Privacy Policy – AFACIAL Skin Bar
Last updated: 29.09.2026
This is an English translation of our privacy policy. The German version is the legally binding one: afacial.at/datenschutz.
Protecting your personal data matters to us. We process your data only on the basis of the law (General Data Protection Regulation – GDPR, Austrian Data Protection Act – DSG, Telecommunications Act – TKG 2021). This privacy policy explains the most important aspects of how we process data on our website and in our studio.
1. Controller
Vitalite Kosmo e.U. (trading as „AFACIAL Skin Bar“)
Owner: Yuliya Lapygina
Am Heumarkt 9/1, 1030 Vienna, Austria
Phone: +43 1 992 99 38 · WhatsApp: +43 676 886063333
E-mail: termin@afacial.at
2. Hosting and server logs
Our website is hosted by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, in a data centre in the EU. OVH acts as our processor (Art 28 GDPR).
When you open the website, the server automatically processes the data your browser sends: IP address, date and time of access, the address requested, the page you came from, browser type and operating system. We need this data to deliver the website and to keep it secure and stable, for example to fend off attacks. We do not combine it with other data and only analyse it if a malfunction or an attack requires it.
Legal basis: legitimate interest in a secure, working website (Art 6(1)(f) GDPR).
3. Cookies and your consent
Cookies are small text files stored by your browser. We set strictly necessary cookies without consent because the website would not work properly without them. All other services – statistics, advertising and the chat – only load once you agree in the cookie banner. Your consent is voluntary; you can use our website in full without it.
The cookie banner is provided by CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom, acting as our processor (Art 28 GDPR). It is loaded from CookieYes servers, which receive your IP address. We store your choice in the cookie “cookieyes-consent” (12 months). As proof of your consent, CookieYes also stores a random consent ID, your choice, the date and time and the country from which you visit the site. You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page; withdrawal applies to the future.
The categories in the cookie banner:
- Necessary: stores your cookie choice.
- Functional: live chat by Superchat (section 4 d).
- Analytics: Google Analytics and Microsoft Clarity (section 7).
- Advertising: Google Ads, Meta Pixel and Klaviyo (section 8).
Google services receive your choice via Google’s “Consent Mode”: as long as you have not agreed, they set no analytics or advertising cookies and send no measurement data.
Legal basis: for necessary cookies § 165(3) TKG 2021 and our legitimate interest in running the website (Art 6(1)(f) GDPR); for all other services your consent (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR); for keeping proof of consent our legal obligation (Art 6(1)(c) in conjunction with Art 7(1) GDPR).
4. Contact, enquiries and booking
a) Phone, e-mail, text message and WhatsApp
If you contact us by phone, e-mail, text message or WhatsApp, we process the data you give us (e.g. name, phone number, e-mail address, desired treatment, preferred appointment) to handle your enquiry, arrange appointments and remind you of them.
With WhatsApp, WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, also processes your data under its own terms; a transfer to the USA is possible. If you do not want this, please contact us by phone or e-mail.
Legal basis: performance of a contract or pre-contractual steps (Art 6(1)(b) GDPR), otherwise our legitimate interest in answering your enquiry (Art 6(1)(f) GDPR).
b) Enquiry form („Welcome Special“)
The “Welcome Special” form lets you send us your name, e-mail address, phone number and your concern. We store the enquiry in our website, where it is not publicly visible, and receive it by e-mail so that we can contact you and arrange an appointment. To prevent spam we check a hidden field and the time taken to fill in the form; no cookies are set for this.
Legal basis: pre-contractual steps at your request (Art 6(1)(b) GDPR) and the consent you give when sending the form (Art 6(1)(a) GDPR). The enquiry is deleted automatically after 6 months.
If you also tick the optional box “Offers by email”, we send your first name, email address, phone number and your concern to our newsletter service Klaviyo (section 9 a). You then receive a short welcome series by email with information about our treatments and your welcome special, followed by our newsletter. The legal basis is your consent (Art 6(1)(a) GDPR, § 174 TKG 2021); you can unsubscribe at any time via the link in every email.
c) Online booking and gift vouchers (Phorest)
You book appointments online through the Phorest booking system and buy gift vouchers in Phorest’s voucher shop. Both open on Phorest pages via links on our website. There we process your details (e.g. name, contact details, chosen treatment and appointment, for vouchers also order and payment data) to manage appointments, send confirmations and reminders and issue vouchers. Online payments – for vouchers and any deposits – are made by card through PhorestPay, Phorest’s payment service. The provider is nDevor Systems Ltd T/A Phorest, 66/67 Great Strand Street, Dublin 1, D01 RW84, Ireland, acting as our processor (Art 28 GDPR).
