Privacy policy

Premium Hair is our passion!

We look forward to your visit to our website princesspa.de and your interest in our company.

The protection of your personal data, such as date of birth, name, telephone number, address, etc., is an important concern for us.

The purpose of this Privacy Policy is to inform you about the processing of your personal data that we collect from you during a page visit. Our data protection practice is in accordance with the statutory provisions of the General Data Protection Regulation of the EU (GDPR) and the Federal Data Protection Act (BDSG). The following data protection declaration serves to fulfil the information obligations resulting from the GDPR. These can be found, for example, in Art. 13 and Art. 14 et seq. GDPR.

Person responsible

The controller within the meaning of Art. 4 No. 7 GDPR is the person who alone or jointly with others decides on the purposes and means of processing personal data.

With regard to our website, the person responsible is:

PrincesSpa
Am Mühlberg 20
93077 Bad Abbach
Germany
E-mail: Caroline.scheil@gmx.de
Tel.: 015125281950

Provision of the website and creation of log files

Every time our website is called up, our system automatically collects data and information of the respective accessing device (e.g. computer, mobile phone, tablet, etc.).

Which personal data are collected and to what extent are they processed?

(1) information about the browser type and version used;

(2) the operating system of the retrieval device;

(3) host name of the accessing computer;

(4) the IP address of the retrieval device;

(5) the date and time of access;

(6) websites and resources (images, files, other page contents) accessed on our website;

(7) websites from which the user’s system came to our website (referrer tracking);

(8) reporting whether the retrieval was successful;

(9) Amount of data transferred

This data is stored in the log files of our system. The storage of these data together with personal data of a specific user does not take place, so that an identification of individual page visitors does not take place.

Legal basis for the processing of personal data

Article 6 (1) lit. f GDPR (legitimate interest). Our legitimate interest is to ensure the achievement of the purpose described below.

Purpose of data processing

The temporary (automated) storage of the data is required for the expiration of a website visit in order to enable the delivery of the website. The storage and processing of personal data is also carried out in order to maintain the compatibility of our website for as many visitors as possible and to combat abuse and remedy malfunctions. For this purpose, it is necessary to log the technical data of the retrieving computer in order to be able to react as early as possible to display errors, attacks on our IT systems and/or errors in the functionality of our website. In addition, the data serves us to optimize the website and to generally ensure the security of our information technology systems.

Duration of storage

The deletion of the aforementioned technical data takes place as soon as it is no longer required to ensure the compatibility of the website for all visitors, but at the latest 3 months after our website has been accessed.

Possibility of objection and deletion

You can object to the processing at any time pursuant to Art. 21 GDPR and request the deletion of data pursuant to Art. 17 GDPR. The rights you are entitled to and how you assert them can be found in the lower section of this Privacy Policy.

Special features of the website

Our website offers you various functions in the use of which personal data is collected, processed and stored by us. Below we explain what happens to this data:

Live chat function

Scope of processing of personal data

The data you enter in our live chat, such as name and content.

Legal basis for the processing of personal data

Article 6 (1) lit. a GDPR (consent by unambiguous affirmative action or conduct)

Purpose of data processing

We will only use the data recorded through our live chat to process requests received through our live chat.

Duration of storage

After processing your request, which has been received by us in our live chat, the collected data will be deleted immediately, unless there are legal retention periods.

Possibility of withdrawal and deletion

The revocation and deletion options are governed by the general provisions on the right of revocation and deletion under data protection law as set out below in this data protection declaration.

The necessity of providing personal data

The use of the live chat takes place on a voluntary basis and is neither contractually nor legally required. You are not obliged to contact us via the live chat. You can also use the other contact options provided on our website. If you do not enter the necessary information, you cannot use our live chat.

Login Area/Registration

Scope of processing of personal data and collected personal data

The registration and login data you have entered with us or the registration and login data you have provided.

