Privacy Policy

Kosmetik Oase
Owner: Viktor Brull
Martin-Luther-Str. 21, 15370 Fredersdorf-Vogelsdorf
Phone: 0176 24 28 11 96
Email: Kosmetikoaseberlin@web.de

No data protection officer has been appointed; given the size of our business there is no obligation to do so under § 38 BDSG.

This website runs on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (product “Hetzner Cloud”). The provider processes data solely on our behalf under a data processing agreement pursuant to Art. 28 GDPR; the servers are located in a data centre in Germany, so no transfer to a third country takes place. When you access the site, the technically necessary connection data is processed: IP address, date and time, page requested, amount of data transferred, referrer, browser type and operating system. Without this data the page cannot be delivered to your browser. The purpose is secure, stable operation and defence against attacks; the legal basis is Art. 6(1)(f) GDPR. We keep no permanent access logs containing IP addresses. Technical logs arising in the event of a fault are retained only for as long as needed to resolve it and are deleted afterwards.

This website sets no cookies for analytics, advertising or tracking. The following are technically necessary: a cookie storing your language choice (NEXT_LOCALE) and two entries in your browser’s local storage — your decision in the privacy banner and the note that you dismissed an information banner. This storage is strictly necessary to provide the service you requested and therefore exempt from consent under § 25(2) no. 2 TDDDG; the related processing is based on Art. 6(1)(f) GDPR. For all non-essential content — currently only the map — we obtain your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. Your consent is voluntary and can be withdrawn at any time with effect for the future via the “Cookie settings” link in the footer. The lawfulness of processing carried out before withdrawal remains unaffected.

Cookie settings

If you call, write or contact us via WhatsApp, we process your details (name, phone number or email address, content of your enquiry) solely to handle your request. The legal basis is Art. 6(1)(b) GDPR for appointment enquiries, otherwise Art. 6(1)(f) GDPR. Clicking the WhatsApp button forwards you to WhatsApp; the controller for processing there is WhatsApp Ireland Ltd., Merrion Road, Dublin 4, Ireland. This may involve transfers to Meta Platforms Inc. in the USA, safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework. If you prefer to avoid this, please contact us by phone. We delete enquiries once they are settled and no statutory retention obligations apply.

For online bookings we link to the Treatwell portal (Treatwell Deutschland GmbH). This is a plain link — no data is transmitted to Treatwell when you open our page. Only when you click the link do you leave our website; from that point Treatwell’s privacy policy applies.

For consistent display we use the Cormorant Garamond and Inter typefaces. They are hosted locally on our server and embedded at build time. No connection to Google servers is established when you open the page and no data is transmitted to Google.

For directions we embed Google Maps, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded after your explicit consent. Only then is a connection to Google established, your IP address and device data transmitted and cookies set. A transfer to Google LLC in the USA cannot be excluded; Google LLC is certified under the EU-US Data Privacy Framework, so an adequacy decision of the EU Commission applies. The legal basis is Art. 6(1)(a) GDPR; you may withdraw your consent at any time with effect for the future. Without consent you can reach the route via the external link, without the map being loaded on our site. More information: https://policies.google.com/privacy

We display reviews on the home page. Where these are sourced from Google, they are fetched exclusively server-side and cached — your browser never connects to Google when the page loads and none of your data is transmitted to Google. Displayed are the name the reviewer published themselves, the star rating and the review text. The legal basis is Art. 6(1)(f) GDPR (presenting our business).

We link to our profiles on Instagram (Meta Platforms Ireland Ltd.) and TikTok (TikTok Technology Ltd.). These are plain links, not embedded content or social plugins — no data is transmitted to these providers when you open our website. Only on clicking do you leave our site, from which point the respective provider’s privacy terms apply.

Only the hosting provider named above acts as a processor with access to data and — where you have consented or contacted them yourself — the external providers named. Transfers to third countries occur solely in the cases described above and are safeguarded by adequacy decisions or EU standard contractual clauses. No automated decision-making, including profiling, takes place.

We process personal data only as long as necessary for the purposes stated and delete it afterwards, unless commercial or tax retention periods (usually 6 to 10 years) apply.

Providing your data is neither legally nor contractually required. Without your contact details, however, we cannot answer an enquiry or arrange an appointment.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Consent granted can be withdrawn at any time with effect for the future (Art. 7(3) GDPR). An informal message to the contact details above is sufficient to exercise these rights.

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation, to such processing. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, phone +49 33203 356-0, Poststelle@LDA.Brandenburg.de.

We update this privacy policy whenever our services or the legal situation change. The version published here applies. Last updated: August 2026.