Legal basis: performance of a contract or pre-contractual steps (Art 6(1)(b) GDPR).
d) Live chat (Superchat)
If you agree to the “Functional” category, we load the Superchat chat window. You can use it to write to us or switch directly to WhatsApp and other messengers. Superchat processes your messages, the contact details you provide and technical data such as your IP address, and may store information in your browser for this purpose. The provider is SuperX GmbH, Prenzlauer Allee 242–247, 10405 Berlin, Germany, acting as our processor (Art 28 GDPR).
Legal basis: your consent to loading the chat window (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR); we answer your message to prepare a contract (Art 6(1)(b) GDPR).
5. Treatment: medical history and photos
a) Treatment and health data (medical history)
Before your first treatment we use a medical history form to collect information about your health and skin condition (e.g. pregnancy, skin conditions, allergies, medication such as acne medication, recent treatments) insofar as this is necessary to carry out the treatment safely. We process this health data solely on the basis of your explicit consent (Art 9(2)(a) GDPR), which you give on the form. You can withdraw this consent at any time with effect for the future; without this information, however, a treatment is not possible for safety reasons.
Legal basis: consent (Art 9(2)(a) GDPR), legitimate interest in documenting the treatment (Art 6(1)(f) GDPR).
b) Photos
Before-and-after photos are only taken with your separate written consent and only used for the purpose stated in it. They are only published (e.g. on our website or on social media) with your explicit consent, which you can withdraw at any time for the future.
Legal basis: consent (Art 6(1)(a), Art 9(2)(a) GDPR).
6. Purchases, gift vouchers and laser flat rate membership
When you buy products or vouchers in the studio, we process your order and payment data to fulfil the contract and to meet tax and commercial retention obligations. You buy vouchers online in Phorest’s voucher shop and pay by card through PhorestPay (section 4 c).
You take out the laser flat rate membership via a Stripe payment link. Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, processes your payment data (e.g. name, e-mail address, card details or SEPA direct debit mandate) to handle the payment and prevent fraud; a transfer to Stripe, Inc. in the USA is possible (section 11). Stripe is itself responsible for processing the payment: https://stripe.com/privacy. We receive the data we need for the membership (name, contact details, plan, payment status), but not your full card details.
Legal basis: performance of a contract (Art 6(1)(b) GDPR), legal obligation (Art 6(1)(c) GDPR), for Stripe also the legitimate interest in preventing fraud (Art 6(1)(f) GDPR).
7. Analytics: Google Tag Manager, Google Analytics and Microsoft Clarity
a) Google Tag Manager
Our website loads Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland. It embeds the services in sections 7 and 8 and only starts them once you have agreed in the cookie banner. Tag Manager itself sets no cookies and analyses nothing; when it loads, however, your IP address is sent to Google, and a transfer to the USA is possible (section 11).
Legal basis: legitimate interest in embedding these services in an orderly way and in technically applying your cookie choice (Art 6(1)(f) GDPR).
b) Google Analytics
If you agree to the “Analytics” category, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland to understand how our website is used and to improve it. It records, for example, the pages you view, time spent, approximate location (country, city), device and browser, clicks on “Book now”, WhatsApp, calls and vouchers, forms sent (without their content) and the steps of the skin quiz. Google Analytics does not store full IP addresses. Cookies: “_ga” and “_ga_…” (up to 2 years each). The data is deleted after 14 months at the latest; a transfer to Google LLC in the USA is possible (section 11). Details: https://policies.google.com/privacy.