Legal basis for the processing of personal data

Article 6 (1) lit. b GDPR (implementation (before) of contractual measures)

Purpose of data processing

You have the possibility to use a separate login area on our website. In order for us to check your authorization to use the protected area or documents, you must enter your login data (email or username and password) in the corresponding form. If required, we can send you your login data or the possibility to have the password reset by e-mail on request.

Duration of storage

The collected data will be stored as long as you maintain a user account with us.

Possibility of objection and deletion

The necessity of providing personal data

The use of the login area on our site is contractually prescribed for the use of the protected area. The use of the content protected by the login area is not possible without entering the personal data. If you want to use our login area, you must fill in the fields marked as mandatory (username and password). Entering the data requires the existence of a user account. Login is not possible if the data you entered is incorrect. If you enter the data incorrectly or not, the protected area cannot be used. However, the rest of the page can still be used without login.

Newsletter Registration Form

Which personal data are collected and to what extent are they processed?

By subscribing to the newsletter on our website, we receive the e-mail address entered by you in the registration field and, if necessary, further contact details if you provide them to us via the newsletter registration form.

Legal basis for the processing of personal data

Article 6 (1) lit. a GDPR (consent by unambiguous affirmative action or conduct)

Purpose of data processing

The data recorded in the registration form of our newsletter are used by us exclusively for sending our newsletter, in which we inform about all our services and our news. After signing up, we will send you a confirmation email containing a link that you must click to complete the subscription to our newsletter (double opt-in).

Duration of storage

Our newsletter can be unsubscribed at any time by clicking on the unsubscribe link, which is also included in each newsletter. Your data will be deleted by us immediately after unsubscribing, provided that there are no legal retention obligations. In the event of an unfinished registration, your data will also be deleted immediately by us. We reserve the right to erasure without giving reasons and without prior or subsequent information.

Possibility of withdrawal and deletion

The revocation and deletion options are governed by the general provisions on the right of revocation and deletion under data protection law as set out below in this data protection declaration.

The necessity of providing personal data

If you wish to use our newsletter, you must fill in the fields marked as mandatory and confirm the e-mail address by clicking on the double opt-in link. The details of the newsletter registration are neither necessary to enter into a contract with us nor legally obligatory. They are used exclusively for sending our newsletter. If you do not fill in the required fields, we cannot provide you with our newsletter service.

Automated credit check/scoring

If you wish to conclude a contract with us, we reserve the right to carry out an exclusively automated processing of your personal data in order to check your creditworthiness. We are also entitled to such an automated decision in accordance with Art. 22 para. 2 a GDPR. Whether or not the contract can be concluded depends on the result of the automated credit check. A credit check calculates statistical probabilities of a default. The credit quality information can contain probability values (score values), which are calculated on the basis of scientifically accepted mathematical-statistical methods. A large number of features, such as, for example, income, address data, occupation, marital status and previous payment behaviour, are used to infer the customer’s future risk of default. The result is expressed in the form of a payment value (so-called score). The information thus obtained is the basis of our decision to establish, implement or terminate a contractual relationship. If you believe that you have been wrongly excluded from the conclusion of the contract due to the credit check, you are welcome to explain your point of view to us by e-mail. We will then review the automated decision in accordance with Art. 22 para. 3 GDPR in specific individual cases. In order to be able to carry out the creditworthiness test, we may, in accordance with Art. 6 para. 1 lit. b GDPR store and process your personal data.

Based on the incoming contract, we transmit your data to the following provider (s) in the following cases:

Automatic identity and credit check when selecting payment methods “PayPal via PayPal Plus,” “Direct debit via PayPal Plus,” “Credit card via PayPal Plus” or “PayPal Plus invoice”

Which personal data are collected and to what extent are they processed?

