Privacy Policy

This English version is a courtesy translation. In case of any discrepancy, the German version (Datenschutzerklärung) is legally binding.

Protecting your personal data is important to us. We process your data exclusively on the basis of the statutory provisions (General Data Protection Regulation – GDPR, Austrian Data Protection Act – DSG, Austrian Telecommunications Act 2021 – TKG 2021). In this privacy policy we inform you about the most important aspects of data processing on our website and when you contact us.

1. Controller

Bebella.

Rashagorn Pihusuut

Neulinggasse 13/7

1030 Vienna, Austria

Phone: +43 677 6192 0499

Email: office@be-bella.at

A data protection officer is not required by law (Art. 37 GDPR). If you have any questions about data protection, please contact us directly at the address above.

2. Legal bases

We process personal data on the following legal bases:

• Consent (Art. 6(1)(a) GDPR) – e.g. for Google Maps
• Contract or pre-contractual measures (Art. 6(1)(b) GDPR) – e.g. booking appointments and answering your enquiries
• Legal obligation (Art. 6(1)(c) GDPR) – e.g. retention obligations under tax law
• Legitimate interest (Art. 6(1)(f) GDPR) – e.g. secure and stable operation of the website

3. Hosting and server log files

Our website is hosted by Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus. When you visit our website, technical information transmitted by your browser is automatically stored in so-called server log files:

• IP address
• date and time of access
• page or file requested
• previously visited page (referrer)
• browser and operating system used

This data is technically necessary to deliver the website and to ensure its security and stability (e.g. to fend off attacks). The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. The log files are only stored for as long as necessary for these purposes and are then deleted. The data is not combined with other data sources.

Hostinger processes the data as a processor on our behalf on the basis of a data processing agreement (Art. 28 GDPR). The servers are located in Germany (EU). Where Hostinger uses sub-processors outside the European Economic Area in individual cases, this is done on the basis of EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Storing your consent in the browser

Our website sets no cookies and uses no analytics or tracking services. If you tick “Remember my choice” when loading the map, we store this decision in your browser's local storage (localStorage) under the key bebella-consent-v1. This information does not leave your device and is not transmitted to us or to third parties. Storing it is strictly necessary to respect your decision (§ 165(3) TKG 2021). You can remove it at any time using the button in section 4 or by deleting the website data in your browser.

4. Google Maps

On our homepage you can display a map from Google Maps to find our studio more easily. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded after you click “Load map”. No data is transmitted to Google before that.

As soon as you load the map, your browser connects to Google's servers. In particular, your IP address, information about your browser and device, the date and time of access and your interactions with the map are transmitted to Google. Google may use cookies or similar technologies. If you are logged in to Google, Google can associate the visit with your account. Google processes this data under its own responsibility.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 165(3) TKG 2021. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; these transfers are covered by an adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). In addition, Google uses EU Standard Contractual Clauses.

For more information, please see Google's privacy policy.

Withdrawal: You can withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.

5. Booking via Fresha

We use the Fresha platform for online booking. The provider is Fresha.com SV Limited, 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom (Company No. 11326509). When you click “Booking” or “Book”, you leave our website and are redirected to Fresha. Our website itself does not transmit any data to Fresha in the process.

When you book, your name, email address, phone number, the booked treatment, the appointment and any notes are processed in particular. We use this data to carry out and manage your appointment and to send appointment reminders. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps and performance of a contract).

Fresha processes the booking data as our processor on the basis of a data processing agreement (Art. 28 GDPR). If you create your own customer account with Fresha, Fresha is itself responsible for this account data; in that case Fresha's privacy policy also applies. For the United Kingdom there is an adequacy decision of the European Commission (Art. 45 GDPR), which was renewed on 19 December 2025 until 27 December 2031.

6. Contacting us

If you contact us by email, phone, WhatsApp or Instagram direct message, we process the data you provide (e.g. name, phone number or username, content of the message) to handle your enquiry, arrange appointments and send appointment reminders. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to an appointment or contract, otherwise our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR).

WhatsApp

WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Message contents are end-to-end encrypted. However, WhatsApp processes metadata (e.g. phone number, time of communication, device information) under its own responsibility and may also transfer it to Meta Platforms, Inc. in the USA (certified under the EU-US Data Privacy Framework). For details, please see WhatsApp's privacy policy.

Instagram

Instagram is provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you message us on Instagram, Meta processes your data under its own responsibility; a transfer to Meta Platforms, Inc. in the USA is possible (certified under the EU-US Data Privacy Framework). For details, please see Instagram's privacy policy.

Please note: Please do not send us health data (e.g. information about allergies or eye conditions) via WhatsApp or Instagram. We are happy to discuss such information in person at the studio or by phone. If you prefer not to contact us via Meta services, you can reach us at any time by email or phone.

7. Our Instagram profile

Our website links to our Instagram profile. This is a simple link: no Instagram content is embedded on our website and no data is transmitted to Meta when you visit our website. You are only redirected to Instagram when you click the link. When you visit our Instagram profile, Meta provides us with anonymised usage statistics (“Insights”). We are jointly responsible with Meta for this processing (Art. 26 GDPR); Meta has assumed primary responsibility (Page Controller Addendum).

8. Storage period

We only store personal data for as long as necessary for the respective purpose. We delete data on appointments and enquiries as soon as it is no longer needed, unless statutory retention obligations apply. We keep invoices and accounting records for seven years in accordance with § 132 of the Austrian Federal Fiscal Code (Bundesabgabenordnung, BAO).

9. Recipients at a glance

10. Your rights

You generally have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interests (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to office@be-bella.at is sufficient.

11. Right to lodge a complaint

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria, this is the:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)

Barichgasse 40–42, 1030 Vienna

Phone: +43 1 52 152-0

Email: dsb@dsb.gv.at

Website: www.dsb.gv.at

12. Last updated

Last updated: September 2026. We update this privacy policy whenever our website or the legal framework changes.