Siriburi Thai Spa
Sign in

Legal

Privacy

Protecting your data matters to us. Below we explain which data we process, for what purpose, on what legal basis and for how long.

1. Controller

Sascha Fuchs
Siriburi Thai Spa & Massage
Eisenbahnstraße 32
66424 Homburg
Germany
Phone: +49 6841 8179592
Email: info@siriburi-thai-spa.de

We are not required to appoint a data protection officer. For any question about data protection, please contact the address above directly.

2. Visiting the website and hosting

You can browse our pages without giving any personal details. On every request our server automatically processes technical access data: the address requested, date and time, volume of data transferred, referrer, browser type and IP address.

We need this data to deliver the site, detect faults and fend off attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is secure and uninterrupted operation.

The logs are limited to a fixed size and are continuously overwritten, so older entries drop out. We do not evaluate them in relation to individuals and do not combine them with other data.

Our website runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes the data solely on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

3. Booking an appointment

When you book an appointment we process: your name, email address, phone number if you provide one, the treatment chosen with duration and price, date and time, the therapist assigned and any notes you add. For a couple's booking we also process the names of the accompanying guests, if you give them.

The legal basis is Art. 6 (1) (b) GDPR — the data is necessary to perform the treatment contract. We use it to confirm your appointment, remind you of it and prepare the treatment.

4. Health-related information

For some treatments — a pregnancy massage or treatments for children, for instance — the booking itself reveals something about your health. We process such data only if you give your explicit consent in the booking form. The legal basis is Art. 9 (2) (a) GDPR together with Art. 6 (1) (a) GDPR.

We record that and when you gave consent so that we can demonstrate it. Without this consent we cannot book the treatment in question. You can withdraw your consent at any time with effect for the future; this does not affect the lawfulness of processing carried out beforehand.

Anything you tell us about your health verbally at the studio is recorded only where this is needed for your safety during the treatment.

5. Voucher purchases and orders

For an order in the shop we process your name, email address, billing address and the order details. If you are giving the voucher as a present, we also process the name and email address of the recipient and your personal message.

The legal basis is Art. 6 (1) (b) GDPR. For the recipient, processing is based on Art. 6 (1) (f) GDPR — our legitimate interest in delivering the gift. Please make sure the recipient agrees to being sent the voucher.

We retain invoices and the associated order data to meet tax and commercial law obligations (Art. 6 (1) (c) GDPR, sections 147 AO and 257 HGB). The retention periods are six and ten years respectively.

6. Payment

Payments in the shop are handled through PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

Your name, email address, the amount and the order number are transmitted to PayPal. You enter your payment details — card or account data — exclusively at PayPal; they never reach us. From PayPal we only receive the information whether the payment succeeded, along with a transaction number.

On the payment page and on the deposit page a script is loaded from PayPal (www.paypal.com) to draw the payment button. In doing so PayPal learns your IP address and sets its own cookies. This happens only on those two pages and only if you open them.

The legal basis is Art. 6 (1) (b) GDPR — without the button there would be no way to pay. PayPal is its own controller for its own processing; PayPal's privacy notice applies.

7. Customer account and sign-in

A customer account is optional. For it we process your name, your email address and — depending on the method you choose — a password in encrypted form or the public key data of a passkey. The legal basis is Art. 6 (1) (b) GDPR.

We offer three ways to sign in: password, a one-time sign-in link by email, and passkey. With passkeys the secret key stays on your device; we store only the public part, which is enough to verify your sign-in.

You can have your account deleted at any time in the "Privacy" area of your account or by sending us a message. Data we are required to retain under tax or commercial law is restricted from further processing and deleted once the retention periods expire.

8. Getting in touch

If you write to us by email or through the contact form, we process your details in order to answer. The legal basis is Art. 6 (1) (b) GDPR where the enquiry concerns a contract, otherwise Art. 6 (1) (f) GDPR — our legitimate interest in replying. We delete enquiries once they have been dealt with and no retention obligation applies.

9. Newsletter

All we need for our newsletter is your email address. We use the confirmation procedure: after signing up you receive an email with a confirmation link, and only once you click it do we add you to the list. We store the times of sign-up and confirmation so that we can demonstrate your consent.

