What personal data we process in connection with this website and your appointment, why we do it — and what rights you have.
1. Introduction and scope
Handling your personal data carefully matters to us. This privacy policy explains what personal data we process in connection with this website and with the making and carrying out of appointments in our studio, for what purpose and on what basis, to whom we may pass data on, and what rights you have.
This policy applies to the website through which you are reading this document, including all its sub-pages in German and English. It does not apply to third-party websites we merely link to — namely the Treatwell booking portal, Instagram, WhatsApp and Google Maps. The moment you follow such a link, only that provider's own privacy policy applies.
Swiss data protection law governs, in particular the revised Federal Act on Data Protection (revFADP) and the Data Protection Ordinance. Where the European General Data Protection Regulation (GDPR) applies to a particular processing activity — because you are visiting us from the EEA, for instance — we follow its requirements as well.
We have deliberately written this policy to describe what this website actually does. The technical statements in sections 5 and 6 are based on an inspection of the code we ship, not on generic boilerplate.
2. Controller
The controller responsible for the processing of personal data within the meaning of the revFADP is:
For anything concerning data protection — requests for information, corrections, deletion, objections, or questions about this policy — the simplest route is an email to the address above. We handle such requests free of charge as a matter of principle and normally reply within 30 days.
As a small business we are not required to appoint a data protection adviser. Your requests are dealt with directly by the studio's management.
3. Principles we apply
We process personal data according to the principles set out in the revFADP. In plain language, that means:
We do not sell personal data, we do not pass it to third parties for advertising purposes, and we do not build personality profiles.
Lawfulness and good faith
We obtain and process data only by lawful means and without hidden intentions. You should be able to understand at any time what happens to the information you give us.
Proportionality
We process only as much data as the purpose genuinely requires. Where a task can be done without personal data, we do without it — which is why this website has neither a contact form nor any audience measurement.
Purpose limitation
Data you send us for an appointment enquiry is used for that appointment and the care around it — not for unsolicited marketing, and not for purposes you could not have foreseen.
Transparency
The collection of personal data and the purpose of processing are apparent to you. That is precisely what this document is for.
Accuracy
We make an effort to keep your data current and correct. Tell us about a change and we will correct it promptly.
Data security
We protect your data with appropriate technical and organisational measures (see section 9).
4. What data we process
Below we describe the three situations in which personal data arises at all in connection with this website and our studio.
a) Server log files
This is a static website. Every page is generated in advance and delivered unchanged when requested. There is no database in which visitor data would be stored, and the pages make no background requests to third-party servers.
As with any internet service, however, technical connection data — server log files — arises at the hosting provider's level. This may include the IP address of the requesting device, the date and time of access, the page or file requested, the HTTP status code, the volume of data transferred, the previously visited page (referrer), and details of browser type, browser version and operating system.
This data arises as a technical necessity; without it a website cannot be delivered at all. It is used solely to keep the service running, to detect faults and to fend off attacks such as attempts at overload. It is not analysed for marketing purposes, not combined with other sources and not linked to any identified person — nor could we do so without additional information.
Retention: log files are automatically deleted or truncated according to our hosting provider's practice, typically within a few days to a few weeks. We keep no copies of our own.
b) Contact by email, telephone or WhatsApp
This website has no contact form. There is no input field anywhere on it through which you could submit personal data to us. Simply visiting the site gives us nothing about you beyond the server log files described above.
You can reach us through the channels listed on the "Info & Contact" page: by email, by telephone or via WhatsApp. These are ordinary links. Clicking one opens your own email program, your phone app or WhatsApp; at that moment the message travels through the service you chose, not through our website.
If you contact us this way, we process whatever you choose to tell us. Typically that is your name, your email address or telephone number and the content of your message — often together with inspiration photos, preferred appointment times or a note about the current state of your nails. We use this information solely to answer your enquiry and to prepare and carry out any appointment.
