Privacy policy

1. Controller

The controller responsible for the processing of personal data on this website (Art. 4(7) GDPR) is:

beautytechnik GmbH
represented by its managing director Sascha Mackenberg
Alter Markt 9, 12555 Berlin, Germany
Phone: +49 30 41 73 8577
Email: info@beautytechnik.de

No data protection officer has been appointed, as the requirements of Art. 37 GDPR and Section 38 BDSG (German Federal Data Protection Act) are not met. If you have any questions about data protection, you can reach us at the email address above.

2. Overview and legal bases

We process personal data only to the extent that this is necessary or permitted for operating this website, handling your enquiries and orders, or on the basis of your consent. We rely in particular on the following legal bases:

• Art. 6(1)(a) GDPR – consent (e.g. live chat, statistics, marketing)
• Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures (e.g. enquiries, orders)
• Art. 6(1)(c) GDPR – legal obligation (e.g. retention obligations, proof of consent)
• Art. 6(1)(f) GDPR – legitimate interest (e.g. secure operation, cookieless audience measurement)
• Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act) – consent to storing or accessing information on your device
• Section 25(2) no. 2 TDDDG – storage that is strictly necessary for a service you have requested

You are under no statutory or contractual obligation to provide your data. However, without the information marked as mandatory, we cannot process your enquiry or order. No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

3. Hosting, delivery and server log files

This website is operated on the Lovable platform (Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA; Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden). The pages are delivered via the network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), which also protects the website against attacks and abusive access.

Each time a page is accessed, technically necessary access data are processed: IP address, date and time, requested address (URL), referrer, browser and operating system (user agent), HTTP status code and amount of data transferred. For this purpose, Cloudflare sets the cookie __cf_bm (detection of automated access, lifetime 30 minutes).

• Purpose: delivery of the website, stability, security, defence against attacks.
• Legal basis: Art. 6(1)(f) GDPR; for the cookie, Section 25(2) no. 2 TDDDG.
• Storage period: the providers store the log data only for as long as necessary for these purposes and delete them afterwards.

Provider's privacy information: lovable.dev/privacy

Provider's privacy information: cloudflare.com/privacypolicy

4. Database, images and videos

We store enquiries, orders, records of consent and website content in a database operated by Supabase, Inc. (970 Toa Payoh North #07-04, Singapore 318992), which is provided to us via Lovable Cloud. The database and the storage for product images and brochures are located in a data centre in the EU (Ireland). When images are loaded, your IP address is transmitted to this storage.

Product videos are loaded from storage operated by DigitalOcean, LLC (105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA) located in Frankfurt am Main. In the process, your IP address and technical access data are transmitted to DigitalOcean.

• Purpose: storage of your details and delivery of images, brochures and videos.
• Legal basis: Art. 6(1)(b) GDPR (enquiries, orders) or Art. 6(1)(f) GDPR (display of the website).

Provider's privacy information: supabase.com/privacy

Provider's privacy information: digitalocean.com/legal/privacy-policy

5. Enquiries via our forms

You can contact us via various forms, e.g. the contact and short enquiry forms, live demonstration, product and financing enquiries, "Start a studio", service and support requests, NiSV & Academy, trainings, trade fair offers, applications, as well as the forms on our landing pages and in the AI device advisor. Depending on the form, we process:

• Contact details: name, email address, phone number, studio or practice name, town / postcode
• Content of the enquiry: your message, selected device or variant and quantity, studio size, topic, preferred time frame, and for financing enquiries the device and term
• Live demonstration: location (showroom or your studio), the address for a demonstration in your studio, preferred date and time of day
• Context: name of the form, the page on which you submitted it, time of submission and the source of your enquiry as described in Section 6

Your enquiry is stored in our database (Section 4) and transferred as a lead to our CRM system Odoo provided by Odoo S.A. (Chaussée de Namur 40, 1367 Grand-Rosière, Belgium), in which our sales and service team handles enquiries. In addition, we receive a notification by email and you receive a confirmation of receipt (Section 7).

• Purpose: processing and answering your enquiry, scheduling appointments, preparing a quotation, customer service.
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures or contract); Art. 6(1)(f) GDPR for documenting business contacts in the CRM.
• Storage period: until your enquiry has been fully processed and thereafter for up to 3 years to keep business contacts traceable (Sections 195, 199 BGB, German Civil Code). If a contract is concluded, the statutory retention periods apply (Section 257 HGB, German Commercial Code; Section 147 AO, German Fiscal Code: up to 10 years).