The legal basis is Art. 6 (1) (a) GDPR. You can unsubscribe at any time using the link at the end of every newsletter email or by sending us a message. We then remove your address from the list.

10. Reviews

After an appointment we ask you once by email for a review. The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in feedback on our work. You may object to this at any time.

If you submit a review, we publish the text and the name you gave only after we have checked it. We take a review down again at your request.

11. Loyalty points

We credit points to your customer account for orders. For this we process order totals and the points balance. The legal basis is Art. 6 (1) (b) GDPR. Without a customer account no points are kept.

12. Cookies

We only use cookies that are necessary to operate the site:

  • siriburi_consent — stores your choice in the cookie notice so we do not ask you again. Lifetime: one year.
  • siriburi_cart_id — links your basket to you while you are shopping.
  • Sign-in cookie — keeps you signed in to your customer account. It is only set if you sign in.

The legal basis for these cookies is section 25 (2) no. 2 TDDDG together with Art. 6 (1) (f) GDPR; without them the basket and sign-in could not work.

We currently use no analytics or marketing tools. There is no reach measurement and no tracking across other websites. You can still make your choice for these two areas in the cookie notice — we record it, and we would only use such services after your consent. You can change your choice at any time via "Cookie settings" in the footer.

Apart from PayPal's payment button we do not embed fonts, maps, videos or buttons from third-party servers. Typefaces are served from our own server; no connection to Google is made.

13. Logging of transactions

Where money, appointments or consent are involved, we keep a record: orders and payments, cancellation of an appointment, submitting a review, subscribing to and unsubscribing from the newsletter, and requests under the GDPR. Alongside the transaction itself we store the date, the time and the IP address it came from.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is being able to show who did what and when — with a disputed cancellation or a withdrawn consent it is the only account we have. We keep these entries for up to three years and delete them afterwards.

This is not the same as the server logs in section 2: those run with every page view and are continuously overwritten.

14. Recipients of your data

We pass on your data only where this is necessary for the purposes described:

  • Hosting: Hetzner Online GmbH, Germany (processor).
  • Email delivery: our email service provider, which delivers confirmations, vouchers and invoices on our behalf.
  • Payment: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
  • Tax advisers and tax authorities, where we are legally obliged to do so.

Data is transferred to countries outside the EU or EEA only where an adequacy decision of the European Commission exists or appropriate safeguards under Art. 46 GDPR have been agreed.

Your data is not sold and is not used for third-party advertising.

15. Retention periods at a glance

  • Server logs: continuously overwritten, not retained
  • Transaction log (including IP address): up to three years
  • Enquiries without a contract: until they have been dealt with
  • Appointment data: until the statutory retention periods end
  • Invoices and order data: six or ten years under tax and commercial law
  • Vouchers: until they expire, then within the retention periods
  • Newsletter: until you unsubscribe
  • Customer account: until you delete it

16. Your rights

You have the right

  • to request access to the data stored about you (Art. 15 GDPR),
  • to have inaccurate data corrected (Art. 16 GDPR),
  • to request erasure, unless a retention obligation stands in the way (Art. 17 GDPR),
  • to request restriction of processing (Art. 18 GDPR),
  • to receive your data in a common format or have it transferred (data portability, Art. 20 GDPR),
  • to object to processing based on legitimate interests (Art. 21 GDPR), and
  • to withdraw consent at any time (Art. 7 (3) GDPR).

While signed in, you can request access and erasure directly in the "Privacy" area of your customer account. We answer requests within one month.

Right to object

Where we process data on the basis of legitimate interests, you can object at any time with effect for the future. Where the processing is for direct marketing, no further reason is needed; in other cases, if grounds arise from your particular situation.

Complaints

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Unabhängiges Datenschutzzentrum Saarland
Die Landesbeauftragte für Datenschutz und Informationsfreiheit
Fritz-Dobisch-Straße 12
66111 Saarbrücken
Germany

17. Changes

We update this notice when our services or the legal situation change. The version published here applies.

Note

This is a translation for your convenience. In legal matters the German version prevails.