional cookies in your browser. Details of their data processing are provided under “AI chat assistant” and “WhatsApp & digital assistant”.

You can configure your browser to notify you when cookies are set, or allow or reject individual cookies; this may restrict full use of our website.

Server log files

The website provider automatically collects and stores information in server log files that your browser automatically transmits to us. This comprises browser type/version, operating system, referrer URL, hostname of the accessing computer, time of the server request and IP address.

Web analytics (Google Analytics)

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies and similar technologies to analyse use of our website. The information generated about your use (including IP address during transmission, pages visited, time spent, approximate region and device/browser data) is transmitted to and stored by Google. Transfer to the USA is possible.

Consent: Analytics using cookies takes place only after your express consent through the cookie banner. The legal basis is your consent (Article 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021). You may withdraw it at any time with effect for the future by choosing “Necessary only” again in the cookie banner.

Without statistics consent: Google Analytics is not activated. We use consent-dependent integration (Basic Consent Mode). Without statistics and marketing consent, Google measurement code is not loaded. Interactions recorded before your choice are not sent to Analytics retrospectively. You can change your consent through “Cookie settings” in the footer. Hosting connections technically necessary for the website are independent of this.

Further information is available in Google’s Privacy Policy.

Google Ads & conversion measurement

We advertise our studio through Google Ads, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). To identify which advertisements actually result in an enquiry, we use Google Ads conversion tracking . Measurement records only that one of the following actions occurred: submitting a consultation request, requesting a quotation or clicking our WhatsApp or telephone number.

Enhanced conversions: If you have consented to advertising cookies, we also transmit the contact data you entered in the form (email address, telephone number, first and last name) to Google so that an enquiry can be attributed to the correct advertisement. This data is cryptographically hashed in your browser (SHA-256) – Google therefore receives no plain-text contact data, but a hash value it can use to match contact data. The data remains personal data and is not rendered anonymous. Without your consent to advertising cookies, no contact data is transmitted.

Consent and Consent Mode v2: Advertising cookies and transmission of contact data take place only after your express consent in the cookie banner. The legal basis is your consent (Article 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021). If you decline, no advertising cookies are used and no contact data you provided is transmitted for enhanced conversions. Without marketing consent, Google Ads destinations are not activated and no Ads conversions are sent. Separate statistics consent activates only statistics destinations. Advertising click identifiers (gclid, gbraid, wbraid) are stored locally only after marketing consent, for no more than 90 days, and may be associated with your enquiry.

Withdrawal: You may withdraw consent at any time with effect for the future by choosing “Necessary only” again in the cookie banner. You can also disable personalised advertising directly with Google through Google ad settings .

Further information is available in Google’s Privacy Policy.

Meta Pixel (Facebook & Instagram Ads)

We also advertise our studio through Facebook and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland), using the Meta Pixel . Measurement records only that one of the following actions occurred: viewing our pages, submitting a consultation request, requesting a quotation or clicking our WhatsApp or telephone number.

Only with consent: The Meta Pixel is loaded only after you consent to advertising cookies in the cookie banner (Article 6(1)(a) GDPR in conjunction with § 165(3) TKG 2021). Without consent, no connection to Meta is established and no Meta cookies (such as “_fbp”) are set. If you withdraw consent, the pixel stops transmitting and Meta cookies are deleted.

Advanced matching: If you have consented, we also transmit the contact data you entered in the form (email address, telephone number, first and last name) when you make an enquiry. This data is cryptographically hashed in your browser (SHA-256) – Meta receives no plain-text contact data, only a hash value for matching with contact data known to Meta. This pseudonymisation is not anonymisation.

Third-country transfers: Data may be transferred to the USA. Possible transfer bases are explained under “Data transfers and recipients”. Meta publishes details in its Privacy Policy.

You may withdraw consent at any time with effect for the future by choosing “Necessary only” again in the cookie banner. You can also disable personalised advertising directly with Meta in its ad settings . Further information is available in Meta’s Privacy Policy.

