Privacy Policy

Last updated: May 2026

The protection of your personal data is very important to me. In this privacy policy, I provide you with transparent information about what data I collect, how I use it, and what rights you have—in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Responsible body

The entity responsible for the processing of personal data within the meaning of the GDPR is:

Schminkzimmer

Ewa Zuzanna Faß

Speyerer Straße 72

67105 Schifferstadt

E-Mail: ewa@schminkzimmer.com

Telephone: 01776365671

A data protection officer is not required by law, as the studio does not exceed the thresholds set forth in Article 37 of the GDPR.

2. Types of Data I gather

Depending on how you use my services, I collect the following categories of personal data:

Contact Information – Name, phone number, email address (appointment scheduling & correspondence)

Health Data*– Allergies, skin conditions, pregnancy, medications, pre-existing conditions (medical history & consent forms: collected via Google Forms, stored in Google Drive)

Treatment Data – Type, date, and outcome of the treatment; products used (documentation & quality assurance)

Payment Information – Payment method, invoice amount (billing & accounting)

Communication Data – Messages via WhatsApp Business, email, or phone (to schedule an appointment)

Website Data – IP address, browser type, duration of visit (technical operation of the website)

*Health data is considered particularly sensitive data under Article 9 of the GDPR. I collect this data only with your explicit consent and only to the extent necessary to ensure the safe administration of your treatment.

3. Purposes & Legal Bases

I process your data exclusively for specified purposes, based on the following legal grounds under the GDPR:

Appointment Scheduling & Treatment Administration – Art. 6(1)(b) of the GDPR ( fulfilment of a contract)

Anamnesis & Informed Consent Forms (Collected via Google Forms, Stored in Google Drive) – Art. 9(2)(a) of the GDPR (explicit consent)

Billing & Accounting – Art. 6(1)(c) of the GDPR (legal obligation, § 257 of the German Commercial Code (HGB), § 147 of the German Fiscal Code (AO))

Customer Communication (Appointment Confirmation, Reminder) – Art. 6(1)(b) of the GDPR ( fulfilment of a contract)

Appointment Scheduling & Management via Studiolution – Art. 6(1)(b) of the GDPR ( fulfilment of a contract)

Newsletter & Offers – Art. 6(1)(a) of the GDPR (Consent) – may be cancelled at any time

Treatment Documentation for Quality Assurance – Art. 6(1)(f) of the GDPR (legitimate interest)

Website Operations – Art. 6(1)(f) of the GDPR (legitimate interest)

4. Retention Period

I will retain your data only for as long as is necessary for the respective purpose or as required by statutory retention periods:

Customer Master Data & Treatment Records: up to 10 years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB))
Health data / History: at least 3 years; up to 10 years for medically relevant treatments
Invoices and payment records: 10 years (legal requirement)
Consents (e.g., newsletters): until revoked; records must be retained for an additional 3 years thereafter
Communication data: up to 6 months after the completion of the respective transaction

Once the retention periods have expired, your data will be securely deleted or anonymized.

5. Disclosure to Third Parties

As a general rule, I do not share your information with third parties without your consent. Exceptions apply in the following cases:

Accountant – Disclosure of invoice data to comply with tax obligations (Data Processing Agreement pursuant to Art. 28 of the GDPR)
Studiolution GmbH – Booking, point-of-sale, and payment system. Processing of contact, appointment, and payment data (Data Processing Agreement pursuant to Art. 28 of the GDPR; see Section 7)
Google LLC (Google Forms) – Collection of medical histories and informed consent forms via online forms (Data Processing Agreement pursuant to Art. 28 of the GDPR; see Section 7)
Google LLC (Google Drive) – Storage of the collected data (Data Processing Agreement pursuant to Art. 28 of the GDPR; see Section 7)
IT Technician – Technical administration of the Google account (contractually required; no access to customer data; see Section 7)
Government Agencies & Courts – when required by law or by an official order
Payment Service Provider – to the extent necessary for processing payments

Data will only be transferred to third countries outside the EU/EEA if an adequate level of data protection is ensured (e.g., the EU-U.S. Data Privacy Framework).

6. Google Forms & Google Drive – Case history & informed consent forms

To collect and store case histories and informed consent forms, I use two products from Google LLC (U.S.), both of which are certified under the EU-U.S. Data Privacy Framework and for which a data processing agreement has been entered into in accordance with Article 28 of the GDPR.

Google Forms – Data Collection: Medical histories and informed consent forms are collected via Google Forms. You fill out the form digitally; the data you enter is processed through Google's servers. For more information: policies.google.com/privacy

Google Drive – Data Storage: The completed forms and documents are stored in encrypted form on Google Drive. For more information: policies.google.com/privacy

Authorized users: Access to Google Forms and Google Drive is restricted exclusively to Ewa Zuzanna Faß and a contracted IT technician who is responsible for the technical administration of the account. This technician does not have access to customer data and is contractually bound to maintain confidentiality (Data Processing Agreement pursuant to Art. 28 of the GDPR).

Your options: If you do not consent to the use of Google Forms or Google Drive, you can alternatively fill out the medical history form on paper at the studio—the documents will then be stored exclusively in a locked cabinet. However, the completion of the health questionnaire is a prerequisite for any treatment—it ensures your safety.

7. Studiolution – Booking, Point-of-Sale, and Payment System

For scheduling appointments, customer management, cash register transactions, and payment processing, I use Studiolution (Studiolution GmbH, Germany). The following data is processed: name, contact information, appointment history, treatment details, and payment information.

Studiolution is a German provider that operates servers exclusively in Germany and is fully compliant with the GDPR. A data processing agreement has been entered into in accordance with Article 28 of the GDPR. Your data will not be used by Studiolution for its own purposes.

