Privacy policy

Last updated: 6 August 2026

This is a courtesy translation. The German Datenschutzerklärung is the legally binding version.

Protecting your personal data matters to us. This policy explains what data we process, for which purposes and on what legal basis, who receives it and what rights you have. It follows the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

  • Razigul Ebner — Saku Razi, owner Razigul Ebner, Michaelbeuernstraße 3, 5020 Salzburg, Austria
  • Phone: +43 699 10740102

We are not legally required to appoint a data protection officer. For any data protection matter please contact us directly using the details above.

2. What data we process

  • Appointment data — your name, phone number, e-mail address, chosen treatment, date and time, and any notes you add when booking.
  • Treatment-related information — details you give us about allergies, skin sensitivities, pregnancy or medical conditions so the treatment can be carried out safely, and a record of previous treatments. Some of this is health data within the meaning of Art. 9 GDPR; we process it solely on the basis of your explicit consent (Art. 9(2)(a) GDPR) and only as far as the treatment requires.
  • Communication data — the content of your calls, messages and enquiries via messenger or social media.
  • Technical data — when you visit this website our hosting provider automatically logs connection data (IP address, browser type, pages viewed, timestamp) to keep the site running and secure.

We never ask for payment details by e-mail and collect no health data beyond what the treatment requires.

3. Purposes and legal bases

  • Booking and carrying out your treatment — performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR).
  • Performing the treatment safely based on your health information — your explicit consent (Art. 9(2)(a) GDPR).
  • Answering enquiries — our legitimate interest in communicating with prospective clients (Art. 6(1)(f) GDPR).
  • Operating and securing the website — our legitimate interest in a stable, secure presence (Art. 6(1)(f) GDPR).
  • Accounting and record keeping — compliance with legal obligations, in particular under the Austrian Federal Fiscal Code (BAO) and Commercial Code (UGB) (Art. 6(1)(c) GDPR).

We do not sell or rent your data.

4. Cookies and consent

This website uses no analytics, advertising or profiling cookies. Only strictly necessary technologies are used. Should we introduce such tools in future, they would not be enabled automatically: we would ask for your prior consent via a banner and update this policy.

The booking module embedded on this site is provided by an external partner and may set the cookies its own operation requires (keeping your booking session alive). Fonts and images are hosted on our own domain; no requests are made to external content delivery networks for them.

5. Recipients of your data

Your data is shared only with those who need it for the purposes in section 3:

  • Blushy (online booking system) — to make, confirm and manage your appointments, as a processor under Art. 28 GDPR.
  • Our hosting provider — Cloudflare, Inc. (Cloudflare Pages) — to deliver and secure this website, as a processor under Art. 28 GDPR.
  • Our tax advisers and public authorities — where legally required.

6. Transfers to third countries

Some providers may process data outside the European Economic Area, in particular in the USA. In those cases we base the transfer on the European Commission's standard contractual clauses or on an adequacy decision (e.g. the EU-US Data Privacy Framework) and take the supplementary measures required. We will provide the basis of a transfer on request.

7. Retention

We keep your data only as long as the stated purposes require. Appointment and treatment data are deleted no later than three years after your last treatment, unless longer statutory retention periods apply. Tax-relevant records are kept for seven years under § 132 BAO. Website connection data is deleted or anonymised automatically after a short period.

8. Security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access: the site is served over HTTPS only, access to client records is limited to those who need it, and our systems are protected by individual accounts. No system can guarantee absolute security.

9. Your rights

Under the GDPR you have the right to:

  • Access (Art. 15) — what data we process about you.
  • Rectification (Art. 16) — correction of inaccurate or incomplete data.
  • Erasure (Art. 17) — deletion of your data, unless a retention obligation applies.
  • Restriction of processing (Art. 18).
  • Data portability (Art. 20) — the data you provided, in a common format.
  • Object (Art. 21) — to processing based on our legitimate interests.
  • Withdraw consent (Art. 7(3)) — at any time, with effect for the future.

An informal message to the contact details in section 1 is enough. We reply within one month. For your protection we may ask you to verify your identity.

10. Right to lodge a complaint

If you believe the processing of your data infringes data protection law, you may lodge a complaint with the supervisory authority:

11. Minors

We do not knowingly process data of persons under 14 without the consent of the person with parental authority. Appointments for minors under 14 must be made by a parent or legal guardian.

12. Photographs and social media

Photographs taken during your treatment are published only with your explicit consent. You may withdraw that consent at any time; the post will then be removed from our channels within a reasonable period.

13. Changes to this policy

We update this policy when our processing or the law changes. The version published on this page is the one in force; the date of the last update is shown at the top.

14. Contact

Razigul Ebner — Saku Razi
Michaelbeuernstraße 3, 5020 Salzburg, Austria
Phone: +43 699 10740102