Provider's privacy information: odoo.com/privacy

Job applications

If you apply via the form under "Careers", we process your details in order to carry out the application procedure (Art. 6(1)(b) GDPR in conjunction with Section 26 BDSG). If your application is unsuccessful, we delete your data no later than 6 months after the procedure has ended, unless you have consented to longer storage. If you are hired, the data are transferred to your personnel file.

6. Source of your enquiry (website source)

In order to understand through which channels enquiries reach us, we note on the first page view of your visit the landing page, the referring website (external sites only) and any campaign parameters (utm_source, utm_medium, utm_campaign). Without your consent, this information remains only in your browser's working memory and is lost when the page is reloaded. Only if you have consented to the "Statistics" or "Marketing" category do we store it for the duration of the session in your browser's session storage (bt-lead-source).

Only with your consent to the "Marketing" category do we additionally store the click identifiers of Google (gclid) and Meta (fbclid, cookie _fbc) in session storage (bt-lead-clicks).

This information is only transmitted when you submit a form. We then store it together with your enquiry in our database and in Odoo (Section 5).

• Purpose: attributing your enquiry to the source or campaign through which you found us, and evaluating our advertising measures.
• Legal basis: storage in the browser: consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); transmission with the enquiry: Art. 6(1)(f) GDPR (legitimate interest in evaluating our marketing channels), for click identifiers Art. 6(1)(a) GDPR.
• Storage period: in the browser until the end of the session; with the enquiry as described in Section 5.

7. Sending of emails

We send confirmations of receipt, notifications to our team as well as order and shipping confirmations via the email infrastructure of Lovable (Section 3) from the sender address noreply@beautytechnik.de. In the process, your email address, your name and the content of the message are processed. Each email sent is logged with the recipient address, time and status. Replies to these emails go to info@beautytechnik.de.

• Purpose: confirmation and processing of your enquiry or order.
• Legal basis: Art. 6(1)(b) GDPR.
• Storage period: we store the sending log for as long as the associated enquiry or order (Sections 5 and 8).

8. Online shop and orders

We offer an online shop for consumables and selected products. We store your shopping cart in your browser's local storage (bt-cart) until you place an order or empty it. When you place an order, we process your name, company, email address, phone number, billing and delivery address, VAT ID where applicable, the items ordered, prices, payment method, payment and shipping status and the tracking number.

• Payment by card and other payment methods via Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter your payment details directly with Stripe; we only receive the payment status.
• Payment via PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. The payment is processed by PayPal; we only receive the payment status.
• Payment in advance / bank transfer: we process the details of your bank transfer at our bank.
• Shipping: for delivery, we pass on your name, delivery address and, where applicable, your phone number or email address to the commissioned shipping company (e.g. DHL, Deutsche Post, DPD, GLS, UPS, Hermes).

• Purpose: processing of your order, payment, shipping and customer service.
• Legal basis: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR for retention under tax and commercial law; for the shopping cart, Section 25(2) no. 2 TDDDG.
• Storage period: order data for up to 10 years in accordance with Section 257 HGB and Section 147 AO.

Provider's privacy information: stripe.com/de/privacy

Provider's privacy information: paypal.com/de/legalhub/privacy-full

9. AI device advisor

Our AI device advisor recommends suitable devices based on your description. Your input is transmitted via the AI Gateway of Lovable (Section 3) to a language model of OpenAI (USA) and processed there; we do not arrange for the input to be stored by the model provider. We do not store the input ourselves. Section 5 only applies once you subsequently submit a form. Please do not enter any personal data (e.g. health data) in the advisor.

• Purpose: answering your question about suitable devices.
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual measure at your request).

10. Google reviews

On the homepage, we display our rating and selected reviews from Google Maps. We retrieve these on the server side via the Google Places API of Google Ireland Limited; no data about you are transmitted to Google in the process. The public reviews are displayed with the names of their authors. You are only taken to Google when you click a link to Google Maps.

• Legal basis: Art. 6(1)(f) GDPR (display of our customer reviews).

11. Consent management and records of consent

On your first visit, our consent banner asks which categories you allow: Necessary (always active), Convenience (live chat), Statistics and Marketing. We store your choice in your browser's local storage (beautytechnik-consent). You can change it at any time via "Cookie settings" in the footer or here, and withdraw your consent with effect for the future (Art. 7(3) GDPR).

