1. Introduction
Thank you for your interest in our beauty studio. Protecting your personal data is important to us. Below, we explain how personal data is processed when you visit our website and use our online services.
2. Data controller
Owner: Maria Petrenko
Frizstraße 3, 70734 Fellbach, Baden-Württemberg, Germany
Phone: +49 176 55 70 37 14
Email: mail@mary4.beauty
3. Definitions
The definitions in the GDPR apply, in particular Article 4 GDPR (for example, “personal data”, “processing”, “controller” and “processor”).
4. Hosting, infrastructure and log data
- When you access our pages, server log files are processed automatically (IP address, date/time, URL, referrer, user agent and status code).
- Legal basis: Article 6(1)(f) GDPR (legitimate interest in stable and secure operation).
- Retention period: log data is generally stored briefly for security and error analysis, then deleted or anonymised.
- We use standard web/CDN components and a hosting provider for technical operation. Where required, data processing agreements are in place with service providers.
5. Cookies and consent management
- We use technically necessary cookies to provide the website.
- Optional cookies (statistics, marketing and convenience) are set only with your **consent**.
- You can change your selection at any time using the cookie banner.
- Legal bases: Article 6(1)(f) GDPR (necessary cookies) and Article 6(1)(a) GDPR (consent for optional cookies).
- For details, see our **[Cookie Policy](/cookie-policy)**.
6. Contact form and communications
- When you use the contact form, we process the data you enter (for example, name, email, telephone number, subject and message) to handle your enquiry.
- Legal bases: Article 6(1)(b) GDPR (pre-contractual communications) and Article 6(1)(f) GDPR (general enquiries).
- Retention period: until the enquiry has been handled and any statutory retention obligations have expired.
7. Online appointment booking
- When you request or book appointments online, we process the necessary contact and appointment details.
- Legal basis: Article 6(1)(b) GDPR (contract or pre-contractual measures).
- Retention period: in accordance with statutory retention periods or until the purpose has been fulfilled.
7a. Email communications and information about similar services
Service emails. In connection with appointment enquiries, bookings, the provision of booked services and the administration of a customer account, we use your email address for necessary communications, particularly confirmations, appointment changes, cancellations and important information about your appointment or customer account. Where processing is necessary to perform a contract or take pre-contractual measures, the legal basis is Article 6(1)(b) GDPR. Necessary service emails do not contain advertising.
Advertising for our own similar services to existing customers. If we received your email address in connection with the sale of a service and all requirements of section 7(3) of the German Act Against Unfair Competition (UWG) are met, we may inform you by email about Mary4Beauty’s own similar cosmetic treatments, care services and directly related offers. This includes, for example, information about corresponding new or supplementary cosmetic services and suitable offers. Such advertising is sent only if you have not objected to the use of your email address for this purpose and were clearly informed of your right to object when your address was collected and in every relevant email. The data protection legal basis is Article 6(1)(f) GDPR (legitimate interest in informing existing customers about our own similar services), subject to the requirements of section 7(3) UWG. Merely registering a customer account or making an appointment enquiry does not provide blanket permission to send such advertising.
Senders and data used. Emails may be sent from various sender addresses used by Mary4Beauty under the @mary4.beauty domain. Maria Petrenko, as the operator of Mary4Beauty, remains responsible for these communications. For this purpose, we process the email address, the name where applicable, the necessary customer or booking reference, and information about consents given, objections and email blocks. Special categories of personal data, particularly health information, are not analysed for advertising purposes.
Objection. You may object to the processing of your data for direct marketing at any time, free of charge and without giving a reason, particularly through the unsubscribe link in every advertising email or by writing to mail@mary4.beauty. Exercising this right incurs no costs other than any transmission costs at basic rates. After your objection, we will no longer use your email address for this direct marketing. Necessary non-advertising messages for the provision of booked services or administration of the customer account remain unaffected. To prevent further advertising contact, we may retain necessary suppression information.