For more information: studiolution.com/datenschutz

8. Communication & Newsletter

I'll contact you regarding appointment confirmations, reminders, and general information through the following channels:

Telephone – for scheduling appointments and last-minute changes
E-Mail – Confirmations, information, invoices
WhatsApp Business (Meta Platforms Ireland Ltd.) – Quick communication & appointment reminders. Messages are processed through Meta’s servers. Please do not share sensitive health information via WhatsApp—share it in person or by phone instead. Privacy information: whatsapp.com/legal/privacy-policy

You may object to being contacted through specific channels at any time without having to provide a specific reason.

Newsletter & Offers – optional & can be unsubscribed from at any time: Newsletters and promotional offers are sent out exclusively on a voluntary basis with your express consent. This is not a prerequisite for my services. You can unsubscribe at any time without providing a reason—via email, WhatsApp, or in person at the studio.

9. IT Technician, WordPress & Hosting (Strato)

My website is hosted on servers provided by Strato AG (Deutschland) When you visit the website, technical data (IP address, browser type, operating system, date/time) is processed on Strato’s servers. A data processing agreement has been entered into with Strato in accordance with Article 28 of the GDPR. For more information: strato.de/datenschutz

For the technical management of the website (WordPress), hosting (Strato), and email account, there is a contractually bound IT Technician. This party has administrative access to these systems—but no access to the content of customer data. It is contractually obligated to maintain confidentiality and comply with the GDPR (Data Processing Agreement pursuant to Article 28 of the GDPR).

10. Cookies & Cookie Consent

My website uses cookies. Cookies are small text files that are stored on your device when you visit the website.

Technically Necessary Cookies are set without your consent—they are necessary for the operation of the website (e.g., language settings, session cookies). Legal basis: Art. 6(1)(f) of the GDPR (legitimate interest).

Not necessary cookies (e.g., analytics or marketing cookies) are set only with your explicit consent. Legal basis: Art. 6(1)(a) of the GDPR (consent).

If you are visiting my website for the first time, you will see a cookie banner, where you can consent to or reject the use of non-essential cookies. You can withdraw your consent at any time—either through the cookie banner (which you can access again via the “Cookie Settings” link in the footer) or through your browser settings.

Manage or delete cookies in your browser: Most browsers allow you to view, block, or delete cookies. You can find more information about this in your browser's settings.

11. Online Presence, Photos, and Third-Party Services

I am active on the following platforms, where personal data may be processed:

Homepage (schminkzimmer.com) When you visit my website, certain technical data is processed (IP address, browser type, duration of visit). This data is used exclusively for the technical operation of the website.

WhatsApp Business (Meta Platforms Ireland Ltd.) I use WhatsApp Business to communicate with customers. Data is processed via Meta's servers. Privacy policy: whatsapp.com/legal/privacy-policy

Google Maps (Google LLC, USA) My studio is listed on Google Maps. Photos, reviews, and location information may be publicly viewable there. Google is certified under the EU-U.S. Data Privacy Framework. Privacy information: policies.google.com/privacy

Google Drive (Google LLC, USA) Storage of case histories and informed consent forms. For more details, see Section 6.

Photos & Before/After Pictures: Photos of you will be taken and published—on my website or my Google Maps profile—only with your explicit written consent. You may revoke this consent at any time; any content that has already been published will be removed immediately upon your request.

12. Data Security

I take appropriate technical and organizational measures to protect your data:

Storage of Paper Documents in Lockable Cabinets
Password protection and up-to-date antivirus software on devices in use
Encrypted Connections (SSL/TLS) on the Website
Restricted Access to Personal Data—Only Authorized Individuals
Contractual Obligations for All Third Parties (IT, Accounting) Regarding Confidentiality and the GDPR
Regular Data Backups

13. Your Rights

Under the GDPR, you have the following rights, which you may exercise at any time by contacting me:

Access to Information (Art. 15) – Information about the personal data I have stored about you
Rectification (Art. 16) – Correction of inaccurate or incomplete data
Deletion (Art. 17) – Deletion of your data, provided there are no legal retention requirements to the contrary
Restriction (Art. 18) – Restriction of processing, e.g., during a verification process
Data Portability (Art. 20) – Receiving your data in a structured, machine-readable format
Objection (Art. 21) – Objection to processing based on legitimate interests

Withdrawal of Consent: You may revoke your consent (e.g., for newsletters, photos, Google Drive) at any time without providing a reason—in writing, by email, or in person at the studio. Revoking your consent does not affect the lawfulness of any processing that took place prior to the revocation.

Right to File a Complaint: You have the right to file a complaint with the relevant data protection supervisory authority:

State Commissioner for Data Protection and Freedom of Information, Rhineland-Palatinate Hintere Bleiche 34, 55116 Mainz Tel.: 06131 / 8920-0 Email: poststelle@datenschutz.rlp.de

14. Data of Minors

My services are generally intended for individuals 16 years of age or older. For clients under 16, I obtain consent from a parent or legal guardian before collecting personal information or providing treatments.

15. Updates to This Privacy Policy

I reserve the right to update this privacy policy in the event of changes to my services, legal changes, or changes to data processing. The most current version is available on this page and posted in the studio. In the event of significant changes, I will inform you in advance—to the extent possible.

16. Contact Information for Data Protection Inquiries

If you have any questions regarding data protection, exercising your rights, or withdrawing your consent, please contact me directly:

Schminkzimmer

Ewa Zuzanna Faß

Speyerer Straße 72, 67105 Schifferstadt

E-Mail: ewa@schminkzimmer.com

Telephone: 01776365671

I will do my best to respond to your request within 30 days—as required by the GDPR.