As proof of your consent (Art. 7(1) GDPR), we log the following for each decision: time, selected categories, version of the consent, page accessed, browser (user agent) and a SHA-256 hashed value of your IP address (not the IP address in plain text).

• Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR; for storage in the browser, Section 25(2) no. 2 TDDDG.
• Storage period: log 3 years; choice in the browser until you change it or we ask you again after a change to the services.

12. Cookies and browser storage

Without your consent, we only set cookies or entries that are strictly necessary for the display and security of the website or for a service you have requested (Section 25(2) no. 2 TDDDG). All others are only set after you have consented to the respective category (Section 25(1) TDDDG).

The lifetimes of third-party cookies are determined by the providers and may change.

13. Google Tag Manager and Google Consent Mode

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA), to integrate Google's services (Sections 14 and 15). The Tag Manager is loaded on every page; in the process, your IP address and your user agent are transmitted to Google.

We use Google Consent Mode v2. As long as you have not given your consent, all consent signals are set to "denied": Google Analytics and Google Ads then do not set or read any cookies and do not use any user or advertising identifiers. Only cookieless signals without identifiers are transmitted (e.g. that a page was viewed or a form was submitted, with time, page, browser and device information), which Google uses for aggregated, modelled analyses. Cookies and identifiers are only used after you have consented to "Statistics" (Analytics) or "Marketing" (Ads).

• Legal basis: cookieless signals without consent: Art. 6(1)(f) GDPR (legitimate interest in measuring the success of our website and advertising); after consent: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.
• Objection: you can object to the processing without consent at any time (Section 23), e.g. by email to info@beautytechnik.de.

Provider's privacy information: policies.google.com/privacy

14. Google Analytics 4

With your consent ("Statistics" category), we use Google Analytics 4 provided by Google Ireland Limited. Google Analytics records which pages you view, how you reached the website, scroll depth, clicks on phone, email and WhatsApp links, the start and submission of forms (form name only, no input), approximate location (derived from the IP address), device, browser and operating system. IP addresses are not stored by Google Analytics 4. The retention period for event data is limited to a maximum of 14 months. Google Analytics is linked to our Google Ads account in order to measure the success of our ads.

• Purpose: audience measurement and improvement of the website.
• Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

Provider's privacy information: policies.google.com/privacy

15. Google Ads (conversion tracking, remarketing, enhanced conversions)

With your consent ("Marketing" category), we use Google Ads provided by Google Ireland Limited:

• Conversion tracking: if you reach us via a Google ad, it is measured whether you subsequently send an enquiry, click on phone, email or WhatsApp, or complete an order. For this purpose, the Conversion Linker stores the click identifier.
• Remarketing: visitors to our website may be assigned to audiences so that our ads can later be shown to them on other websites and in Google services.
• Enhanced conversions: when a form is submitted, the email address or phone number you entered may be hashed with SHA-256 in your browser and transmitted to Google in order to attribute the conversion to a Google account. This only happens if you have consented to the "Marketing" category.

• Purpose: measurement and optimisation of our advertising campaigns, remarketing.
• Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.
• Storage period of the cookies: see Section 12.

Provider's privacy information: policies.google.com/privacy

16. Microsoft Clarity

With your consent ("Statistics" category), we use Microsoft Clarity provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (parent company: Microsoft Corporation, USA). Clarity records mouse movements, clicks, scrolling behaviour and page views in pseudonymised form and uses them to create heatmaps and session recordings. Input in form fields is masked and not transmitted. Clarity also sets cookies on Microsoft Bing domains (see Section 12).

• Purpose: improvement of user guidance and error analysis.
• Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.
• Storage period: recordings at Microsoft up to 30 days, analyses up to 13 months.

Provider's privacy information: privacy.microsoft.com

17. Meta Pixel (Facebook, Instagram)

With your consent ("Marketing" category), we load the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (parent company: Meta Platforms, Inc., USA). The pixel records page views and the submission of an enquiry ("Lead" event), sets the cookies _fbp / _fbc and transmits these to Meta together with your IP address and user agent. If you are logged in to Facebook or Instagram, Meta can attribute the visit to your account.

We and Meta are joint controllers for the collection and transmission (Art. 26 GDPR); any further processing is the sole responsibility of Meta. You can find the joint controller agreement at facebook.com/legal/controller_addendum. You can also exercise your rights directly against Meta.