Joint responsibility for Meta events

For collection and transmission of pixel events, we and Meta Ireland act as joint controllers within the scope of the Meta Controller Addendum (Article 26 GDPR). We are responsible for providing information and obtaining your consent; under this agreement, Meta is responsible in particular for handling data subject requests concerning this joint processing and for the security of its products. You may exercise your rights against both parties. Meta’s subsequent processing for its own purposes is separate from this.

Contact & communication

If you contact us using the contact form, email, telephone or messaging services, we process and store the information in your enquiry, including the contact data you provide, to handle the enquiry and any follow-up questions.

Contact form

Data processed: Name, email address, telephone number (optional), message content, time of enquiry.
Legal basis: Steps prior to entering into a contract (Article 6(1)(b) GDPR) or legitimate interest (Article 6(1)(f) GDPR).
Retention period: See “Retention periods”.

Reminders about your enquiry: If you request a consultation (contact form, Laser Check or enquiry form on Facebook/Instagram), we reply on the channel you selected (email or WhatsApp) and remind you about your enquiry up to twice – usually after one day and after a further three days. This is part of handling your enquiry (Article 6(1)(b) or (f) GDPR). The reminders end as soon as you reply, book an appointment or object; replying “STOP” is sufficient.

Email communication

When you contact us by email, your email address and the data you provide are processed to handle your enquiry. Incoming and outgoing messages, including relevant attachments, are processed in the ALL-INKL mailbox and in the protected communication centre in Firestore and associated with the relevant enquiry or customer record. Third parties may be able to view email content during transmission unless end-to-end encryption is used. For sensitive information, we recommend personal contact or encrypted communication.

WhatsApp Business

We use WhatsApp Business for customer communication (WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; parent company: Meta Platforms Inc., USA).

Data processed: Telephone number, name, profile photo (if stored in WhatsApp), message content, timestamps.
Legal basis: Handling your pre-contractual or contractual matters (Article 6(1)(b) GDPR), or, for general enquiries, our legitimate interest in customer communication (Article 6(1)(f) GDPR).

Quotations by WhatsApp: On request, we can send you a personalised quotation by WhatsApp. A quotation PDF is created, stored temporarily on our servers (Firebase Storage), and a personal download link is sent to you in the WhatsApp message. Processing takes place to take steps prior to entering into a contract (Article 6(1)(b) GDPR).

Please note: WhatsApp transfers metadata to servers in the USA; WhatsApp explains the transfer bases in its Privacy Policy. Please note that cloud backups can affect end-to-end encryption. Please use the protected medical history channel or personal contact at the studio for health information. Further information is available in the WhatsApp Privacy Policy.

Appointment booking & customer management

We process our customers’ personal data to manage appointments and provide our services.

Direct appointment booking

Data processed: Name, contact data (telephone, email), booked treatment, appointment details and treatment history. We process treatment-related health information separately with your explicit consent; see “Digital medical history”.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR); for health data: explicit consent (Article 9(2)(a) GDPR).
Retention period: See “Retention periods”.

Calendar organisation

Appointments may be synchronised with the studio’s Google Calendar for studio organisation. This processes names, contact information, appointment times, agreed services and appointment notes (Article 6(1)(b) GDPR or our interest in reliable appointment organisation under Article 6(1)(f) GDPR). Answers from the digital medical history questionnaire are not included in this synchronisation.

Appointment reminders

We send organisational appointment confirmations and reminders through the agreed communication channel: preferably through WhatsApp with documented channel consent, with email as the fallback. An explicit preference for email takes priority. These messages serve to manage appointments (Article 6(1)(b) GDPR), where appropriate on the basis of our interest in avoiding missed appointments (Article 6(1)(f) GDPR). Proactive WhatsApp messages require documented channel consent. Advertising, birthday greetings and review requests must be assessed separately and are not authorised merely by an appointment request or cookie consent. You can unsubscribe from non-essential reminders and advertising messages at info@beauty-laser.at.

