Privacy policy

This privacy policy informs you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), about the nature, scope and purpose of processing personal data in connection with the wellness massage services offered by Valentyna Kyselova and, where applicable, visits to a website or social media profiles.

1. Controller

The controller responsible for processing data within the meaning of the GDPR is:
Valentyna Kyselova
Contact details and address: legal notice

No company data protection officer has been appointed because the statutory requirements under Section 38 of the German Federal Data Protection Act (BDSG) are not currently met. Please direct enquiries to the contact address above.

2. Principles of data processing

Personal data is processed only within the legally permitted framework and in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality under Article 5 GDPR.

3. Contact and appointment booking

When you make contact by phone, email, messenger services or an online booking function, the information you provide (for example, name, phone number, email address, requested appointment and address for mobile appointments) is processed to handle the enquiry and organise the appointment. The legal basis is Article 6(1)(b) GDPR (pre-contractual measures or performance of a contract).

4. Payment data

Payment data is processed in connection with payment for your booking. Card payments are handled by the payment service provider SumUp, to which the necessary data is transmitted. SumUp processes this data as an independent controller under its own privacy provisions. The legal basis for the transfer is Article 6(1)(b) GDPR.

5. Collection of health-related data

Before a massage, clients may be asked about their health, solely to the extent necessary to identify possible contraindications and provide the service safely.

This may include information about pregnancy, acute inflammation, recent operations, injuries, skin conditions, cardiovascular conditions and other contraindications to massage.

Clients provide this information voluntarily. The data is used exclusively to assess whether the treatment can be carried out, is stored securely on paper or digitally, and is not shared with third parties without a legal basis.

The legal basis for processing these special categories of personal data (health data) is the data subject’s explicit consent under Article 9(2)(a) GDPR, obtained before the first treatment. Consent may be withdrawn informally at any time with effect for the future, for example by email using the contact details in the legal notice. Following withdrawal, further treatment may no longer be possible if contraindications cannot otherwise be assessed.

6. Photographs and images

If photographs are to be taken in an individual case, for example to document progress or for reference or advertising purposes, including before-and-after photographs, this is done only with the client’s prior, separate consent under Article 6(1)(a) GDPR. Use for advertising purposes, for example on social media, requires express, separate consent. Consent may be withdrawn at any time with effect for the future. On request, previously published material will be removed where technically possible and reasonable.

7. Website, cookies and server log files (where a website is operated)

When a website is accessed, the hosting provider automatically records technical information, such as the IP address, date and time of access, page requested and browser used, in server log files. This processing is based on Article 6(1)(f) GDPR (a legitimate interest in operating a secure, functional website), and the information is generally deleted automatically after a short period.

If cookies or comparable technologies that are not strictly technically necessary are used, for example for statistics or marketing, this occurs only after prior consent under Section 25 TTDSG in conjunction with Article 6(1)(a) GDPR through an appropriate consent tool.

8. Contact form and email contact

When you contact the provider by email or through any contact form, the information you provide is stored to process the enquiry and any follow-up questions. The legal basis is Article 6(1)(b) or (f) GDPR.

9. Social media profiles

Where profiles are maintained on third-party platforms, such as Instagram, the respective platform operator’s privacy notices and terms of use also apply. Data communicated through messages on such platforms is processed for appointment organisation to the same extent described in Section 3.

10. Recipients and sharing of data

Personal data is shared with third parties only where necessary to perform the contract, for example with SumUp, where a legal obligation exists, for example towards tax authorities, or where you have expressly consented. Data is not shared with third parties for advertising purposes.

11. Transfers to third countries

As a general rule, data is not transferred to countries outside the EU/EEA (third countries). If a service provider based or operating servers outside the EU/EEA is used in an individual case, this occurs only where an adequate level of data protection is ensured, for example through the European Commission’s standard contractual clauses.

12. Retention periods

Personal data is stored only for as long as necessary for the processing purposes or as required by statutory retention periods:

• Invoices and accounting records: up to 10 years (Section 147 AO, Section 257 HGB).
• Contact and appointment data where no contract is concluded: up to 12 months if there is no further contact.
• Health-related information: deleted once no longer required to assess treatment, and at the latest after applicable statutory retention periods expire or consent is withdrawn.
• Photographs and images subject to separate consent: until consent is withdrawn.

13. Data security

Appropriate technical and organisational measures are taken to protect personal data against accidental or intentional manipulation, loss, destruction and unauthorised access. Security measures are continually improved in line with technological developments.

14. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Article 22 GDPR.

15. Rights of data subjects

Subject to the applicable statutory requirements, data subjects have the following rights:

• Access to personal data being processed (Article 15 GDPR).
• Rectification of inaccurate data (Article 16 GDPR).
• Erasure (“right to be forgotten”, Article 17 GDPR).
• Restriction of processing (Article 18 GDPR).
• Data portability (Article 20 GDPR).
• Objection to processing based on legitimate interests (Article 21 GDPR).
• Withdrawal of consent with effect for the future (Article 7(3) GDPR).
• Lodging a complaint with a data protection supervisory authority (Article 77 GDPR), in particular the Hessian Commissioner for Data Protection and Freedom of Information where competent.

To exercise these rights, an informal message using the contact details in the legal notice is sufficient.

16. Changes to this privacy policy

This privacy policy is updated as necessary to reflect changes in legal requirements or in the services offered. The most recently published version applies.