Privacy Policy

1. Controller

Email: info@sirigajaspa.de
Telephone: +49 (0)159 0632 8095

2. General information on data processing

We process personal data only where necessary to provide our website, respond to enquiries, arrange appointments or comply with legal obligations.

Personal data means any information relating to an identified or identifiable natural person.

Processing is based in particular on the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

3. Hosting and website delivery

This website is delivered through Vercel.

Vercel Inc.
340 S Lemon Ave #4133
Walnut, CA 91789
USA

Technically necessary connection and log data may be processed when the website is accessed, including:

• IP address
• date and time of access
• requested page or file
• browser type and version
• operating system
• referrer URL
• technical error and security information

This processing delivers the website securely, reliably and efficiently and prevents misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure and uninterrupted website operation.

Where data is processed outside the EEA, this takes place only in compliance with the legal requirements for international transfers, in particular appropriate safeguards under Articles 44 et seq. GDPR.

Vercel Privacy Notice
Vercel Data Processing Addendum

4. Strictly necessary storage and cookie settings

We use strictly necessary storage technologies so the website functions securely and your cookie settings can be stored in your browser.

Legal bases:

• Article 6(1)(f) GDPR
• Section 25(2) TDDDG

Optional technologies for analytics, external content or marketing are activated only after your explicit consent. The website currently integrates no such optional technologies.

Legal bases for any future consent-based activation:

• Article 6(1)(a) GDPR
• Section 25(1) TDDDG

You may change or withdraw consent at any time through “Cookie Settings” in the footer.

5. Contacting us

If you contact us by email, telephone or a messaging service offered on the website, we process the data you provide, particularly your name, email address or telephone number, message content and time of contact.

The purpose is to handle your enquiry. The legal basis is Article 6(1)(b) GDPR for enquiries concerning a contract or pre-contractual steps and Article 6(1)(f) GDPR for general enquiries.

Data is erased when no longer required to handle the enquiry and no statutory retention duty or legitimate reason for further storage applies. The website currently has no contact form.

6. Online appointment booking

The website currently provides neither an online booking form nor an external booking widget. Booking buttons lead to the contact page; appointment requests can be made by telephone or WhatsApp.

When arranging an appointment, we process the reservation information supplied, particularly name, telephone number, email address (if provided), preferred location, treatment, date and time, duration, number of people, special requests, booking status and, where applicable, assigned practitioner.

Processing is necessary to arrange the appointment and prepare or perform the treatment contract under Article 6(1)(b) GDPR.

WhatsApp

The website contains links to WhatsApp. Only when you follow a link and use WhatsApp will your telephone number, profile and connection data and communication content be transferred according to your input.

WhatsApp Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

We use the information to respond and arrange appointments. The legal basis is Article 6(1)(b) GDPR for contract-related messages and otherwise Article 6(1)(f) GDPR. WhatsApp may process data outside the EEA using the transfer mechanisms it describes. We erase messages held by us when no longer needed and no statutory duty or legitimate reason applies. We have no control over WhatsApp's independent storage.

WhatsApp Privacy Policy

7. Booking confirmations and reminders

No automated email or SMS confirmations or reminder services are configured in the project. Where we respond by telephone, email or WhatsApp about a specific appointment, contact details are used solely for booking-related communication under Article 6(1)(b) GDPR.

9. External content and services

Google Maps (external link)

The website does not embed an interactive Google map. It displays a locally generated panel and provides only an external route-planning link. No data is transmitted to Google before you click. On following it you leave our website; Google may process your IP address, device and browser information and requested location or search query.

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

The purpose is route planning at your request. Because our website neither embeds Maps nor accesses or stores device information for this link, it is not assigned to a consent category. Further processing is Google's responsibility. Google may process data in third countries using the transfer mechanisms it describes.

Google Privacy Policy

10. Server logs and security

Technical log data may be processed to deliver the website, detect attacks, investigate technical errors and prevent misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure and reliable operation. We do not state a fixed retention period because none is defined in the available project configuration.

11. Retention periods

We retain personal data only as long as required for the relevant purpose or while statutory retention obligations apply.

Booking and contract data is retained according to statutory commercial and tax-law retention obligations where it forms part of business records.

Pure contact enquiries are generally erased once conclusively handled and no legal or legitimate reason for further storage applies.

Consent records are retained as long as necessary to demonstrate that valid consent was obtained.

12. Legal bases

• Article 6(1)(a) GDPR: consent
• Article 6(1)(b) GDPR: contract or pre-contractual steps
• Article 6(1)(c) GDPR: legal obligation
• Article 6(1)(f) GDPR: legitimate interests

13. Your rights

Subject to legal requirements, you have in particular the rights to:

• access under Article 15 GDPR
• rectification under Article 16 GDPR
• erasure under Article 17 GDPR
• restriction under Article 18 GDPR
• data portability under Article 20 GDPR
• object under Article 21 GDPR
• withdraw consent under Article 7(3) GDPR

Withdrawal takes effect for the future and does not affect processing carried out before withdrawal.

14. Right to lodge a complaint

You may complain to a data protection supervisory authority. The authority responsible for Saxony-Anhalt is:

Telefon: +49 (0)391 81803-0
E-Mail: poststelle@lfd.sachsen-anhalt.de
Offizielle Kontaktseite

15. Requirement to provide data

Information identified as required to arrange an appointment is necessary to carry out the requested booking or contract. Without it, an appointment may not be arranged. No online ordering function is currently available.

16. Automated decision-making

No solely automated decision-making, including profiling, within Article 22 GDPR takes place unless expressly stated elsewhere.

17. Data security

We use appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and other misuse.

The website is transmitted securely using HTTPS.

18. Changes to this Privacy Policy

We may update this Privacy Policy if legal requirements, technical functions or service providers change.

The current version is available on this website.