Privacy Policy
Note: This translation is provided for your convenience only. Only the German version is legally binding.
1. Data protection at a glance
The following notes provide a simple overview of what happens to your personal data when you visit this website.
2. Controller
Nora El Hindi - Art of Beauty
Ottostraße 29, 54294 Trier
Email: info@noraelhindi-artofbeauty.de
3. Server logs
When visiting this website, technical data (IP address, time, browser, operating system) are temporarily stored in the server log. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in stable, secure services).
4. Cookies & sessions
We use cookies in three categories. On your first visit we expressly ask for your consent via a cookie banner (Art. 6 para. 1 lit. a GDPR in conjunction with § 25 TTDSG). Necessary cookies are set without consent (§ 25 para. 2 no. 2 TTDSG). You can revoke or adjust your choice at any time via the link "Change cookie settings" in the footer. We store your decision for 365 days and log it for the obligation to provide proof (Art. 7 para. 1 GDPR) in the internal consent log.
4.1 Cookies used
| Name | Category | Purpose | Storage period |
|---|---|---|---|
AOB_SESS | Necessary | Session cookie (login, cart, CSRF) | Browser session, max. 2 h |
aob_csrf | Necessary | CSRF protection for forms | Session |
aob_consent | Necessary | Stores your cookie selection | 365 days |
aob_vid | Necessary | Anonymous visitor ID for proof of consent | 365 days |
| (optional) | Statistics | Anonymised audience measurement | only with consent |
| (optional) | Marketing/push | Push notifications, personalised offers | only with consent |
You can revoke your consent at any time via the link Cookie Settings or directly in your customer account under My account → Privacy.
5. Contact form & customer account
When using the contact form or customer account, your details (name, email, telephone, message) are stored to process your enquiry. Legal basis: Art. 6 para. 1 lit. b GDPR (initiation of contract) or lit. a (consent).
6. Newsletter
Registration for the newsletter takes place using the double opt-in procedure. You can revoke your consent at any time by clicking the unsubscribe link.
Performance measurement. Unsere Newsletter enthalten ein kleines Zählpixel und Links mit einer pseudonymen Kennung. Damit erfassen wir, ob ein Newsletter geöffnet und welche Links angeklickt wurden (Zeitpunkt, Newsletter, angeklickter Link, gekürzte Browser-Kennung, IP-Adresse nur als täglich wechselnder, nicht rückrechenbarer Hashwert zur Erkennung automatischer Aufrufe). Die Kennung enthält keine E-Mail-Adresse. Wir nutzen die Daten ausschließlich, um unsere Newsletter zu verbessern; sie werden nicht an Dritte weitergegeben und nach spätestens 24 Monaten gelöscht. Rechtsgrundlage ist deine Einwilligung in den Newsletter (Art. 6 Abs. 1 lit. a DSGVO); mit der Abmeldung endet auch die Messung. Öffnungen lassen sich technisch nicht sicher feststellen, etwa weil Mailprogramme Bilder vorab laden oder blockieren.
7. Online booking
Online appointments are handled directly through our own booking system. We only collect the data required to arrange the appointment (name, e-mail, telephone, preferred date) and store it until the statutory retention periods expire. Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual steps).
7a. Security log for bookings
What we log. In addition to the booking itself, we keep a security log of booking-related operations: the creation, modification, rescheduling and cancellation of an appointment, as well as the recording of a no-show. For each of these operations we store the time, the channel used (website, customer app, cancellation link from the email, studio), the address called up within our site, the browser identifier and – insofar as the operation took place via a request to our website – the IP address from which the request came. Added to this are the details from the booking itself (name, email, telephone number, treatment, appointment and booking time, status).
Why. We have repeatedly received bookings that turned out to be fabricated; some of these incidents have been reported to the law enforcement authorities. Without such documentation it is possible neither to detect misuse nor to substantiate a specific incident to the authorities. The log serves this purpose alone – preventing misuse of our booking system, safeguarding operations, and asserting, exercising or defending legal claims. It is not used for advertising, reach measurement, profiling or the assessment of individuals.
Legal basis. Art. 6(1)(f) GDPR. Our legitimate interest is protection against abusive bookings and the preservation of evidence for legal claims (cf. Recitals 47 and 49 GDPR); where the data serves the handling of the appointment itself, additionally Art. 6(1)(b) GDPR.
Storage period. We automatically delete the IP address in plain text after 30 days. After that, only a value that cannot be traced back remains, from which it is still possible to tell that two operations came from the same connection, without the address itself continuing to be stored. The rest of the log entry is deleted after 365 days at the latest. Exception: If a case concerns a criminal complaint, ongoing proceedings or a specific legal defence, we suspend automatic deletion for that particular case until it is concluded (Art. 17(3)(e) GDPR).
Access. Only expressly authorised accounts belonging to the studio management can access the security log
No location tracking, no attribution to individuals. We do not derive locations or identities from IP addresses and we do not use device fingerprinting. An IP address documents an internet connection at a point in time, not a person.
Your right to object. You can object to the processing under Art. 21 GDPR on grounds relating to your particular situation. We will then check whether our protective interests prevail in the individual case. You will find your rights to access and erasure under point 15.
8. Audience measurement with Google Analytics 4
What happens. We use Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It shows us which pages are visited and how visitors find their way to us. This helps us improve the website.
Only after your consent. Google Analytics is only loaded if you have consented to the “Statistics” category. Without your consent, no Google script is loaded and no connection to Google is established.
What is recorded. Pages visited, time spent, approximate location, device and browser, as well as the page that brought you to us. Your IP address is truncated. We cannot personally identify you from this.
