The German version of this notice is the binding one.
Controller
Glow Garden by Vu Nails Lounge
Owner: Thi Hong Phuong Hong Vu
Klosterstraße 47, 40211 Düsseldorf, Germany
Phone: +49 (0)211 97710701
E-mail: hallo@glowgardenduesseldorf.de
What data we process and why
When you book an appointment online, we process the details we need for it:
- first and last name, e-mail address and phone number
- the services booked, answers to additional questions, the person from our team you asked for, date and price
- your message to us and the names of companions for group bookings
- earlier appointments, cancellations and no-shows (customer file)
The legal basis is the performance of the contract or of pre-contractual measures (Art. 6(1)(b) GDPR). Without these details we cannot give you an appointment.
If you voluntarily mention health information in your message, such as allergies, we process it only to treat you safely and only with your consent (Art. 9(2)(a) GDPR).
Confirmations and reminders
We send confirmations, changes, cancellations and reminders by e-mail (Art. 6(1)(b) GDPR). The e-mails are sent by a service provider on our behalf.
You only receive reminders and personal messages via WhatsApp if you agreed to this when booking (Art. 6(1)(a) GDPR). For this we transfer your phone number, your first name, the appointment details and the content of our messages to WhatsApp Ireland Limited or Meta Platforms Ireland Limited, Ireland; your replies also reach us via WhatsApp. A transfer to the USA cannot be ruled out; Meta is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time with effect for the future.
Messages between you and us
When we write to you personally, for example with a question about your appointment, we do so by e-mail or – if you agreed – via WhatsApp. If you reply or write to us yourself by e-mail or WhatsApp, we store your message together with ours in your customer file so our team can deal with your request (Art. 6(1)(b) and (f) GDPR). Of the e-mails to our mailbox we only take over replies to e-mails we sent you. So that it remains clear what we sent you, we keep a copy of every message to you (confirmations, reminders, personal messages) (Art. 6(1)(f) GDPR). Copies and messages are deleted after two years, messages from phone numbers that are not in the file after six months – and all of them as soon as your customer file is deleted.
Inspiration photos
If you upload photos of your desired design when booking, we store them resized and without metadata (such as the location) solely to prepare your appointment. Only the studio can see them; they are deleted no later than twelve months after the upload, and immediately for bookings that are not completed (Art. 6(1)(b) GDPR).
Reminder of your next appointment
A few weeks after services such as shellac or gel we remind you of your next appointment by e-mail, with your last selection for quick rebooking. This is based on our legitimate interest in maintaining the customer relationship (Art. 6(1)(f) GDPR, § 7(3) UWG). You can object at any time: via the link in every reminder or in your customer account.
Customer account
You sign in to your customer account without a password, using a link we send to your e-mail address. There you see your appointments, can download your data and delete your account.
Waiting list
If you join the waiting list, we store your preferred time and let you know as soon as a suitable appointment becomes free (Art. 6(1)(b) GDPR). You can leave the list at any time via the link in our messages.
Payments via PayPal
If you pay online, for example for a voucher or a deposit, the payment is handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. We transfer the amount, the order or booking number and the return address; PayPal does not pass your payment details on to us. PayPal's privacy policy also applies. The legal basis is Art. 6(1)(b) GDPR.
Hosting and security
The booking pages run on the server of a hosting provider in the European Union that operates it on our behalf (Art. 28 GDPR). They are delivered via Cloudflare, Inc. (USA), which protects them against attacks and serves them quickly; Cloudflare is certified under the EU-US Data Privacy Framework. Technically necessary data such as IP address, time and page requested are processed (Art. 6(1)(f) GDPR, our legitimate interest in secure operation). The server logs are deleted automatically after 14 days.
Cookies and local storage
We only set technically necessary cookies, for example for your reservation while booking and for signing in to your customer account. Your browser keeps your booking progress only for the session. We do not use tracking or advertising cookies.
Storage period
We delete or anonymise your customer file automatically if you have had no appointment for 36 months. Records of services and payments are kept as long as commercial and tax law requires. Consents and their withdrawal are documented as long as we have to be able to prove them.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. You can withdraw consent at any time. Please write to us at the address above.
You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.