If you have selected “PayPal via PayPal Plus,” “Direct Debit via PayPal Plus,” “Credit card via PayPal Plus” or “PayPal Plus Invoice,” we will forward your personal customer data collected as part of the payment processing to the PayPal company. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal Plus”). If you give your consent, the following data are affected by the data transmission: first and last name, street, house number, zip code, city, date of birth, telephone number as well as the data related to your order.

Legal basis for the processing of personal data

Article 6 (1) lit. b GDPR (implementation (before) of contractual measures)

Purpose of data processing

PayPal Plus performs a credit check when you select one of the payment methods listed below, “PayPal via PayPal Plus,” “Credit card via PayPal Plus,” “Direct Debit via PayPal Plus” or “PayPal Plus Invoice.” Mathematical-statistical methods are used to calculate a rating with respect to the probability of a default (so-called calculation of a scoring value). PayPal Plus bases the calculated scoring value of its decision to provide the respective payment methods. The calculation of a scoring value is carried out in accordance with recognised scientific procedures. The PayPal Privacy Policy is also referred to: Https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Duration of storage

We will store the relevant data for the processing of the payment as long as it is necessary for the execution of the transaction. Insofar as the data are subject to statutory retention obligations, the deletion takes place after the end of the retention obligation. The duration of storage of the data by PayPal results from PayPal’s privacy policy: Https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Possibility of objection and deletion

You can object to the processing at any time pursuant to Art. 21 GDPR and request the deletion of the data pursuant to Art. 17 GDPR. The rights you are entitled to and how you assert them can be found in the lower section of this Privacy Policy.

Automatic identity and creditworthiness check when selecting PayPal payment method

Which personal data are collected and to what extent are they processed?

If you have selected “PayPal” as the payment method, we will forward your personal customer data collected as part of the order to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”). If you give your consent, the following data are affected by the data transmission: first and last name, street, house number, zip code, city, date of birth, telephone number as well as the data related to your order.

Legal basis for the processing of personal data

Article 6 (1) lit. b GDPR (implementation (before) of contractual measures)

Purpose of data processing

PayPal performs a credit check when you select the PayPal payment method. Mathematical-statistical methods are used to calculate a rating with respect to the probability of a default (so-called calculation of a scoring value). PayPal bases the calculated scoring value of its decision to provide the respective payment methods. The calculation of a scoring value is carried out in accordance with recognised scientific procedures. The PayPal Privacy Policy is also referred to: Https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Duration of storage

Possibility of objection and deletion

Statistical evaluation of visits to this website – Webtracker

We collect, process and store the following data when accessing this website or individual files of the website: IP address, website from which the file was retrieved, name of the file, date and time of the retrieval, transmitted data quantity and message about the success of the retrieval (so-called web log). We use this access data exclusively in non-personalized form for the continuous improvement of our website and for statistical purposes. We also use the following web trackers to evaluate the visits to this website:

MailChimp

We use the MailChimp service of The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, 30308 Atlanta, United States of America, email: Dpo@mailchimp.com, website: Https://mailchimp.com/. Processing shall also take place in a third country for which there is no adequacy decision by the Commission. Therefore, the standard level of protection for the GDPR during transmission cannot be guaranteed, since it cannot be excluded that authorities in the third country, for example, can access the collected data.

Your consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, which you have made on our website.

We use the Service to display the newsletter and a subscription option on our website.

You can revoke your consent at any time. Further information on the revocation of your consent can be found either at the consent itself or at the end of this data protection declaration.

Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://mailchimp.com/legal/.

The provider also offers an opt-out option under https://mailchimp.com/legal/.

Integration of external web services and processing of data outside the EU

On our website we use active content from external providers, so-called web services. By accessing our website, these external providers may receive personal information about your visit to our website. It may be possible to process data outside the EU. You can prevent this by installing an appropriate browser plugin or disabling the execution of scripts in your browser. This may result in functional limitations on websites that you visit.