• Purpose: measurement, targeting and optimisation of our advertising on Facebook and Instagram.
• Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

Provider's privacy information: facebook.com/privacy/policy

18. Meta Conversions API (server-side transmission)

Only if you have consented to the "Marketing" category do we additionally transmit a "Lead" event from our server to Meta via the Meta Conversions API when you submit an enquiry. The following are transmitted:

• your email address and phone number, each hashed with SHA-256 (not in plain text),
• IP address and user agent,
• the cookie values _fbp / _fbc,
• a random event ID, the time and the page on which you sent the enquiry.

Purpose: more reliable measurement and avoidance of double counting with the pixel. Legal basis: Art. 6(1)(a) GDPR. Hashing is a protective measure, not anonymisation; the data remain personal data. No event is transmitted for support requests.

19. Ahrefs Web Analytics

We use Ahrefs Web Analytics provided by Ahrefs Pte. Ltd., 16 Raffles Quay, #33-03 Hong Leong Building, Singapore 048581. Without cookies and without storing anything on your device, Ahrefs measures which pages are viewed, through which source visitors arrive, as well as country, browser and device type. No user profiles are created across websites; the IP address is only processed in truncated or hashed form.

• Purpose: data-minimising audience measurement and optimisation of our content for search engines.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimising audience measurement).
• Objection: at any time (Section 23), e.g. by email to info@beautytechnik.de.

Provider's privacy information: ahrefs.com/legal/privacy-policy

20. Odoo live chat

With your consent ("Convenience" category), we integrate the live chat provided by Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium. The chat window is loaded from our Odoo system (beautytechnik.odoo.com); in the process, your IP address is transmitted to Odoo, and the chat stores entries in your browser's local storage (Section 12). Without this consent, the chat is not loaded.

• Data processed: chat content, contact details provided voluntarily, time, page accessed, IP address, browser and device information.
• Purpose: answering your questions about our devices and services directly.
• Legal basis: loading the chat: Art. 6(1)(a) GDPR, Section 25(1) TDDDG; chat content: Art. 6(1)(b) GDPR.
• Storage period: chat histories are stored in Odoo for as long as necessary for processing and deleted afterwards; statutory retention periods remain unaffected.

Provider's privacy information: odoo.com/privacy

21. Links to other services

Our website contains links to WhatsApp (Meta Platforms Ireland Limited), Google Maps and other websites. These are simple links without embedded content; data are only transmitted when you click a link. If you write to us via WhatsApp, WhatsApp's privacy information applies; we process your message in order to reply (Art. 6(1)(b) GDPR).

22. Recipients and transfers to third countries

We use the following service providers. Where they process data on our behalf, we have concluded data processing agreements with them in accordance with Art. 28 GDPR or accepted their terms:

• Lovable Labs Incorporated (USA) / Lovable Labs AB (Sweden): hosting, sending of emails, AI gateway
• Cloudflare, Inc. (USA): delivery and protection of the website
• Supabase, Inc. (Singapore; data storage in the EU): database, file storage
• DigitalOcean, LLC (USA; storage location Frankfurt): product videos
• Odoo S.A. (Belgium): CRM and live chat
• OpenAI (USA): language model for the AI device advisor, via Lovable
• Google Ireland Limited / Google LLC (USA): Tag Manager, Analytics, Ads, Places API
• Microsoft Ireland Operations Limited / Microsoft Corporation (USA): Clarity
• Meta Platforms Ireland Limited / Meta Platforms, Inc. (USA): Pixel, Conversions API
• Ahrefs Pte. Ltd. (Singapore): Web Analytics
• Stripe Payments Europe, Ltd. (Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): payments
• Shipping companies: delivery of orders

Transfers to countries outside the EU or the EEA (in particular the USA and Singapore) take place on the basis of an adequacy decision of the EU Commission (for the USA: EU-U.S. Data Privacy Framework, Art. 45 GDPR, insofar as the recipient is certified) or of EU standard contractual clauses (Art. 46(2)(c) GDPR).

Note: even with these safeguards, access by authorities in the USA cannot be completely ruled out. Where services are based on your consent, this consent also covers the associated transfer (Art. 49(1)(a) GDPR).

23. Your rights

You have the following rights with regard to your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR), e.g. via the cookie settings

To exercise your rights, a message to info@beautytechnik.de is sufficient.

24. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59–61, 10555 Berlin
www.datenschutz-berlin.de

25. Data security

This website is encrypted using TLS (recognisable by "https://" in the address bar). Only authorised staff have access to enquiries and orders.

26. Changes to this privacy policy

We will adapt this privacy policy if our website, the services used or the legal situation change. The version published on this page at any given time applies.