Privacy Policy

§ 1 General

Your personal data such as your name, e-mail address, telephone number and address are processed by us only in accordance with the provisions of German data protection law and the data protection law of the European Union (EU). The following provisions inform you about the purposes of processing, recipients, legal bases and storage periods, as well as about your rights and the controller responsible for the processing of your data. This privacy policy applies only to our websites. If you are redirected to other sites via links on our pages, please inform yourself there about the respective handling of your data.

§ 2 Data processing for the performance of a contract

(1) Purpose of processing
Your personal data, which you provide to us when contacting us, when registering a user account or when booking an appointment, are required for communicating with us and for providing our services. You are not obliged to contact us. Without providing your e-mail address, we cannot reply to you. If you send us an enquiry before entering into a contract, by e-mail, via a contact form etc., we process the data received in this way to carry out pre-contractual measures and, for example, answer your questions about our platform. If you book an appointment with a salon via Salonado, we process the data required for the booking (in particular your name, e-mail address, telephone number where applicable, the selected service and the appointment) and transmit these to the respective salon so that it can carry out the appointment. If you operate a salon profile on Salonado as a salon owner, we process the data you provide during registration and profile maintenance in order to provide the platform functions. We inform you about the appointment and any changes to it by e-mail (transactional e-mails, e.g. booking confirmations and reminders).

(2) Legal basis
The legal basis for this processing is Art. 6(1)(b) GDPR.

(3) Categories of recipients
Hosting provider, payment service provider (Stripe, see § 9), the respective salon with which you book an appointment, and e-mail delivery service providers for transactional e-mails.

(4) Storage period
We store the data required for the performance of the contract until the expiry of the statutory warranty periods and, where applicable, contractual guarantee periods. We retain the data required under commercial and tax law for the periods prescribed by law, as a rule ten years (cf. § 257 HGB (German Commercial Code), § 147 AO (German Fiscal Code)). Data processed for the purpose of carrying out pre-contractual measures are deleted as soon as the measures have been carried out and it is evident that no contract will be concluded. We store the data of your user account until you delete your account.

§ 3 Hosting and server log files

(1) Purpose of processing
When you access our website, the web server automatically stores information transmitted by your browser in so-called server log files. This includes in particular the IP address, date and time of access, the page or file accessed, the amount of data transferred, the browser and operating system used, and the previously visited page (referrer). These data are required for the technical provision of the website, ensuring trouble-free operation, error analysis and defending against attacks.

(2) Legal basis
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and functional provision of the website).

(3) Categories of recipients
Our hosting provider processes the data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR.

(4) Storage period
The server log files are stored only for as long as is necessary for the purposes stated and are then deleted or anonymised.

§ 4 Cookies and comparable technologies

(1) Purpose of processing
Cookies and comparable storage technologies are used on this website. Technically necessary cookies are required to ensure the basic operation of the website (e.g. to store your consent decision or for logging in to your user account). In addition, we use cookies for analysis purposes and for loading external map services only if you have expressly consented to this. Before any processing requiring consent, you will receive a notice (cookie banner) when you first access the website, via which you can allow or refuse their use.

(2) Legal basis
The legal basis for processing by means of technically necessary cookies is Art. 6(1)(f) GDPR in conjunction with § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). The legal basis for processing by means of cookies requiring consent is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

(3) Storage period
The storage period of the individual cookies varies depending on the provider and purpose. You can find information on this in the cookie banner and in the following sections on the respective services.

(4) Withdrawal
You can withdraw or adjust your consent at any time with effect for the future. To do so, click on "Cookie settings" in the footer. The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent up to the time of withdrawal.

§ 5 Consent management

(1) Purpose of processing
To manage your consents to cookies and similar technologies, we use the open-source solution "vanilla-cookieconsent". When you access the website, a banner is displayed via which you can consent to or refuse individual categories of cookies. The selection you make is stored in a technically necessary cookie and in your browser's local storage (LocalStorage) so that the banner does not appear again on future visits and your settings are taken into account.