We use the following external web services:

Google Fonts

We use Google Fonts from Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States of America, Email: Support-de@google.com, Website: Http://www.google.com/. Processing shall also take place in a third country for which there is no adequacy decision by the Commission. Therefore, the standard level of protection for the GDPR during transmission cannot be guaranteed, since it cannot be excluded that authorities in the third country, for example, can access the collected data.

Your consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, which you have made on our website.

The Google Fonts service reloads fonts on our site to allow you to view the page in a visually better version.

You can revoke your consent at any time. Further information on the revocation of your consent can be found either at the consent itself or at the end of this data protection declaration.

Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://policies.google.com/privacy.

Google APIS

We use Google APIS from Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States of America, Email: Support-de@google.com, Website: Http://www.google.com/. Processing shall also take place in a third country for which there is no adequacy decision by the Commission. Therefore, the standard level of protection for the GDPR during transmission cannot be guaranteed, since it cannot be excluded that authorities in the third country, for example, can access the collected data.

Your consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, which you have made on our website.

We use Google APIS to reload further services from Google on the website. Google Apis is a collection of interfaces for communication between the various Google services used on your website.

The service or we collect the following data for processing itself: IP address

You can revoke your consent at any time. Further information on the revocation of your consent can be found either at the consent itself or at the end of this data protection declaration.

Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://policies.google.com/privacy.

Gstatic

We use the company’s Gstatic service Google LLC, 1600 Amphitheatre Parkway, 94043 Mointain View, United States of America, email: Support-de@google.com, website: Http://www.google.com/. Processing shall also take place in a third country for which there is no adequacy decision by the Commission. Therefore, the standard level of protection for the GDPR during transmission cannot be guaranteed, since it cannot be excluded that authorities in the third country, for example, can access the collected data.

Your consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, which you have made on our website.

Gstatic is a static content retrieval service used by Google to reduce bandwidth usage and pre-load required catalog files.

You can revoke your consent at any time. Further information on the revocation of your consent can be found either at the consent itself or at the end of this data protection declaration.

Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://policies.google.com/privacy.

WordPress

We use the WordPress service of Automattic Inc., 60 29th Street # 343, CA 94110 San Francisco, United States of America, e-mail: Vipprivacyshield@automattic.com, website: Https://automattic.com/. Processing shall also take place in a third country for which there is no adequacy decision by the Commission. Therefore, the standard level of protection for the GDPR during transmission cannot be guaranteed, since it cannot be excluded that authorities in the third country, for example, can access the collected data.

According to Art. 6 para. 1 lit. f GDPR represents our legitimate interest in the processing. Our legitimate interest lies in achieving the purpose described below.

WordPress is the technical system behind our website for operating our WordPress website. We need the integration so that we can view and edit our website.

With regard to processing, you are entitled to the right to object set out in Article 21. Further information can be found at the end of this privacy policy.

Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://automattic.com/privacy/.

Jivochat/JivoSite

We use the Jivochat/JivoSite service of Jivosite, Inc., 1811 Silverside Road, 19810 Wilmington, Delaware,, United States of America, email: Privacy@jivochat.com, website: Https://www.jivochat.com/. Processing shall also take place in a third country for which there is no adequacy decision by the Commission. Therefore, the standard level of protection for the GDPR during transmission cannot be guaranteed, since it cannot be excluded that authorities in the third country, for example, can access the collected data.

Your consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, which you have made on our website.

The service is used to integrate a chat message on our website and to operate the chat. It is part of the chat software behind the chat.

You can revoke your consent at any time. Further information on the revocation of your consent can be found either at the consent itself or at the end of this data protection declaration.

Further information on the handling of the transmitted data can be found in the provider’s privacy policy under https://www.jivochat.com/files/privacy_policy.pdf.

Website check seal

We use the Website-Check Seal service of the company Website-Check GmbH, Beethovenstraße 24, 66111 Saarbrücken, Germany, e-mail: Support@website-check.de, website: Http://www.website-check.de/. The transfer and processing of personal data takes place exclusively on servers in the European Union.