If you tell us anything health-related — an allergy, a nail condition or a skin irritation, for example — that constitutes sensitive personal data within the meaning of Art. 5 lit. c revFADP. We process such information only where you volunteer it, only for the purpose of treating you safely, and we do not pass it on to third parties.
Retention: as long as needed to deal with your enquiry. Correspondence about completed appointments is kept for as long as it remains useful for your ongoing care and legally permissible. Documents of accounting relevance are subject to the statutory ten-year retention period under Art. 958f of the Swiss Code of Obligations. Beyond that, you may ask us at any time to delete your correspondence.
c) Booking through Treatwell
Appointments are made through the Treatwell booking portal. The "Book on Treatwell" buttons on this website are plain links that take you to Treatwell's own site. No booking widget, iframe or script from Treatwell is embedded in this website. Before you click, no data whatsoever is transmitted to Treatwell — not even your IP address.
Once you book on Treatwell, Treatwell's terms and privacy policy apply. Treatwell is the controller for the processing that happens there; we have no influence over how it is arranged. Please note that the booking platform's payment and cancellation terms may also apply.
Treatwell then passes us the booking data we need in order to carry out the appointment: usually your name, your contact details, the service booked and the date and time, together with any notes you added to the booking. We process this data under our own responsibility for scheduling, for providing the service and for invoicing.
Booking through Treatwell is voluntary. You are equally welcome to arrange an appointment by telephone, email or WhatsApp; in that case no data is transmitted to Treatwell at all.
Cookies are small text files that a website can place on your device and read again on a later visit. They are used, for example, to remember a language setting, to keep a shopping basket or a login alive, or to measure how visitors behave. The browser's local storage (localStorage and sessionStorage), the browser database IndexedDB and so-called service workers perform comparable tasks.
This website sets no cookies. It creates no entries in localStorage or sessionStorage, uses no IndexedDB and registers no service worker. Nothing remains on your device after your visit except the ordinary browser cache, which your browser manages by itself.
For that reason you will find neither a cookie banner nor a consent manager on this website: both would be pointless. We inspected the code we ship and the pages' behaviour in the browser; the result is recorded below.
Audit of storage mechanisms on this website
Mechanism
Purpose
Type
Duration
Set by
HTTP cookies
none set
—
—
—
localStorage
no entries
—
—
—
sessionStorage
no entries
—
—
—
IndexedDB
not used
—
—
—
Service worker
not registered
—
—
—
Browser cache
caching of fonts and images
strictly necessary
determined by your browser
your browser
"Strictly necessary" would describe cookies without which a website cannot function as intended — for load balancing, session management, remembering a language choice or repelling automated attacks. This website does not set those either; the language choice is expressed in the page address instead (/de/ or /en/). Should our hosting provider exceptionally set a strictly necessary cookie to protect against attacks, this happens at infrastructure level, serves security alone, and is neither read nor analysed by us.
The legal position in Switzerland: under Swiss law — Art. 45c lit. b of the Telecommunications Act read together with the revFADP — no prior consent is required in order to set cookies. What is required is that users be informed about the processing and its purpose, and that they be able to refuse it (opt-out). This section discharges that duty to inform. Visitors from the EEA are additionally covered by the stricter consent regime there — which, in the absence of any cookies, likewise has nothing to apply to here.
Independently of all this, you can restrict or entirely prevent cookies in your browser at any time, and delete cookies already stored:
Google Chrome
Settings → Privacy and security → Third-party cookies, or Delete browsing data.
Mozilla Firefox
Settings → Privacy & Security → Cookies and Site Data.
Apple Safari
Settings → Privacy → Manage Website Data; on iOS under Settings → Safari.
Microsoft Edge
Settings → Cookies and site permissions → Manage and delete cookies and site data.
Blocking all cookies may impair your use of other websites. It has no effect on the usability of this one.
Audience measurement: we use no analytics or statistics tool — neither a cookie-based one nor a cookieless one. There is no counting of page views, no analysis of referral sources, no cross-site tracking, no building of usage or personality profiles and no personalised advertising. We hold no insight into the use of this website beyond the technical server log files kept by our hosting provider.
