Privacy policy

1. Who is responsible

The controller for the processing described here, within the meaning of the General Data Protection Regulation (GDPR), is:

2. Opening a page

This website runs on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, acting as our processor. The servers are located in the European Union.

To deliver a page, the web server has to process the data your browser sends with every request:

• your IP address
• the address of the page requested
• the date and time of the request
• the browser and operating system you are using
• the page you came from, if your browser sends one

This is technically unavoidable: without your IP address the answer cannot reach you. It is processed to deliver the site and to keep it secure and available, on the basis of our legitimate interest under Art. 6(1)(f) GDPR. We do not use it to build profiles and we do not combine it with any other data.

We keep no access log, so ordinary page views are not written down anywhere. What the server does record are technical error messages, for example when a connection breaks off or a certificate cannot be renewed, and those messages can contain the IP address involved. These logs are deleted after fourteen days at the latest.

3. Cookies and storage

When you first open this website, it stores nothing at all on your device. Nothing is written until you make a choice in the cookie banner.

Once you choose, we store a single cookie called "cc_cookie" on our own domain. It records nothing but your own decision: which categories you allowed and when. It contains no identifier that would let us recognise you elsewhere, it is not readable by any third party, and it is never sent to anyone else. It is set with SameSite=Lax and expires after 182 days, roughly six months, after which you will be asked again. Storing it is necessary to honour your choice, so no separate consent is required for the cookie itself.

Beyond that, this site writes nothing to local storage or session storage and does not attempt to recognise your device by any other means. There is exactly one optional category, "Functional: map", and it controls only the Google map described in section 6. If you choose "Necessary only", nothing further is stored and no request goes to Google.

You can change or withdraw your choice at any time through the "Cookie settings" link at the bottom of every page.

4. Usage statistics

We would like to know roughly how the site is used, for instance which sections people actually read. We do this without cookies and without tracking anyone across websites.

The statistics run on Matomo, an open source analytics application that we host ourselves on infrastructure operated by greyt. Your browser never talks to the analytics server. Instead, the page sends a small anonymous message to an address on this same domain, and our server passes it on. No third party receives a request from your browser.

What is passed on:

• the address and title of the page you are on
• the page you came from, if your browser sends one
• your browser and operating system, and your browser language
• your IP address, shortened before it is passed on: the last block of an IPv4 address is set to zero, an IPv6 address is truncated to its first three blocks
• which of these events occurred: opening a page, scrolling past a quarter, half, three quarters or the end of it, and clicking a phone number or a link leading off this site

No cookie is set, nothing is stored on your device, and no fingerprint of your browser is taken. Because the IP address is shortened before it reaches the analytics application, we cannot single you out from these records. The legal basis is our legitimate interest in understanding how our own website is used, Art. 6(1)(f) GDPR. Since nothing is stored on or read from your device, no consent is required under the ePrivacy rules.

5. Booking an appointment

Appointments are booked on Salonkee, not here. Every booking button opens salonkee.lu in a new tab. Nothing is embedded, and we transmit no data to Salonkee when you open this page. As soon as you follow the link you are on their website, and their terms apply: Salonkee privacy policy.

6. The map, only after you allow it

The "Visit us" section can show a Google map. It is not loaded when the page opens. Instead you see our address, a note explaining what loading it means, and a button that opens the cookie settings. Until you allow the "Functional: map" category, not a single request goes to Google.

Once you allow it, the map is embedded from Google. Google Ireland Limited then receives your IP address and can set cookies in your browser, and your data may be transferred to servers of Google LLC in the United States, a country whose level of data protection is not considered equivalent to that of the EU. Your consent under Art. 6(1)(a) GDPR is also your consent to that transfer under Art. 49(1)(a) GDPR.

You can withdraw that consent at any time through the "Cookie settings" link at the bottom of every page. Switch "Functional: map" off and the map is removed again, and no further data is sent to Google. Withdrawing does not affect what was already transmitted while the map was loaded.

7. Fonts and media

The two typefaces used here, Manrope and Outfit, are published through Google Fonts, but they are not loaded from Google. They are downloaded once when the site is built and are then delivered from our own server. Opening this page therefore creates no connection to Google.

The same applies to every image and to the silent background video in the header: all of it is delivered from this domain. There is no video platform involved, and no external player.

8. Your rights

Under the GDPR you have the right to obtain information about the personal data we process about you (Art. 15), to have inaccurate data corrected (Art. 16), to have data erased (Art. 17), to have processing restricted (Art. 18), to receive your data in a portable format (Art. 20), and to object to processing based on our legitimate interest (Art. 21). Where processing rests on your consent, you may withdraw it at any time with effect for the future.

One honest limitation: the records described in section 4 do not allow us to identify you, and we do not collect additional data in order to be able to. If you wish to exercise a right in relation to those records, please provide information that lets us locate them, as set out in Art. 11(2) GDPR.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is the Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg, phone +352 26 10 60 1.

9. Changes to this policy

If we change how this website works, we will update this page. The date at the top always shows the current version.