According to Art. 6 para. 1 lit. f GDPR represents our legitimate interest in the processing. Our legitimate interest lies in achieving the purpose described below.

The script of the website check GmbH is the technical integration of the website check seal. With this seal we want to show that we take the subject of data protection very seriously. Due to the inclusion of the website check check seal, non-personal data is transferred to the website check GmbH as publisher of the check seal so that they can technically deliver it.

With regard to processing, you are entitled to the right to object set out in Article 21. Further information can be found at the end of this privacy policy.

Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://www.website-check.de/datenschutzerklaerung/.

Information on the use of cookies

Scope of processing of personal data

We integrate and use cookies on various pages to enable certain functions of our website and to integrate external web services. The so-called “cookies” are small text files that your browser can store on your access device. These text files contain a characteristic string that uniquely identifies the browser when you return to our website. The process of storing a cookie file is also referred to as “setting a cookie.” Cookies can be set both by the website itself and by external web services.

Legal basis for the processing of personal data

Article 6 (1) lit. f GDPR (legitimate interest) or Art. 6 para. 1 lit. a or Article 9 (2) lit. a GDPR (consent).

The legal basis for this is given in the cookie table listed later on this point.

In general, our legitimate interest in cookies which are collected on the basis of a legitimate interest is to ensure the functionality of our website and the services integrated therein (technically necessary cookies). In addition, cookies may increase their usability and enable a more individual approach. Here we have made a balance between your interests and our interests.

With the help of cookie technology, we can identify, analyse and track individual website visitors only if the website visitor is involved in the use of the cookie in accordance with Art. 6 para. 1 lit. a GDPR.

Purpose of data processing

The cookies are set by our website or external web services in order to maintain the full functionality of our website, to improve the usability or to pursue the purpose stated with your consent. Cookie technology also allows us to recognize individual visitors using pseudonyms, such as individual or random IDs, so that we can offer more individual services. Details are listed in the following table.

Duration of storage

The cookies listed below are stored in your browser until they are deleted or, in the case of a session cookie, until the session has expired. Details are listed in the following table:

woocommerce_items_in_cart

.princesspa.de

WordPress

The cookie controls the shopping cart of the shop system and is necessary for inserting goods into the shopping cart.

Technically necessary

Meeting

Basic functionality

cookies.js

princesspa.de

Web page operator

This cookie allows us to store individual comfort settings you have chosen and keep them for your current and future site visits.

Approval

a few seconds

Configuration

mailchimp_landing_site

princesspa.de

Web page operator

This cookie allows us to store individual comfort settings you have chosen and keep them for your current and future site visits.

Approval

approx. 28 days

Configuration

woocommerce_cart_hash

.princesspa.de

Web page operator

This cookie allows us to store individual comfort settings you have chosen and keep them for your current and future site visits.

Approval

Meeting

Configuration

wp_woocommerce_session_e7f31506737445ff9fd354176ea77848

.princesspa.de

Web page operator

This cookie allows us to store individual comfort settings you have chosen and keep them for your current and future site visits.

Approval

approx. 2 days

Configuration

Possibility of objection, revocation of consent and deletion

You can set your browser according to your wishes in such a way that the setting of cookies is generally prevented. You can then decide on the acceptance of cookies on a case-by-case basis or accept cookies in principle. Cookies can be used for various purposes, e.g. to recognize that your access device is already connected to our website (permanent cookies) or to store recently viewed offers (session cookies). If you have expressly granted us permission to process your personal data, you can revoke this consent at any time. Please note that this does not affect the lawfulness of the processing carried out on the basis of consent until revocation.

Data security and data protection, communication by e-mail

Your personal data will be protected by technical and organizational measures during collection, storage and processing in such a way that they are not accessible to third parties. In the case of unencrypted communication by e-mail, we cannot guarantee complete data security on the way to transmission to our IT systems, so that we recommend encrypted communication or postal service for information with a high need for confidentiality.