6. Third parties and embedded content
This website embeds no third-party content. No external fonts, no map services, no videos, no social media widgets, no booking widgets and no analytics scripts are loaded. Every resource — fonts, images, stylesheets and code — is delivered from our own server. Merely opening a page therefore creates no connection to any third party.
Connections to the services listed below arise only when you actively click the relevant link — with the exception of our hosting provider, which by its nature delivers the website itself.
Hosting — Cloudflare Pages
This website runs on Cloudflare Pages, a service of Cloudflare, Inc., based in San Francisco, United States. Cloudflare operates a worldwide network of data centres; pages are served from whichever location is closest to you. For visitors from Switzerland, delivery normally happens from a location in Switzerland or elsewhere in Europe. There is no contractual restriction to Swiss-only server locations.
In delivering the site, Cloudflare processes the technical connection data described in section 4 a) — your IP address in particular — as our processor. Cloudflare also applies measures to detect and repel attacks, which serve to keep this website reachable.
No analytics tool is in use. Neither Google Analytics nor a cookieless service such as Plausible, Matomo, Fathom or Umami is integrated. This statement is based on an inspection of the code we ship: opening a page of this website sends not a single request to any external server.
Treatwell — linked only
Treatwell is a European booking platform for beauty and wellness services; the Swiss platform is operated by Treatwell DACH GmbH. We are listed there and handle online appointment bookings through it.
On our website Treatwell is linked and nothing more — no widget and no script is embedded. Only when you click the link does Treatwell receive your IP address and the usual connection data; what further data arises there is governed by Treatwell's own privacy policy. In return we receive the booking data described in section 4 c).
We offer contact via WhatsApp, a service of WhatsApp Ireland Limited, part of the Meta group. The link on our website opens WhatsApp with a prepared greeting; you send the message yourself after reviewing it.
If you message us on WhatsApp, Meta learns that communication is taking place between your number and ours, and processes the associated connection and usage data. Message content is end-to-end encrypted. We have no influence over Meta's processing.
If you would rather avoid this, please use email or the telephone — both are equally good and reach the same person.
We link to our Instagram profile in several places. These are ordinary links: no Instagram feed, no embedding script and no "like" button is integrated into this website. As long as you do not click the link, Instagram learns nothing about your visit here.
If you do click it, you arrive on the Instagram platform, operated by Meta Platforms Ireland Limited. From that point on their privacy terms apply. If you are logged in there, Meta can associate the visit with your account.
No Google Maps map is embedded on this website. We merely provide a button linking to our location on Google Maps.
That distinction matters in data protection terms. If a map were embedded, a connection to Google's servers would be established the moment the page loaded — without any action on your part and whether or not you even looked at the map — transmitting your IP address among other things. Because we only link, this happens only once you click and open Google Maps in a new window.
From that point on the privacy terms of Google Ireland Limited, respectively Google LLC, apply. If you would rather find us without involving Google: our full address and directions by tram and by car are given on the "Info & Contact" page and in the footer of every page.
The fonts used on this website (Outfit and Monsieur La Doulaise) are delivered from our own server. There is no connection to Google Fonts, to fonts.googleapis.com, to fonts.gstatic.com or to any other font service. Loading a page therefore transmits your IP address to no font provider.
7. Disclosure abroad
Your data is processed in principle in Switzerland and the European Economic Area. Disclosure abroad may arise in the following situations:
From a Swiss perspective the United States does not offer generally adequate data protection within the meaning of Art. 16 revFADP. Disclosures there are therefore based on recognised safeguards — in particular the standard contractual clauses recognised by the FDPIC and, where the provider concerned is certified, the Swiss-U.S. Data Privacy Framework.
We do not ourselves actively transfer client data abroad. The disclosures listed arise from operating the website, or from communication channels you choose voluntarily.
