Privacy notice

Wichert Elena & Julija Osnaca GbR, Kosmetik­studio GlamRoom, Mainzer Landstraße 33, 60329 Frankfurt am Main, Germany. Email: info@glamroom.net; phone: +49 151 66152432. This notice covers the website and the studio processes described below.

Your browser sends technical data including IP address, time, requested address, referrer, browser and operating system information. We use it to deliver the site, investigate errors and prevent misuse. The basis is Article 6(1)(f) GDPR: our legitimate interest in secure, functional services. Credentials protect the private studio and administration areas.

The website uses a one.com unmanaged VPS in Germany. The current one.com data processing agreement lists Envia TEL GmbH for the unmanaged VPS data centre and Dogado GmbH for monitoring. The studio application and server-side processing for Greta/Telegram also run on this VPS. Telegram communication uses Telegram as an external service. Older backups on the former Timeweb hosting are retained separately; the migration does not automatically delete them. This does not mean that all processing by every provider takes place only in the EU.

Essential storage for security, sign-in and your cookie choice relies on section 25(2)(2) TDDDG; subsequent personal data processing relies on Article 6(1)(b) or (f) GDPR according to its purpose. Optional storage, analytics, advertising and external content require consent under section 25(1) TDDDG and Article 6(1)(a) GDPR. You can reject as easily as accept. Scrolling, continued browsing or closing settings does not give consent.

• glamroom-consent-v1: choice, policy version and time in local storage, valid for 180 days on this browser and website.
• Convenience, with consent only: Greta welcome and quiet mode for up to 90 days, per-tab animation counter, dismissed notice and shop favourites. The latter two have no automatic expiry; they remain until removed or consent is withdrawn.
• Cart: using WooCommerce cart features may set woocommerce_items_in_cart, woocommerce_cart_hash, wp_woocommerce_session_* and functional browser storage. Cart cookies last for the session; a WooCommerce session normally lasts up to two days. Login cookies apply to signed-in users.
• Google Analytics 4, only with statistics consent: _ga and _ga_ZD67KM6F52, first-party cookies distinguishing browsers and retaining session state; at most 60 days without automatic renewal. User/event data in the GA4 property: two months; standard aggregated reports can remain available longer.
• Meta Pixel and Planity: still disabled here; our consent loader sets no cookies for them.

The consent record contains no contacts, answers, customer identifier or cross-device ID. If storage is blocked, a choice applies only to the open page.

Open Cookie settings in the footer to choose each optional category or withdraw all consent. Withdrawal applies going forward. Loaded external content and separate measurement contexts are removed. The current page and entered form data remain in place. This cannot recall data already sent. Cookies on other domains can be removed only by their provider or your browser settings.

Fonts, images, the static neighbourhood map and selected Instagram preview images load from our own website server. The map is not an embedded Google Maps service. Links to Google Maps, Instagram, Facebook, WhatsApp and Planity contact the respective provider when you choose them. Its privacy terms then apply; our consent settings do not control the external website.

The official Instagram profile preview loads only after separate Instagram consent and opening the preview. Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland receives technical information such as IP address, browser details and the visited site, and potentially cookies/account information depending on your browser and sign-in. Processing in the USA and other countries is possible. Local content remains available without consent. Our linked social profiles are also subject to Meta rules and, where applicable, joint responsibilities for page statistics. Meta privacy policy.

If the studio connection is enabled, our server retrieves public reviews of our Google business profile through the Google Business Profile API and keeps a cache no older than 30 calendar days. It displays the published name, stars, date, text and, where available, our reply. Reading this local view sends no visitor-browser data to Google for this purpose. Google receives our server connection data and the account information needed for the studio connection. Display relies on Article 6(1)(f) GDPR, our legitimate interest in presenting public reviews transparently.

We use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand use of our public website. Only after you allow “Statistics” do we measure page views, “Termin buchen” clicks, page language and technical usage information. Google also receives the IP address needed for communication; GA4 does not log or store IP addresses. Our events do not send names, telephone numbers, appointment-request text or customer identifiers. Successful appointment requests are not currently recorded as analytics events.

The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. We use Basic Consent Mode: before consent and after refusal, no Google analytics scripts or pre-consent cookieless pings load. Withdraw consent for the future at any time through Cookie settings. Withdrawal stops collection and removes our accessible GA cookies; it cannot recall data already transmitted.

The first-party cookies _ga (distinguishing browsers) and _ga_ZD67KM6F52 (session state) are set only with consent. We limit them to 60 days without automatic renewal; your browser may remove them sooner. Our GA4 setting deletes user-level and event-level data after two months. Standard aggregated reports can remain available longer.

