Privacy Policy

Last updated: October 2026

1. Controller

Ursula Tina Kent
Tinfaey Waxing Studio
c/o DMS + Ink
Mommsenstraße 35
10629 Berlin
Email: kontakt@tinfaey.de

A data protection officer is not required by law and has not been appointed.

2. Collection and processing of personal data

We store all appointment, customer and invoice data on our own server in Germany. If you book online, you do so via Treatwell; Treatwell then also receives your booking data as an independent provider. Appointments you book directly with us (phone, WhatsApp, in the studio) are stored only by us.

Appointment booking

Online bookings are processed via Treatwell's booking system, which is embedded on our website. When you book online, the following data is collected directly by Treatwell:

  • Name, email address, phone number
  • Requested services, date and time
  • Payment method (on-site payment)

Treatwell processes this data as an independent provider to handle the online booking. More information can be found in Treatwell's privacy policy at treatwell.de/info/datenschutzerklaerung. Treatwell informs us about every online booking by e-mail. From it we take your name, e-mail address, phone number, booked service, appointment, price and order number into our appointment calendar and our internal booking system in order to carry out and invoice the appointment. We reconcile rescheduled and cancelled appointments with our Treatwell account. For direct bookings by phone, WhatsApp or in the studio, we record your name, phone number, your e-mail address if you wish, and appointment and service details internally. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

Email communication

We send the following transactional emails:

  • Booking confirmation (direct booking): for bookings made by phone, WhatsApp or in person, we send an appointment confirmation containing details and a cancellation link. Online bookings via Treatwell are confirmed directly by Treatwell.
  • Cancellation confirmation (direct booking): if a directly booked appointment is cancelled, you will receive a confirmation. Online bookings are cancelled via Treatwell.
  • Invoice: if you request an invoice after your appointment, it will be sent as a PDF attachment by email.
  • Voucher: if you purchase a voucher and request delivery by email, the voucher code will be sent to you by email.
  • Response to contact enquiries: if you use the contact form, we will reply to your enquiry by email.

The legal basis for booking- and contract-related emails is Art. 6(1)(b) GDPR (performance of a contract). For replies to contact enquiries, Art. 6(1)(f) GDPR applies (legitimate interest in handling enquiries). Emails are not used for marketing purposes.

Contact form

When you use the contact form, we collect your name, e-mail address and the content of your message in order to reply to you. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in handling enquiries). The enquiry is deleted automatically after 30 days.

Server log files

When you visit our website, technical data is automatically stored in server log files: shortened IP address (the last part is removed), page requested, date and time, browser and device information and the previously visited page (referrer). This data cannot be attributed to a specific person and is used solely to ensure the operation and security of the website. The log files are overwritten continuously once they reach a fixed size, usually after a few days. The legal basis is Art. 6(1)(f) GDPR.

3. Retention periods

Booking data is generally stored for 3 years after the appointment. Invoices and tax-relevant documents are subject to the statutory retention obligation under Section 147(1) of the German Fiscal Code (AO) and are kept for 10 years. We keep a log of e-mails we send (recipient, subject, time) as proof of dispatch; it is deleted after 3 years, a short preview of the content already after 90 days (for voucher e-mails, the code and value are kept so the voucher remains traceable). Contact enquiries are deleted after 30 days, the data of our own visitor statistics after 26 months.

4. Disclosure to third parties

Your data is not sold or shared for marketing purposes. The following third-party services are in use:

  • Hosting: The website, booking system and database run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany. Hetzner processes the data solely on our behalf and according to our instructions (data processing under Art. 28 GDPR). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation).
  • Treatwell (online booking): Online bookings are processed via the booking system of Treatwell Limited (c/o WeWork, 8 Devonshire Square, London, EC2M 4PL, UK). Treatwell processes the booking data as an independent controller in accordance with its own privacy policy. No data processing agreement exists, as Treatwell processes the data on its own responsibility. The “Book an appointment” page embeds Treatwell’s booking system directly. As soon as you open this page, your browser connects to Treatwell. Technical data such as your IP address, browser information and the page visited are transmitted to Treatwell, and Treatwell may set its own cookies. Treatwell is based in the United Kingdom, for which an adequacy decision of the EU Commission exists. The legal basis for the embedding is Art. 6(1)(f) GDPR (legitimate interest in simple online booking). If you do not want this, you can also book your appointment by phone, via WhatsApp or in the studio. Datenschutzerklärung Treatwell
  • Google Calendar: Appointment data (date, time, service, name, and for online bookings also e-mail address, phone number and order number) is entered into an internal Google Calendar to organise scheduling. Treatwell's booking e-mails go to a Google mailbox and are read automatically there. Operator: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Art. 6(1)(b) and (f) GDPR. Google Privacy Policy
  • Google Analytics 4: We use Google Analytics to analyse usage behaviour (see section 5). Operator: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
  • Email delivery: Transactional emails are sent via our own domain through Strato. Operator: Strato AG, Otto-Ostrowski-Strasse 7, 10249 Berlin. Name and email address are transmitted in this process. Strato Privacy Policy

5. Cookies and tracking

Technically necessary cookies

This website uses technically necessary cookies to provide basic functionality. This includes a cookie that stores your decision regarding the cookie banner. These cookies are required for the website to operate and are set without separate consent. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a technically functioning service).

Our own visitor statistics without cookies

On our own server we count how often our pages are visited, roughly how long they stay open, from what kind of device and roughly where visits come from (e.g. “Google” or “Instagram”). We do not use cookies for this, store nothing on your device and share nothing with others. We do not store your IP address; we only use it briefly to count several page views on the same day as one visit. The figures are deleted after 26 months. The legal basis is Art. 6(1)(f) GDPR.

Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only used when you have given your consent via the cookie banner.

Google Analytics collects anonymised data on page views and user interactions (e.g. whether the booking area was accessed). No personal data such as name or email address is transmitted to Google. Data is processed on EU servers. Google Signals is disabled.

Note on international data transfers: Google Ireland Limited is a subsidiary of Google LLC (USA). It cannot be ruled out that Google LLC has technical access to processed data. The transfer to the USA is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (DPF, Art. 45 GDPR). Google LLC is DPF-certified.

Google Analytics sets cookies (including _ga) with a lifetime of up to 2 years to distinguish users and evaluate sessions.

The legal basis is Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future:

Further information is available at support.google.com/analytics.

6. Your rights

You have the right at any time to:

  • Access to the data stored about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data, unless statutory retention obligations apply (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability of data you have provided (Art. 20 GDPR)
  • Objection to processing based on legitimate interests (Art. 21 GDPR)
  • Withdrawal of a given consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, please contact: kontakt@tinfaey.de

You may withdraw consent you have given at any time without giving reasons, with effect for the future. This does not affect the lawfulness of processing carried out prior to withdrawal.

You also have the right to lodge a complaint with the competent supervisory authority:
Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstr. 219, 10969 Berlin
www.datenschutz-berlin.de

The use of contact data published in the legal notice for the purpose of sending unsolicited advertising and information material is hereby expressly prohibited. We expressly reserve the right to take legal action in the event of unsolicited advertising being sent.

7. Security

Data transmitted between your browser and our website is encrypted via HTTPS (TLS). We protect stored data through technical and organisational measures against unauthorised access, loss or misuse.

Please note that transmission by email is not fully secure and may contain security vulnerabilities. We therefore recommend a different means of communication for particularly confidential messages.

8. Changes to this privacy policy

We reserve the right to update this privacy policy as necessary to reflect changes in the legal situation or website functionality. The current version is always available on this page.