Cloudflare, Inc. — United States
Technical connection data in the course of delivering this website. Delivery to Swiss visitors normally happens from European locations; the company is nonetheless established in the United States and can access its systems from there.
Treatwell DACH GmbH — Germany, further locations in Europe
Booking data, if you book through the platform. The Swiss platform is operated by Treatwell DACH GmbH; details and any further recipients are set out in Treatwell's own privacy policy.
Meta (WhatsApp, Instagram) — Ireland and United States
Communication and usage data, if you message us on WhatsApp or follow our Instagram link.
Google — Ireland and United States
Connection data, if you click the link to Google Maps.
8. Retention periods
We keep personal data only for as long as the purpose requires or the law demands. Specifically:
Server log files
Automatically deleted or truncated by the hosting provider, typically within a few days to a few weeks.
Correspondence (email, WhatsApp, telephone notes)
For as long as needed to deal with your enquiry and look after you afterwards. We delete it sooner at your request.
Appointment and treatment records
For the duration of the client relationship, so that we can build on earlier treatments at a follow-up appointment.
Accounting records
Ten years, under the statutory retention duty in Art. 958f of the Swiss Code of Obligations.
Images showing identifiable people
Until consent is withdrawn; the image is then removed.
9. Data security
We take appropriate technical and organisational measures to protect your data against unauthorised access, loss and misuse.
This website is delivered exclusively over an encrypted connection. Transmission uses HTTPS with TLS encryption, indicated by the padlock symbol in your browser's address bar. Content is therefore protected against interception in transit.
Access to correspondence and to appointment and treatment records is limited to those people in the studio who need it for their work. Devices and accounts are password protected. Treatment records are kept where clients in the studio cannot read them.
Please note that transmitting data over the internet — in particular by unencrypted email — can have security weaknesses. Complete protection against third-party access is not possible. Please do not send us sensitive information by unencrypted email; for anything confidential, speak to us in person or by telephone.
10. Your rights
The revFADP gives you, as the person concerned, a number of rights. You may exercise them at any time and, as a rule, free of charge:
How to exercise these rights: send us an email at the address given in section 2, or speak to us in the studio. So that we do not hand your data to an unauthorised person, we have to verify your identity and may therefore ask you for further details. We normally answer within 30 days. If exceptionally we cannot, we will tell you and explain why.
You may also turn to the supervisory authority: the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. We would ask you to come to us first — most matters are settled easily and directly.
Access (Art. 25 revFADP)
You may ask us whether we process personal data about you and, if so, what. The information covers among other things the purpose of processing, the retention period, the origin of the data and any recipients.
Rectification (Art. 32 revFADP)
If the data we hold about you is inaccurate or incomplete, you may ask us to correct it. We do so without delay once we have checked.
Erasure and destruction
You may ask us to delete your data, insofar as no statutory retention duty stands in the way — in particular the ten-year period for accounting records.
Objection
You may object to a processing activity. If you object, for instance, to being contacted through a particular channel or to the publication of a photograph, we stop immediately.
Data portability (Art. 28 revFADP)
You may ask us to hand over the data you have given us in a common electronic format, or to transfer it directly to another body, insofar as this is possible with proportionate effort.
Withdrawal of consent
Where processing rests on your consent — the publication of a photograph, for example — you may withdraw it at any time with effect for the future, without any disadvantage to you.
11. Minors
Our services are aimed at adults. We do not knowingly collect personal data from children under 16 without the consent of a parent or guardian.
Young people are of course welcome in our studio. For booking and treating a minor we require the consent of the person with parental authority. Should we discover that we have received a child's data without the necessary consent, we delete it.
12. Changes to this policy
We may adapt this privacy policy if our website, our procedures or the legal requirements change. The version published on this page is the one that applies.
Material changes would concern sections 5 and 6 above all: should this website ever use an analytics tool, a contact form, a booking widget or an embedded map, we will update this policy accordingly before that goes live.
We recommend consulting this policy from time to time. The date of the current version is given at the end of this page.