Payments, cash register and receipts

SumUp: For card payments or payment links provided by us, the amount, currency, payment description, reference and transaction status are processed. You enter card details at the terminal or on the provider’s payment page. Our management system stores payment allocation and status, not full card numbers or card security codes. The payment service provider for the EEA offering is generally SumUp Limited, Block 8, Harcourt Centre, Charlotte Way, Dublin 2, D02 K580, Ireland; the entity named in the specific payment transaction is decisive.

helloCash: We use helloCash (mRaP GmbH, Pulvermühlweg 11, 3250 Wieselburg-Land, Austria) for cash register management and receipt creation. Depending on the receipt, customer name, salutation, contact and address data, internal customer reference, service line items, amounts, payment method and transaction reference are transmitted. Receipt number, status and link are stored in our management system. Personal receipt links must be treated confidentially. Medical history answers are not required to create receipts.

Processing takes place to handle payments and contracts (Article 6(1)(b) GDPR) and to meet tax-related receipt and retention obligations (Article 6(1)(c) GDPR, particularly the BAO and cash register regulations). SumUp may act as a controller in its own right, particularly for payment processing and statutory checks; helloCash processes the cash register data we manage according to its respective contractual role. Further information: SumUp privacy information and helloCash privacy information.

Processing on behalf of the controller and provider roles

Technical service providers may process data on our behalf; this requires an agreement under Article 28 GDPR. Payment, platform or communication providers acting as controllers in their own right must be distinguished from these. A data processing agreement does not replace required consent or the conditions for a third-country transfer.

Our information on processing on behalf of the controller explains the services and roles. Customers do not need to enter into a data processing agreement with us for treatment. A public overview or model contract does not prove that an agreement has been concluded with a provider.

Digital medical history & treatment documentation

Before laser treatment, you receive a personal, time-limited form link. After the required identity verification, you can complete the medical history, read information about the procedure, prospects of success, risks, preparation and aftercare, and digitally sign the declarations. The link is confidential and must not be shared.

Data and purposes: Master and contact data, information about skin, hair and treatment areas, medication, pre-existing conditions, pregnancy/breastfeeding, allergies, photosensitivity, previous treatments and other treatment-related circumstances. We use this for preparation, individual risk assessment at the studio, safe treatment planning and documentation. The information is not used for automatic medical clearance.

Consent and choice: Health data is processed on the basis of your separate explicit consent under Article 6(1)(a) and Article 9(2)(a) GDPR. Providing it is not a statutory obligation. You may refuse consent or withdraw it at any time with effect for the future at info@beauty-laser.at . Without the information necessary for the safety assessment and lawful processing, we cannot carry out laser treatment. If you do not wish to use the online form, you can discuss recording the information at the studio. Withdrawal does not affect the lawfulness of previous processing. Records may only continue to be retained where an independent legal basis exists, particularly Article 6(1)(f) and Article 9(2)(f) GDPR for necessary legal claims.

Digital record: Together with your answers and drawn signature, we store the version and actual displayed content of the information and consent, your individual confirmations and the server-side submission time. Earlier submitted versions remain as evidence; corrections may be added. The signature serves as documentation, not biometric identification. After submission, a PDF copy is available to you through a protected download; download access expires after 30 minutes. You can request a copy from the studio later.

Technology and recipients: The data is processed through our website and stored in Google Firebase/Firestore. Authorised studio personnel have access through the protected management area. Google Cloud and Google Drive backup are technical services for storage and recovery. Email providers receive the contact and delivery data needed to send the link; we do not send answers, signatures or health records as ordinary email attachments. Where necessary for legal proceedings, relevant records may be transmitted to legal representatives, insurers or competent authorities and courts.

Protected form area: Necessary session cookies that cannot be read by JavaScript protect verified access (for no more than one hour) and the subsequent PDF download. They are not used for advertising. Digital medical history forms do not use advertising or analytics services, AI assistants or Google Maps address entry; their health data is not made available to these services. The corresponding sections of this policy apply to retention periods and data subject rights.

Voluntary internal photographic documentation

We take and store photos of treatment areas only with separate voluntary consent for internal documentation of skin condition and progress. These may contain health information; the bases are Article 6(1)(a) and, where applicable, Article 9(2)(a) GDPR. The choice in the medical history form records your decision; it does not mean that photos are already being taken or uploaded there. Refusal does not affect your treatment.

