Privacy policy

Data controller and contact

Sirin Firdevs Celik, Sirin Cosmetics e.U., Ada-Christen-Gasse 2a EG01, 1100 Vienna, Hanssonzentrum. Privacy enquiries: sc@sirincosmetics.at.

Contact and appointment enquiries

If you contact us by email, phone or WhatsApp, we process the contact details you provide and the contents of your enquiry to respond and arrange appointments. For pre-contractual or contractual enquiries, Article 6(1)(b) GDPR applies; general enquiries are handled on the basis of our legitimate interest in communication under Article 6(1)(f) GDPR.

Online booking through Treatwell

You can use our booking links to arrange appointments on Treatwell. You leave our website for the external booking page only when you open the link. Information about how your details are processed there is available in Treatwell's privacy policy.

Appointment management with Apple iCloud Calendar

We manage client appointments with Apple iCloud Calendar. We store only first and last names, phone numbers and appointment history in the calendar. This information is stored and synchronised through iCloud to organise and coordinate your appointments. The legal basis for processing necessary to arrange appointments is Article 6(1)(b) GDPR.

Information about Apple's data processing is available in the Apple privacy policy. Calendar entries and the appointment history they contain are stored until consent is withdrawn or they are deleted by the controller. Apple's processing follows Apple's applicable privacy and security terms.

Client forms and treatment records

Our client forms collect first and last names, date of birth, address, phone number, email address and confirmation of adulthood. We also ask how you heard about our studio. Completed forms and treatment consent documents are kept in physical client files. Our operational retention practice is to keep these files for seven years after the last visit. Further visits move the start of this period to the most recent visit. This describes our operational practice, not a blanket statutory retention requirement for all form information. Records are kept only for as long as necessary for client management, treatment and safeguarding statutory or legal claims.

Basic and contact details are used for client management, appointment coordination and treatment documentation. Article 6(1)(b) GDPR applies to data required to perform the contract. The question about how you found our studio helps identify the contact source and is processed only if answered voluntarily.

Health information

Depending on the treatment, we collect information including allergies, skin and eye conditions, medication, pregnancy or breastfeeding, previous treatments and health limitations. This helps assess possible contraindications and intolerances before treatment and document the information provided.

Health data receives special protection under Article 9 GDPR. The client form includes consent to the processing of personal and health-related data for treatment, documentation and client management. Where processing is based on valid explicit consent, Articles 6(1)(a) and 9(2)(a) GDPR apply. Consent to treatment does not automatically replace data protection consent.

Consent can be withdrawn for the future. Without health information needed for safe treatment, it may not be possible to carry out or continue a treatment. Consent and treatment-related information are documented in the client file and kept only for as long as necessary for treatment and safeguarding legal claims.

Records for minors

A separate declaration from a parent or legal guardian is used for lash extensions on minors. It records names, dates of birth, addresses, phone numbers and signatures of the minor and the parent or legal guardian. This documents consent to treatment. These documents form part of the physical client file and are kept only for as long as necessary to document consent and safeguard legal claims.

Client photos and publication

The client form contains two separate photo decisions: consent to taking and storing photos for documentation, and voluntary consent to using anonymised photos for marketing, for example on the website and social media. Consent to documentation is not permission to publish. Where personal data is processed, consent-based use follows Article 6(1)(a) GDPR; Article 9 GDPR must also be considered where health information is identifiable. Permission for anonymised photos does not grant general permission to publish identifiable people.

You may withdraw your consent at any time for the future, for example by emailing sc@sirincosmetics.at. The lawfulness of processing before withdrawal remains unaffected. After withdrawal, we stop the relevant use and remove publications within our control. Publicly published images may have been copied by third parties, and these copies cannot always be fully retrieved.

Original photos are stored in Apple iCloud and kept until the relevant consent is withdrawn. After withdrawal, they are deleted unless another legal basis or statutory obligation requires continued retention. The seven-year retention practice for paper files does not automatically apply to photos. Publication takes place only on explicitly approved channels, in particular the website or social media.

No advertising or campaign messages

We do not send advertising or campaign messages by email, SMS or WhatsApp. Communication to handle your enquiry or arrange appointments is unaffected.

Providing the website

When you access a website, technical connection data, particularly the IP address, is transmitted to the hosting infrastructure used. This processing enables delivery and secure operation of the website. Where based on legitimate interests, the legal basis is Article 6(1)(f) GDPR.

We offer optional, data-minimising visitor analytics. It activates only when you expressly select “Allow analytics” in the notice. The legal basis is your consent under Article 6(1)(a) GDPR; where required for access to information on your device, Section 165(3) TKG 2021 also applies. Without consent, no analytics events are sent. Your decision is stored locally in your browser so we do not ask again on every page. You can change or withdraw it at any time using “Privacy settings” in the footer; no further analytics data is sent after withdrawal.

For analytics, we store aggregated daily figures and short-term counts for the last 24 hours: the day or timestamp (UTC), a predefined page category, a broad device class (mobile, tablet or desktop), an approximate city and country based on a technical location signal, and the number of page views and estimated sessions. We also count clicks on predefined links, such as treatments, WhatsApp, phone, Instagram and Treatwell, together with the source page and website area. Message contents, free-text entries and individual click histories are not stored. Approximate location is derived only from this server signal; we do not store IP addresses or precise locations. VPNs and mobile networks can make the location inaccurate. We do not store names, phone numbers, individual visitor identifiers, complete URLs with query parameters or referrers for this purpose. Brief session differentiation takes place only locally in the browser using the timestamp of the last activity; no identifier is sent to the server. Aggregated daily figures are kept for a maximum of 90 days and cleared during the next processing operation or query. Timestamped counts for the 24-hour view are deleted during the next processing operation or query once 24 hours have passed. Analytics is used solely to improve the website, not for advertising or sending campaign messages.

Analytics data is processed server-side through the Sites hosting infrastructure. Only the owner, after signing in with her ChatGPT account, has access to the analytics page and its reports, including approximate regions. Staff and visitors do not receive reports. The website does not contain embedded social media feeds or an embedded Google map. Images and fonts are served by the website itself. A technical check also identified a Cloudflare security check intended to detect automated or harmful access. Security cookies, particularly cf_clearance, may be used. Security cookies are used only where necessary for secure operation and protection against misuse. Further information is available in the Cloudflare cookie documentation.

Links to WhatsApp, Instagram and Google

These services are accessible through ordinary links. Clicking them takes you away from our website. Providers may process personal data under their own privacy policies. You can alternatively contact us by email or phone.

Access within the studio

Within the studio, the owner generally has access to calendar data, client photos and physical client files. Staff receive access only where necessary for the particular treatment and only to the extent required. Technical processing by the service providers used is unaffected.

Retention periods and recipients

Enquiry data is deleted once it is no longer needed for handling the enquiry, unless statutory retention duties or legal claims require otherwise.

Your rights

Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests. Consent can be withdrawn at any time with effect for the future.

You may also lodge a complaint with the Austrian Data Protection Authority .