Privacy Policy
Protecting your personal data matters to me. Below I inform you under the GDPR about the nature, scope and purpose of processing.
1. Controller
Mehmet Mısırlı, Mobile Massage & Hamam — HamamWell, Magdeburgerstr. 12, 78467 Konstanz. Phone: +49 152 1545 6401. Email: info@hamamwell.de.
2. Hosting and server log files
This website is hosted by Lovable (Lovable Labs Incorporated) and delivered via Cloudflare Germany GmbH as a content delivery network. A data processing agreement under Art. 28 GDPR is in place with both providers.
When the site is opened, server log files are recorded automatically: IP address, date and time, page requested, referrer, browser type and operating system. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, trouble-free operation). Log files are deleted after 30 days at the latest.
3. Contact and booking form
For an appointment request made through the online calendar I process the data you provide: name, phone number, email address, street and number, postcode and town, desired service, date and time and an optional message. The address is required because the service takes place at your home. I use this data solely to handle your request and arrange the appointment. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps and performance of a contract); no cookie consent is required for it.
Requests are stored in the cloud database of this website. The database is operated by Lovable (Lovable Labs Incorporated) as a processor under Art. 28 GDPR. To prevent misuse, an encrypted checksum of your IP address is also stored briefly. To notify me of new appointment requests, an e-mail service provider (Resend) is used, which processes the request data solely for this purpose as a processor under Art. 28 GDPR. Appointment data is deleted no later than six months after the appointment, unless statutory retention periods apply. The data subject rights listed below apply. To protect the booking form against automated misuse, Cloudflare Turnstile is used; technical data such as the IP address is processed for that purpose. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing misuse).
No health data is collected through the form. Please do not enter any information about your health in the message field. Special categories of personal data under Art. 9 GDPR are collected offline only and only with separate written consent.
Contact by phone, WhatsApp or email is processed for the same purpose. If you contact us via WhatsApp, WhatsApp Ireland Ltd. processes connection data. This route is used only at the visitor's own initiative.
4. Legal bases
Art. 6(1)(b) GDPR for initiating and performing a contractual relationship (appointment, delivery of the session).
Art. 6(1)(f) GDPR for secure operation of the website and answering general enquiries.
Art. 6(1)(a) GDPR where you have consented (e.g. optional measurement services).
5. Retention
Request data is deleted as soon as it is no longer needed for the purpose, at the latest six months after the communication ends. Statutory retention periods (§ 147 AO, § 257 HGB) remain unaffected.
6. Recipients
Your data is passed on only to service providers required to operate the website or handle the request (hosting, email provider), in each case on the basis of a data processing agreement. No transfer to third countries takes place.
7. Cookies
This website currently uses no cookies for analytics or marketing. Technically necessary cookies may be set to ensure functionality; the legal basis is § 25(2) TDDDG.
8. Fonts
All fonts are served locally from this server. There is no connection to Google Fonts and no data transfer to the USA.
9. Google Ads and Analytics
Measurement services such as Google Analytics 4 and Google Ads conversion tracking are prepared but disabled. They are only loaded after your explicit consent via a consent banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). No tag runs without consent.
10. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future.
11. Right to complain
You may complain to a supervisory authority; the one responsible for me is: Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.
12. Location request (optional)
In the booking form you can optionally use the “Use my location” button. Only when you press it does your device determine the coordinates and send them once to the Nominatim service of the OpenStreetMap Foundation in order to determine the address. The coordinates are not stored by me.
The legal basis is your consent under Art. 6 (1) (a) GDPR, given by pressing the button and revocable at any time by simply not using the function. You can always type the address by hand instead.