(2) Legal basis
The legal basis for storing your consent decision is Art. 6(1)(c) GDPR (compliance with a legal obligation to document consent) and Art. 6(1)(f) GDPR (legitimate interest in the user-friendly management of consents).

(3) Categories of recipients
No data are transferred to third parties. The data are stored exclusively locally in your browser.

(4) Storage period
The consent decision is stored for a period of 6 months. After that, the banner is displayed again so that you can confirm or adjust your consent.

§ 6 Google Analytics 4

(1) Purpose of processing
If you have given your consent, we use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), on this website. Google Analytics uses cookies and similar technologies to analyse the use of the website. Among other things, information about pages visited, time spent, device and country of origin is collected. We use this information to evaluate the use of the website, to compile reports on website activity and to improve the website.

(2) IP anonymisation
Google Analytics 4 truncates the IP address by default before it is stored. This rules out any direct identification of individuals.

(3) Legal basis
The legal basis for the processing is your express consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer.

(4) Categories of recipients and transfer to third countries
The recipient of the data is Google Ireland Limited as the responsible entity within the EU. A transfer to third countries (in particular the USA) cannot be ruled out. For the USA, an adequacy decision of the EU Commission exists (EU-US Data Privacy Framework), under which Google LLC is certified. In addition, we have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

(5) Storage period
The data collected by GA4 are stored by default for 14 months and then deleted automatically.

(6) Further information
You can find Google's privacy policy at https://policies.google.com/privacy. Information on the terms of use of Google Analytics can be found at https://marketingplatform.google.com/about/analytics/terms/de/.

§ 7 Google Maps

(1) Purpose of processing
On the salon pages we embed interactive maps from the Google Maps service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) in order to show you the location of the respective salon. The map is only loaded if you have consented to the "Maps" category via the cookie banner. Without consent, a placeholder is displayed instead of the map and no data are transmitted to Google. When the map is loaded, a connection to Google servers is established, whereby in particular your IP address is transmitted. In addition, we use the Google Geocoding API on the server side to determine the map coordinates of salon addresses. No personal data of website visitors are transmitted to Google in this process.

(2) Legal basis
The legal basis for embedding Google Maps is your express consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer.

(3) Categories of recipients and transfer to third countries
The recipient of the data is Google Ireland Limited. A transfer to third countries (in particular the USA) cannot be ruled out. For the USA, an adequacy decision of the EU Commission exists (EU-US Data Privacy Framework), under which Google LLC is certified.

(4) Further information
You can find Google's privacy policy at https://policies.google.com/privacy.

§ 8 Sign in with Google

(1) Purpose of processing
You have the option of registering and signing in to Salonado with your existing Google account (Google Sign-In). The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). If you use this function, you are redirected to Google and sign in there with your credentials. We then receive from Google the data required to create your account, in particular your name and your e-mail address. Your Google credentials are never transmitted to us. The use of this function is voluntary; alternatively, you can register with your e-mail address.

(2) Legal basis
The legal basis for the processing is Art. 6(1)(b) GDPR (provision of the user account at your request). Google is responsible for the data processing carried out by Google as part of the sign-in process.

(3) Categories of recipients and transfer to third countries
When you sign in, a connection to Google servers is established. A transfer to third countries (in particular the USA) cannot be ruled out. For the USA, an adequacy decision of the EU Commission exists (EU-US Data Privacy Framework), under which Google LLC is certified.

(4) Storage period
We store the account data received from Google until you delete your Salonado user account.

(5) Further information
You can find Google's privacy policy at https://policies.google.com/privacy.

§ 9 Online payments via Stripe

(1) Purpose of processing
For online payments when booking an appointment, we use the payment service provider Stripe. The provider for users in the EU is Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). If you pay for a booking online, the data required for processing the payment (in particular your name, payment details such as card data, amount and currency) are collected and processed directly by Stripe. Your complete payment details are not stored on our servers. Payments are processed via Stripe Connect, meaning the payment amount goes to the respective salon with which you booked the appointment. Stripe also processes your data for fraud prevention and to fulfil its own legal obligations.