Only personnel authorised for documentation and technical storage providers receive access. You may withdraw consent at any time with effect for the future at info@beauty-laser.at. The retention criteria explained above apply. This consent does not permit publication, advertising or social media use. That would require separate voluntary consent expressly covering the publication purpose and the media concerned.

Online consultation requests

You can request a free consultation through our website. You provide your name, email address, telephone number, date of birth for age verification, selected communication channel and, where applicable, its consent record, as well as the desired treatment areas (body areas) and, if applicable, a preferred appointment.

Double-Opt-in: After submission, the request is initially stored and the selected appointment temporarily reserved. You receive a confirmation link through the selected channel: email or, with separate channel consent, WhatsApp. Only after confirmation is the consultation entered as a binding appointment in the calendar. This verifies access to the selected communication channel; it is not consent to advertising.

Data processed: Name, email address, telephone number, date of birth, channel choice and, where applicable, WhatsApp consent record, selected body areas/treatment preferences, preferred appointment, time of request.
Legal basis: Taking pre-contractual steps at your request (Article 6(1)(b) GDPR); selecting cosmetic body areas is not automatically health information. Please do not enter diagnoses or medical histories in the consultation form. We obtain explicit health data consent separately for the actual medical history.
Retention period: See “Retention periods” (consultation requests).

Online quotation requests (quotation by email)

On our pricing page, you can select services and packages and request a non-binding personalised quotation. You provide your first name, last name and email address. The quotation is automatically created as a PDF and sent to you as an email attachment.

Data processed: First name, last name, email address, your selected services/packages and the calculated quotation price, time of request. Your request is stored in our prospect/lead management system (including a copy of the quotation created) so that we can understand your request and contact you if you are interested.
Legal basis: Taking pre-contractual steps at your request (Article 6(1)(b) GDPR) and our legitimate interest in processing and following up enquiries (Article 6(1)(f) GDPR).
Retention period: See “Retention periods” (quotation and prospect data).

Delivery uses our provider’s email server (see “Data transfers and recipients”). On request, a quotation can also be sent by WhatsApp.

Social Media

We maintain a presence on social networks to communicate with customers, prospects and users active there and inform them about our services.

In particular, we use Instagram and Facebook (Meta Platforms Ireland Limited). User data may be processed outside the European Union. Please note that Meta processes data for advertising purposes and to create user profiles. Please consult Meta’s privacy information for details.

Booking system (Treatwell)

For online appointment booking and customer feedback, we use the Treatwell portal (Treatwell DACH GmbH, Vienna branch, Karl-Popper-Straße 22, 1100 Vienna).

If you book an appointment or submit a review there, Treatwell processes your name, contact information and booking details and sends us the data necessary for the booking. Roles and further processing are described in the Treatwell Privacy Policy.

AI chat assistant

Our website offers an AI-powered chat assistant that answers general questions about our services. We use Google’s Gemini API to generate responses (for paid API services in Austria, generally Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; processing in the USA is also possible).

Data processed: The messages you enter in the chat and the conversation history of the current session. These are sent to Google to answer your questions. Please do not enter sensitive health data or personal data requiring particular protection in the chat.
Legal basis: Our legitimate interest in answering general enquiries (Article 6(1)(f) GDPR); for specific pre-contractual matters, Article 6(1)(b) GDPR. Mere use does not constitute explicit consent to processing health data.

Further information about Google’s data processing is available in Google’s Privacy Policy.

AI assistance at the studio

The team may specifically call on Google Gemini to draft email replies. This processes the latest relevant messages and selected customer data such as name, appointment overview, quotation subject and the status of whether a medical history form exists. Where a query is necessary, appointment services, quotation amounts and the subjects and dates of earlier emails may be added. Structured medical history content is not a data field in these tools. However, free-text emails may contain sensitive information you have provided yourself; please submit health information through the protected medical history channel.

These drafts help process your request (Article 6(1)(b) GDPR) or support efficient general communication (Article 6(1)(f) GDPR). These bases alone do not permit health data to be transferred to AI services. If an email conversation contains health information, the team must not use the AI draft function for that conversation; such matters must be handled personally. The function imports the relevant conversation and does not provide reliable automatic redaction of health data. A human reviews the email draft before it is sent. With the “Quotation from text” feature, the team sends the pasted enquiry text and service catalogue to Gemini to suggest suitable services. Only the required service preferences, without names, contact details or health information, should be pasted for this purpose. The team reviews suggestions before creating a quotation. No solely automated decision is made about treatment suitability, contractual claims or comparably significant matters.