Google signals, detailed location and device data collection, advertising personalization and Enhanced Measurement are disabled. Google Ads is not linked. We do not load GA4 in studio areas, the Mini App, WordPress administration or on staging.

Google may also process data in the USA. Google LLC is certified under the EU–US Data Privacy Framework; Google relies on the European Commission’s adequacy decision for covered transfers. See Google transfer frameworks, Google LLC’s DPF entry and Google’s privacy policy. Meta Pixel remains disabled and would require separate marketing consent.

We process contact details, chosen service/variant, preferred time and message to advise you, handle requests and agree appointments. The basis is Article 6(1)(b) GDPR for contracts/pre-contractual steps, otherwise Article 6(1)(f) for handling communications. An appointment is confirmed only by the studio. Please do not send health details, identity documents or payment information in free-text fields. Health data, if necessary, needs its own appropriate basis; cookie consent does not cover it.

Planity is an external booking service considered for the studio; no Planity booking widget is embedded on this website. Website requests use our own form and calendar. If you choose an external Planity booking, contact, service and appointment data are processed according to its own notices. Planity is not automatically our processor for every activity; its role depends on the service and contract. Planity privacy and terms.

Authorised staff manage contact, appointment, service, price, payment-status and history records. Past prices remain in historical records. Existing studio/Arnica records may be imported and checked to continue customer relationships; the visitor browser does not load Arnica content. Bases are Article 6(1)(b) for service, (c) for legal duties and (f) for accountable administration. Operational information is exchanged in the internal Telegram channel. Telegram Messenger Inc. also processes account, message and technical data under its own policy. Cloud chats and bots are not end-to-end encrypted secret chats.

Greta is a digital assistant. The current website selection uses fixed questions and local catalogue data; answers are not sent to a language model. In the separate internal Telegram channel, AI through RouterAI (ООО «Интер», Russia) assists the team. Messages, selected context and requested studio information may be sent to the AI service and its model provider. Processing exclusively within Europe is not guaranteed. AI can be wrong; the studio makes binding appointment confirmations and decisions. Website cookie consent does not authorise internal AI processing. RouterAI privacy.

Identifiable photographs and videos for the website or social media need separate documented permission covering their purpose and channel. Booking or cookie consent is not photo consent. Consent-based publication relies on Article 6(1)(a) GDPR; contact the studio to withdraw it for the future. Image and copyright rights also apply. Copies made by other parties may remain after we remove our publication.

Orders can be stored when you use the shop, cart and collection checkout with payment at the studio. It processes goods, quantities, prices, name and email, and optional phone/order notes. Online payment and delivery are not offered here. PayPal, Google Pay and Apple Pay are planned for future online payments and are not activated. Depending on the chosen payment processor, required contact, order, payment and technical data would go to it and the bank/card network. Google Pay and Apple Pay are wallets and do not by themselves identify the processor. Necessary payment processing relies on Article 6(1)(b) GDPR; legal duties on (c); optional analytics still requires consent. PayPal, Google Pay, Apple Pay.

Authorised studio staff and relevant hosting, communications, booking and, where used, payment/AI providers receive data for their respective purposes; authorities and advisers when legally necessary. Transfers outside the EEA must satisfy Articles 44 onward GDPR, for example an applicable adequacy decision or effective appropriate safeguards. A well-known US provider is not sufficient: DPF certification must cover the relevant entity and processing. We make no blanket promise that every provider is EU-only or certified. Ask the studio for information on the safeguards actually applied.

Duration follows purpose and necessity: enquiries until dealt with and any resulting contract completed, then only where a legal duty or concrete claim/evidence purpose remains; booking/payment documents for their applicable statutory period. Security logs serve operation, error and abuse investigation; specific incidents may require preservation. Photo permissions and proof remain for the authorised use and necessary evidence. Fixed browser lifetimes are listed above. You can ask which period or criteria apply to your particular record.

Subject to legal conditions you have rights of access, correction, erasure, restriction and portability under Articles 15–20 GDPR. Withdraw consent at any time for the future without affecting earlier lawfulness. Object to processing based on legitimate interests for reasons relating to your situation under Article 21; object to direct marketing at any time. Data necessary for contracts is needed to handle them; optional details and consent are voluntary. Our website does not make solely automated decisions with legal or similarly significant effects under Article 22 GDPR.

You may complain to a supervisory authority, particularly where you live or work or where a suspected infringement occurred. In Hesse: Hessian Commissioner for Data Protection and Freedom of Information. Use the studio contact above for requests, withdrawal or questions.