Privacy policy

The controller is the most beautiful GmbH, Neutorstraße 48, 5020 Salzburg, phone and WhatsApp +43 664 99230429, email info@themostbeautiful.at.

If you have questions about data protection or want to exercise your rights, simply write to us at this address.

The website and its database are operated by Lovable (Lovable Cloud, technically based on Supabase). When you open a page, the server processes technically necessary data such as IP address, date and time, the page requested and your browser and operating system in order to deliver the page and protect it against misuse.

To protect against spam and attacks, we briefly count requests per IP address; this count is only held in memory and is not stored permanently.

The legal basis is our legitimate interest in secure and functioning operation of the website (Art. 6(1)(f) GDPR).

We do not use tracking or advertising cookies. When you log in to your customer account, your browser stores the login so that you stay logged in. This is technically necessary (§ 165(3) TKG 2021) and ends when you log out.

When you contact us, we process your details in order to answer your enquiry and, where applicable, to arrange an appointment (Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR).

For a booking we process your first and last name, email address, mobile number, the chosen treatment, practitioner, date and time and an optional note. We also store when you accepted which version of the terms and conditions.

If you also book for a companion, we process their name, email address and mobile number as well so that they receive their own confirmation.

Appointments you make by phone, via WhatsApp or at the studio are entered into the same system.

We use this data to plan, carry out and bill the appointment, to send you confirmation and reminder messages and to let you reschedule or cancel via your personal link. The legal basis is the contract with you (Art. 6(1)(b) GDPR). Without this information we cannot give you an appointment.

A customer account is optional. It shows your appointments and your Beauty Credit. For this we process your contact details, your appointments and the entries on your credit account (Art. 6(1)(b) GDPR).

We only use your date of birth if you have agreed to the birthday greeting (Art. 6(1)(a) GDPR). You can withdraw this consent at any time in your account or by messaging us.

If you recommend us, we record who recommended whom in order to credit the balance. After an appointment we may ask you for a review; the review itself is voluntary.

Before certain treatments we ask at the studio for information about your health, for example allergies, medication or pregnancy. We only process this information with your explicit consent and only to carry out the treatment safely (Art. 9(2)(a) GDPR).

We only take before and after photos with your consent. They are only published with your separate written consent, which you can withdraw at any time.

We send confirmations, reminders, rescheduling and cancellation notices by email via Lovable’s email service.

If you gave a mobile number when booking, we may also send you the same messages via WhatsApp. For this we use Twilio as the sending service; the messages are delivered via WhatsApp (Meta). We point this out when you book. If you do not want WhatsApp messages, simply reply STOP.

The legal basis is the contract with you (Art. 6(1)(b) GDPR).

You only receive our newsletter if you subscribed and confirmed your subscription via the link in our email (double opt-in). For this we store your email address, your name and the times of subscription and confirmation (Art. 6(1)(a) GDPR).

The newsletter is sent via Amazon Simple Email Service (Amazon Web Services, data centre in the EU). We currently do not measure whether a newsletter is opened or a link is clicked. Should we introduce this, it will be stated here beforehand.

You can unsubscribe at any time via the link at the end of every newsletter or by messaging us.

If you have been to us before, we transferred your customer data, past appointments and any existing newsletter subscription from our previous booking system and our till system to the new system so that we can continue to look after you (Art. 6(1)(b) and (f) GDPR).

Payment is made at the studio in cash, by debit card (Bankomat) or by credit card. For card payments, the payment provider of the card terminal processes your card data; we do not receive complete card data.

Medical treatments are carried out by Dr. Peter Pumberger under his own responsibility. He is himself the controller for the data he collects for them. We pass on to him the appointment data he needs for the appointment.

A Google Maps map is embedded on the “Contact & directions” page. The map is only loaded when you actively switch it on. Before that, no connection to Google is established (Art. 6(1)(a) GDPR).

Links to our Google reviews open Google’s website, where Google’s privacy policy applies.

This website does not use web analytics, advertising networks, tag managers or tracking cookies. Should this change, we will describe it here beforehand.

The fonts are delivered from our own server; no fonts are loaded from third-party providers.

We only pass on data where necessary for the purposes described: to Lovable and Supabase (hosting, database, email delivery), to Amazon Web Services (newsletter), to Twilio and WhatsApp/Meta (WhatsApp messages) and to tax advisers and authorities where required by law. We have data processing agreements with our service providers.

Some of these providers are based in the USA or access data from there. Any transfer is then based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on EU standard contractual clauses.

We keep data for as long as we need it for the respective purpose. Appointment and customer data are kept for the duration of the customer relationship. Invoices and accounting records must be kept for seven years (§ 132 BAO). Newsletter data is deleted after you unsubscribe, birthday-greeting data after you withdraw your consent. You can have your customer account deleted at any time; records we are legally required to keep remain stored until the retention period ends.

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent at any time with effect for the future.

If you believe that we are not processing your data lawfully, you can lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).