(2) Legal basis
The legal basis for the processing is Art. 6(1)(b) GDPR (payment processing for the performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in secure and reliable payment processing and fraud prevention).

(3) Categories of recipients and transfer to third countries
The recipient of the data is Stripe Payments Europe, Ltd. as well as the respective salon, which receives the payment amount and the payment status via Stripe Connect. A transfer to Stripe, Inc. in the USA cannot be ruled out. For the USA, an adequacy decision of the EU Commission exists (EU-US Data Privacy Framework), under which Stripe, Inc. is certified.

(4) Storage period
We retain payment-related data within the scope of retention obligations under commercial and tax law, as a rule ten years (cf. § 257 HGB, § 147 AO). Stripe's privacy policy applies to the storage period at Stripe.

(5) Further information
You can find Stripe's privacy policy at https://stripe.com/de/privacy.

§ 10 Rights of the data subject

If your personal data are processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

1. Right of access

You may request confirmation from the controller as to whether personal data concerning you are being processed by us. If such processing is taking place, you may request access to the following information from the controller:
(1) the purposes for which the personal data are processed;
(2) the categories of personal data which are processed;
(3) the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;
(4) the envisaged period for which the personal data concerning you will be stored or, if specific information on this is not possible, the criteria used to determine the storage period;
(5) the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
(6) the existence of a right to lodge a complaint with a supervisory authority;
(7) all available information on the origin of the data, where the personal data are not collected from the data subject;
(8) the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you are transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.

2. Right to rectification

You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you are inaccurate or incomplete. The controller must carry out the rectification without undue delay.

3. Right to restriction of processing

Under the following conditions, you may request the restriction of the processing of the personal data concerning you:
(1) if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
(2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
(3) the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims, or
(4) if you have objected to the processing pursuant to Art. 21(1) GDPR and it has not yet been established whether the legitimate grounds of the controller override your grounds.

Where the processing of the personal data concerning you has been restricted, such data may, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the processing has been restricted in accordance with the conditions set out above, you will be informed by the controller before the restriction is lifted.

4. Right to erasure

a) Obligation to erase
You may request the controller to erase the personal data concerning you without undue delay, and the controller is obliged to erase these data without undue delay, where one of the following grounds applies:
(1) The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
(2) You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR and there is no other legal basis for the processing.
(3) You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
(4) The personal data concerning you have been unlawfully processed.
(5) The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
(6) The personal data concerning you have been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.

b) Information to third parties
Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17(1) GDPR to erase them, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copies or replications of, those personal data.

c) Exceptions
The right to erasure does not apply to the extent that processing is necessary
(1) for exercising the right of freedom of expression and information;
(2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, in so far as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
(5) for the establishment, exercise or defence of legal claims.

5. Right to be informed

If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients.

6. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where
(1) the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and
(2) the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another controller, where technically feasible. The freedoms and rights of other persons must not be adversely affected by this. The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of the personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions. The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of the personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Right to withdraw the declaration of consent under data protection law

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the time of withdrawal.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
(1) is necessary for entering into, or the performance of, a contract between you and the controller,
(2) is authorised by Union or Member State law to which the controller is subject and that law lays down suitable measures to safeguard your rights and freedoms and your legitimate interests, or
(3) is based on your explicit consent.

However, these decisions must not be based on special categories of personal data referred to in Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) applies and suitable measures to safeguard your rights and freedoms and your legitimate interests have been taken. With regard to the cases referred to in (1) and (3), the controller shall take suitable measures to safeguard your rights and freedoms and your legitimate interests, which include at least the right to obtain human intervention on the part of the controller, to express your own point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of the personal data concerning you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

Controller responsible for data processing

Salonado
Viktor Töws
Röpkestraße 61
40235 Düsseldorf
Germany

Contact

Phone: +49 211 5426 9771
Web: salonado.com
Contact: Form