Limits of this provision. This provision does not constitute general consent to newsletters, advertising for third-party or dissimilar offers, or advertising by SMS or WhatsApp. Where separate consent is required, the relevant advertising is sent only on that basis.
8. Live chat
- The website includes a live chat (Odoo Website Live Chat). Connection and usage data, as well as the content you enter, may be processed.
- Legal basis: Article 6(1)(a) GDPR (consent) or Article 6(1)(b) GDPR (support for pre-contractual enquiries).
9. Embedded maps (Google Maps)
- Google Maps may be embedded to show our location. The map loads only after your consent through the cookie/consent mechanism.
- Provider: Google Ireland Limited. Data may be transferred to third countries.
- Legal basis: Article 6(1)(a) GDPR (consent).
10. Web analytics and tag management
We use analytics and tag services in compliance with data protection requirements; these become active only after consent:
- Google Tag Manager (GTM): manages tags and integrations; generally does not itself process personal data, but may load other services. Provider: Google Ireland Limited. Legal basis: Article 6(1)(a) GDPR.
- Plausible Analytics (domain: analytics.pnet.cloud): privacy-friendly web analytics without personal profiles; IP addresses are not stored permanently. Legal basis: Article 6(1)(a) GDPR.
- Ahrefs Analytics: audience reach and SEO analytics. Legal basis: Article 6(1)(a) GDPR.
Information about possible transfers to third countries (particularly the USA) by individual providers: risks may arise, for example from the lack of a level of data protection comparable to that in the EU. Your consent also covers such transfers (Article 49(1)(a) GDPR).
11. Social media links and WhatsApp
- Our website links to our social media profiles (Instagram and Facebook). When you click a link, the respective platform’s data policies apply.
- We may offer a contact option through WhatsApp. If you use it, WhatsApp’s privacy terms also apply.
- Legal basis: Article 6(1)(a) GDPR (your initiative or consent) or Article 6(1)(b) GDPR (communications).
12. Overview of legal bases
- Article 6(1)(a) GDPR — consent
- Article 6(1)(b) GDPR — contract or pre-contractual measures
- Article 6(1)(f) GDPR — legitimate interests, particularly operational security, prevention of misuse and, where the requirements of section 7(3) UWG are met, direct marketing to existing customers for our own similar services.
13. Recipients and data processing on our behalf
- Hosting, infrastructure and support providers (processors)
- Analytics, communications and tag services where consent has been given
Where required, data processing agreements are in place with all relevant service providers.
14. Retention periods
We process personal data only for as long as necessary for the relevant purposes or as required by statutory retention periods. Data is then deleted or anonymised.
We retain information about objections to direct marketing, particularly the email address and suppression status, to the extent necessary to respect the objection on an ongoing basis and prevent further unwanted advertising. We do not use this information to conduct advertising campaigns.
15. Your rights
You have the following rights in relation to the controller:
- Right of access (Article 15 GDPR)
- Right to rectification (Article 16 GDPR)
- Right to erasure (Article 17 GDPR)
- Right to restriction of processing (Article 18 GDPR)
- Right to data portability (Article 20 GDPR)
- Right to object (Article 21 GDPR) to processing based on Article 6(1)(f) GDPR
- Right to withdraw consent with effect for the future (Article 7(3) GDPR)
- Right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR)
- Right to object at any time to the processing of personal data for direct marketing under Article 21(2) and (3) GDPR; after an objection, the data will no longer be processed for these purposes.
16. Obligation to provide data
Providing your data is necessary to conclude or carry out appointments and contracts (Article 6(1)(b) GDPR). Without this data, we may be unable to handle your request. There is no obligation to provide data for optional services such as analytics, maps or live chat. Use of your email address for direct marketing is not required to book an appointment or receive treatment. Your objection to advertising has no effect on this.
17. Data security
We use technical and organisational measures to protect your data against loss, destruction, access, alteration or disclosure by unauthorised persons.
18. Updates
This Privacy Policy is updated when necessary, for example when functions, providers or legal requirements change.