Processing through the Gemini API is governed by the Gemini API Terms and the associated data protection terms. These differ from private Gemini chat accounts. Providers may keep technical security and abuse logs; we do not make an unrestricted promise of immediate deletion or processing exclusively in the EU. You may request personal handling without AI assistance.

WhatsApp & digital assistant

You can contact us through WhatsApp . The WhatsApp service is operated by WhatsApp Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland); data may be processed in the USA.

Our digital assistant answers general questions, for example about prices, opening hours and available consultation appointments. It identifies itself as an assistant. Incoming messages are classified on our server. For optional AI selection of response style, Google Gemini receives only predefined topic, language and tone categories and public studio information, not the original conversation, names, telephone numbers, customer numbers or personal links. Replies are assembled from approved texts and public facts. Personal appointment changes, sensitive or unclear matters go to the team. You can request personal assistance by writing “TEAM”.

WhatsApp communication: Telephone number, transmitted profile name, text, any media, and sending, delivery and read statuses are stored in our protected communication area for handling your enquiry. WhatsApp/Meta also processes connection and usage data under its own responsibility. Please do not send medical histories or sensitive health data through WhatsApp. Use the protected form or a personal discussion instead.

The legal basis is handling your appointment matters (Article 6(1)(b) GDPR) or our legitimate interest in handling general enquiries (Article 6(1)(f) GDPR). You may object to automated handling at any time and request personal handling by our team.

Further information is available in the WhatsApp/Meta Privacy Policy and Google’s Privacy Policy.

Providers & services

Google Fonts

The Google fonts used on our website are served locally through Next.js. Loading these fonts does not require a direct connection from your browser to Google Fonts.

Google Maps, Places & Street View

The public contact page displays a locally served orientation map and a locally served directions video. Simply displaying them does not establish a connection to Google Maps or OpenStreetMap. Only when you open an external map or directions link do the respective service’s privacy terms apply. In the protected studio area, Google Places assists with address entry; entered address search terms, IP address and technical device data may be transmitted to Google. This supports accurate customer management on the basis of our legitimate interest (Article 6(1)(f) GDPR); manual entry remains possible. Health information is not needed for this.

AI chat & web analytics

For processing by our AI chat assistant and Google Analytics, see the separate sections “AI chat assistant” and “Web analytics (Google Analytics)” above.

Your rights as a data subject

Under the GDPR, you have the following rights concerning your personal data stored by us:

• Right of access (Article 15 GDPR): You have the right to request confirmation of whether we process personal data concerning you. If we do, you have a right of access to that data and further information under Article 15 GDPR.
• Right to rectification (Article 16 GDPR): You have the right to request rectification of inaccurate personal data concerning you without undue delay.
• Right to erasure / “right to be forgotten” (Article 17 GDPR): You may request erasure where the statutory conditions are met. Statutory retention obligations or a necessary legal defence may prevent complete deletion; we will inform you accordingly.
• Right to restriction of processing (Article 18 GDPR): You have the right to request restriction of the processing of your data where certain conditions apply.
• Right to data portability (Article 20 GDPR): Where processing is automated and based on your consent or a contract, you may receive the data you provided in a structured, commonly used and machine-readable format and, where technically feasible, request its transmission to another controller.
• Right to withdraw consent (Article 7(3) GDPR): Where processing is based on your consent, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out up to that point.

To exercise your rights, please contact: info@beauty-laser.at

Right to object (Article 21 GDPR)

Right to lodge a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that processing your personal data infringes the GDPR.

Competent supervisory authority in Austria:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Telephone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy occasionally so that it continues to meet current legal requirements or reflects changes to our services. New information does not retrospectively change earlier consent. For new purposes requiring consent, we obtain fresh consent in advance.

Where possible, we will notify you separately of significant changes. The date at the top of this page indicates the current version of this Privacy Policy.