Legal basis. Your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can revoke it at any time via “Cookie settings” in the page footer; the revocation takes effect immediately and for the future.
Third country. A transfer to the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework. More details in the Google's privacy policy.
9. Google Ads and conversion measurement
What happens. We advertise with Google Ads (Google Ireland Limited, address as above). So that we can tell whether an ad actually led to an appointment booking, an enquiry or an order, we measure these conversions.
Only after your consent. This service, too, is only loaded if you have consented to the “Marketing” category.
What is recorded. Which of our pages you visited after clicking an ad and whether an action relevant to us took place. We only receive aggregated reports from Google; this does not allow us to identify you personally.
Enhanced conversions. When you complete an appointment booking, an enquiry or an order, we additionally transmit your e-mail address and – if provided – your telephone number to Google, but only as an irreversible hash value. Google matches this value against Google accounts in order to attribute an ad to the booking. These details never leave our server in plain text, and this matching only takes place if you have consented to “Marketing”.
Consent Mode. We use Google Consent Mode v2. Until you have given your consent, advertising and analytics storage remain disabled.
Calls from ads. If you tap the call button directly in a Google ad, Google may connect the call via its own forwarding number. Google records the start, end and duration of the call as well as your phone number and area code, and tells us whether a call lasted longer than 60 seconds. All we learn from this is that an ad led to a call. Calls are not recorded, and we do not pass call data on to third parties – both are explicitly switched off in our Google Ads account. This process takes place within the ad and therefore depends not of the cookie consent on this website. The legal basis is our legitimate interest in measuring the success of our advertising, Art. 6(1)(f) GDPR. Further details in the Google's privacy policy.
Legal basis. Your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG, revocable at any time.
10. Meta Pixel (Facebook and Instagram)
What happens. We use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It lets us measure whether our ads on Facebook and Instagram lead to a booking or an order, and show visitors to our website suitable ads.
Only after your consent. The Meta Pixel is only loaded if you have consented to the “Marketing” category. Without consent, no connection to Meta is established.
What is transmitted. Events such as “page viewed”, “product viewed”, “added to cart”, “purchase” or “appointment booked” – each with technical identifiers, not with your name.
Additionally server-side (Conversions API). We additionally send the same events directly from our server to Meta. Reason: transmissions from the browser are often lost, for example due to ad blockers. So that an event is not counted twice as a result, both transmissions carry the same identifier. This route, too, is only used if you have consented to “Marketing”. Details such as e-mail address or telephone number are only transmitted as an irreversible hash value – they never leave our server in plain text.
Joint responsibility. We are jointly responsible with Meta for the collection and transmission (Art. 26 GDPR). You can find the agreement on this at Meta.
Third country. A transfer to the USA is possible. Meta Platforms Inc. is certified under the EU-US Data Privacy Framework. More details in the Meta's privacy policy.
Legal basis. Your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG, revocable at any time.
11. Payment processing
What happens. If you pay for your order online, we pass the necessary data on to the payment service provider you select during checkout. We ourselves store none full card numbers or bank login details – you enter these directly with the respective provider.
To whom. Depending on the payment method chosen:
- Card, Klarna or SEPA direct debit – Stripe Payments Europe Limited, Dublin, Ireland. For Klarna, Klarna Bank AB (publ), Stockholm, Sweden, is also involved. Privacy at Stripe
- PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Privacy at PayPal
- Card payment on site – hobex AG, Salzburg, Austria.
For Prepayment, bank transfer or cash payment at the studio no payment service provider is involved.
What is transmitted. Name, billing and, where applicable, delivery address, e-mail address, order number and amount. With Klarna, the provider may additionally carry out its own credit check; Klarna is independently responsible for this.
Legal basis. Art. 6(1)(b) GDPR – the transfer is necessary to fulfil the purchase contract. We do not need your consent for this, but you can avoid the transfer by choosing a payment method without a service provider.
12. Shipping your order
What happens. If we ship goods to you, we pass your name and delivery address on to the shipping provider – usually DHL Paket GmbH, Germany. If you have provided an e-mail address for parcel tracking, this is transmitted as well.
Legal basis. Art. 6(1)(b) GDPR – without this transfer, the goods you ordered cannot reach you.
13. Push notifications
What happens. You can opt in to push notifications in your browser, for example for appointment reminders. Technically, these run via Firebase Cloud Messaging, a service of Google Ireland Limited, Dublin, Ireland.
Only after your consent. The script required for this is only loaded if you have consented to the “Marketing” category and additionally confirm your browser's prompt. If you withdraw your consent, no script will be loaded any more.
What is transmitted. A technical device identifier to which the message is delivered – not your name.
Third country. A transfer to the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework.
Legal basis. Your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG, revocable at any time.
14. Managing your consent
Via “Cookie settings” in the footer you can view, change or fully withdraw your decision at any time. Essential cookies for login, cart and security cannot be deselected because the website does not work without them.
15. Your rights
You have the right at any time to access, rectification, erasure, restriction of processing, objection and data portability. To do so, please contact info@noraelhindi-artofbeauty.de or, as a registered customer, use our self-service functions under My account → Privacy: there you can immediately generate your complete data export (Art. 15 / 20 GDPR) as JSON or request the deletion of your account (Art. 17 GDPR).
16. Digital Services Act (DSA)
Information on the notification procedure for illegal content and on the complaint mechanism can be found in our DSA Statement.
17. Supervisory authority
You have the right to lodge a complaint with a supervisory authority, in particular at your place of residence or work.