Legal basis: your consent (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings”.
c) Microsoft Clarity
If you agree to the “Analytics” category, we also use Microsoft Clarity from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. In heatmaps and recorded sessions, Clarity shows us how visitors use the website – for example where they click and how far they scroll – so that we can find errors and make the site easier to use. Text typed into form fields is masked. Cookies: “_clck” (1 year), “_clsk” (1 day) and Microsoft cookies such as “MUID” (1 year). Microsoft deletes recordings after 30 days and analyses after 9 months; a transfer to Microsoft Corporation in the USA is possible (section 11). Details: https://privacy.microsoft.com/en-gb/privacystatement.
Legal basis: your consent (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR).
8. Advertising: Google Ads, Meta and Klaviyo
We advertise our treatments on Google, Instagram and Facebook. If you agree to the “Advertising” category, we measure whether our ads lead to bookings or enquiries and may show you our offers again later (remarketing).
a) Google Ads
We use Google Ads with conversion tracking from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland. If you reach our website via an ad, it is recorded whether you then, for example, click “Book now”, call us, write via WhatsApp or send the form; we only see aggregated figures. For remarketing, Google may recognise you as a visitor to our website and show you our ads on other websites and devices, for example if you are signed in to Google. Cookies: “_gcl_au” (90 days) and Google advertising cookies such as “IDE” (up to 13 months). A transfer to Google LLC in the USA is possible (section 11). Your Google ad settings: https://adssettings.google.com.
Legal basis: your consent (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR).
b) Meta Pixel and Conversions API (Instagram, Facebook)
We use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It records pseudonymously which pages you view and whether you, for example, book an appointment, contact us, send the form, subscribe to the newsletter or want to buy a voucher. We use this to measure the effect of our ads on Instagram and Facebook, to build audiences (e.g. visitors to our website or people similar to them) and to show relevant ads. If you are signed in to Instagram or Facebook, Meta may link this data to your account.
If you have consented, we may also send the same events directly from our server to Meta (Conversions API) so that they are counted even with ad blockers or browser restrictions; a shared event ID prevents double counting. Details such as e-mail address or phone number are only sent in encrypted (hashed) form.
Cookies: “_fbp” and “_fbc” (90 days each). We are jointly responsible with Meta for collecting the data on our website and sending it to Meta (Art 26 GDPR); the agreement: https://www.facebook.com/legal/controller_addendum. Meta alone is responsible for any further processing: https://www.facebook.com/privacy/policy. A transfer to Meta Platforms, Inc. in the USA is possible (section 11). Your ad preferences: https://www.facebook.com/adpreferences.
Legal basis: your consent (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR).
c) Klaviyo (sign-up forms)
If you agree to the “Advertising” category, we also load the Klaviyo script. It recognises you on later visits once you have signed up for the newsletter, so that we can send you relevant content, and it can display Klaviyo forms. Cookie: “__kla_id” (2 years). More about Klaviyo in section 9 a.
Legal basis: your consent (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR).
9. Newsletter and marketing messages
a) Newsletter (Klaviyo)
If you subscribe to our newsletter – via the “Beauty List” sign-up field at the bottom of every page or the box in the “Welcome Special” form (section 4 b) – we send you offers, promotions and news from AFACIAL Skin Bar by e-mail, and a voucher to start when you use the sign-up field. We need your e-mail address for this. We send your details directly from our server to Klaviyo as soon as you submit the form. When you use the sign-up field, you confirm your subscription via a link in an e-mail (double opt-in); the time and source of sign-up and confirmation are stored as proof. We see whether newsletters are opened and links clicked in order to improve them.
We send the newsletter with Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02111, USA, acting as our processor (Art 28 GDPR). Klaviyo is certified under the EU-U.S. Data Privacy Framework; EU standard contractual clauses apply in addition (section 11).
Legal basis: your consent (Art 6(1)(a) GDPR, § 174 TKG 2021). You can unsubscribe free of charge at any time – via the link in every e-mail or by writing to termin@afacial.at. You will then receive no more newsletters; we keep a note that you unsubscribed so that it stays that way.
b) Marketing messages to existing customers
If you have booked a treatment with us or bought a product or voucher and gave us your contact details in doing so, we use them for 6 months from your last appointment or purchase to inform you about our own similar services and offers (e.g. appointment reminders, promotions, new treatments).
Legal basis: legitimate interest in direct marketing to existing customers (Art 6(1)(f) GDPR, recital 47) in conjunction with § 174(4) TKG 2021.