Claim for information and requests for correction – Deletion & restriction of data – Revocation of consent – Right to object

Information claim

You have the right to request confirmation as to whether we process personal data from you. If this is the case, you have a right to information about the information specified in Art. 15 para. 1 GDPR, unless the rights and freedoms of other persons are affected (cf. Art. 15 para. 4 GDPR). We are also happy to provide you with a copy of the data.

Correction claim

In accordance with Art. 16 GDPR, you have the right to have incorrectly stored personal data (such as address, name, etc.) corrected at any time. You can also request completion of the data stored by us at any time. Appropriate adjustments shall be made immediately.

Right to erasure

In accordance with Art. 17 para. 1 GDPR, you have the right to delete the personal data collected about you if the data is either no longer required;

on the basis of the revocation of your consent, the legal basis of the processing has disappeared without replacement;

you have objected to the processing and there are no legitimate reasons for the processing;

your data is processed unlawfully;

a legal obligation requires this or a survey has taken place in accordance with Art. 8 para. 1 GDPR.

The right does not exist in accordance with Art. 17 para. 3 GDPR if the processing is necessary for the exercise of the right to freedom of expression and information;

your data has been collected on the basis of a legal obligation;

processing is necessary for reasons of public interest;

the data are required to assert, exercise or defend legal claims.

Right to restriction of processing

According to. Article 18 (1) GDPR you have the right in individual cases to request the restriction of the processing of your personal data.

This is the case if you dispute the accuracy of the personal data;

the processing is unlawful and you do not agree to a deletion;

the data is no longer required for the purpose of processing, but the data collected serves to assert, exercise or defend legal claims;

an objection to the processing according to Art. 21 para. 1 GDPR has been filed and it is still unclear which interests outweigh.

Right of revocation

If you have given us explicit consent to the processing of your personal data (Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR), you can revoke it at any time. Please note that this does not affect the lawfulness of the processing carried out on the basis of consent until revocation.

Right to object

In accordance with Art. 21 GDPR, you have the right to object at any time to the processing of personal data concerning you, which is based on Art. 6 para. 1 lit. f (in the context of a legitimate interest) have been brought to object. You are entitled to the right only if there are special circumstances against the storage and processing.

How do you exercise your rights?

You can exercise your rights at any time by contacting the contact details below:

PrincesSpa
Am Mühlberg 20
93077 Bad Abbach
Germany
E-mail: Caroline.scheil@gmx.de
Tel.: 015125281950

Right to data portability

According to Art. 20 GDPR, you have a right to transfer the personal data concerning you. The data is provided by us in a structured, common and machine-readable format. The data can be transmitted to you or to a responsible person named by you.

Upon request, we provide the following data in accordance with Art. 20 para. 1 GDPR:

Data based on explicit consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR;

Data that we have pursuant to Art. 6 para. 1 lit. b have received GDPR from you under existing contracts;

Data processed as part of an automated process.

We will carry out the transfer of personal data directly to a controller you want, insofar as this is technically feasible. Please note that we may not transfer data that interferes with the freedoms and rights of other persons in accordance with Art. 20 para. 4 GDPR.

Right of appeal to the supervisory authority pursuant to Art. 77 para. 1 GDPR

If you suspect that your data will be processed unlawfully on our site, you can, of course, bring about a judicial clarification of the problem at any time. In addition, any other legal option is open to you. In accordance with Art. 77 para. 1 GDPR, you have the possibility to contact a supervisory authority. The right of appeal in accordance with Art. 77 GDPR is your right in the EU Member State of your place of residence, your place of work and/or the place of the alleged infringement, i.e. you can choose the supervisory authority to which you are contacting from the above-mentioned locations. The supervisory authority to which the complaint was filed then informs you of the status and results of your submission, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

Created by:

This post is also available in DE.