Right to object: you can object to this use free of charge at any time, in any message you receive or informally by e-mail to termin@afacial.at. Health data is never used for marketing.
c) Marketing messages to prospective customers (consent)
If you expressly agree to receive marketing information when booking online, in the studio or in a form, we use your contact details for 6 months from the date of consent to inform you by e-mail, text message or WhatsApp about offers, promotions and services. If you become a customer in the meantime, section 9 b applies.
Legal basis: your consent (Art 6(1)(a) GDPR). Consent is voluntary; handling your enquiry does not depend on it. You can withdraw it free of charge at any time with effect for the future, in any message or by e-mail to termin@afacial.at.
10. Video, maps, social media and fonts
a) Video (YouTube)
The video on our home page is hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland). It only loads when you click “Watch the video” – before that there is no connection to YouTube. After the click, the player loads via youtube-nocookie.com; Google then receives your IP address and may store information in your browser, and a transfer to the USA is possible (section 11).
Legal basis: your consent by clicking “Watch the video” (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR).
b) Google Maps
Links such as “Get directions” open Google Maps. Data is only sent to Google once you click; from then on Google’s privacy policy applies: https://policies.google.com/privacy.
c) Social media
We run profiles on social networks (e.g. Instagram, Facebook). On our website we only link to them; we do not use social media plugins that send data as soon as the page loads. When you visit our profiles, the privacy terms of the respective provider apply. Where we are jointly responsible with the provider (e.g. page insights), the processing is based on our legitimate interest in public relations (Art 6(1)(f) GDPR).
d) Fonts
The fonts of our website are stored on our own server. No data is sent to font providers such as Google Fonts when they load.
11. Transfers to third countries
Some providers (Google, Meta, Microsoft, Klaviyo, Stripe) also process data in the USA. For companies certified under the EU-U.S. Data Privacy Framework – which applies to these providers – the European Commission found an adequate level of data protection on 10.07.2023 (Art 45 GDPR). In addition, the providers have concluded EU standard contractual clauses (Art 46(2)(c) GDPR). For the United Kingdom (CookieYes), there is also an adequacy decision of the European Commission (Art 45 GDPR).
12. Recipients of the data
We only pass on your data where this is necessary for the purposes described or required by law. Recipients are the service providers named above – OVH (hosting), CookieYes (cookie banner and proof of consent), Phorest (booking, vouchers and online payments), Superchat (chat), Klaviyo (newsletter), Google, Meta and Microsoft (analytics and advertising, only with consent), Stripe (payments) – as well as our tax advisers and authorities within the scope of legal obligations. Where service providers act as our processors, contracts under Art 28 GDPR are in place. We do not sell your data.
13. Retention periods
- Appointment and contact data: for the duration of the customer relationship
- Enquiries via the form, e-mail or chat: 6 months, unless they lead to an appointment or contract
- Contact data for marketing: 6 months from the last appointment/purchase (section 9 b) or from consent (section 9 c)
- Newsletter: until you unsubscribe
- Accounting data (invoices, payments, SEPA): 7 years under § 132 BAO
- Medical history and treatment records: for the duration of the customer relationship and beyond as long as necessary to protect legal claims (usually 3 years after the last treatment)
- Analytics: Google Analytics up to 14 months, Microsoft Clarity 30 days (recordings) or 9 months (analyses)
- Cookies: as stated for each service (sections 3, 7 and 8)
- Data based on consent: until withdrawal
14. Your rights
You have the right of access (Art 15 GDPR), rectification (Art 16), erasure (Art 17), restriction (Art 18), data portability (Art 20) and objection (Art 21). You can withdraw consent at any time with effect for the future, consent to cookies via “Cookie settings” at the bottom of every page.
An informal message is enough to exercise your rights: termin@afacial.at
If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at
15. No automated decision-making
We do not make automated decisions, including profiling (Art 22 GDPR). For advertising (section 8), Google and Meta analyse your usage pseudonymously to select ads; this has no legal or similarly significant effect on you.
16. Data security
We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Our website is delivered over an encrypted connection (SSL/TLS).
17. Changes to this privacy policy
We may update this privacy policy if the law or our data processing changes. The version published on this page applies.