Privacy notice
Updated: 2026-10-14
Draft: operator, provider and retention details marked [COMPLETE] are not yet verified. This notice is incomplete.
1. Controller and contact
Your selected salon controls its customer and appointment data: [COMPLETE: legal name, legal form, authorised representative and postal address]. Privacy contact: [COMPLETE: email and postal address]. Website/UniCut platform operator and its role: [COMPLETE]. Data protection officer, if appointed: [COMPLETE or not required]. Salon contact details also appear on its website.
2. Data, purposes and legal bases
Account and booking data include name, email, optional telephone, password hash, verification/session records, services, staff, dates, times, status and communications, for providing the account and appointment (GDPR Art. 6(1)(b)). POS, payment references, discounts, gift cards, memberships and loyalty records support contracts and applicable legal records (Art. 6(1)(b)/(c)). Optional profiles can contain birth date, gender, address, favourite staff, style preferences, treatment formulas, notes and photos. Only necessary fields are mandatory; online bookings need contact and appointment details. Do not put unnecessary sensitive information in free text.
3. Health information, images and sources
Allergy/health information is voluntary. Storing it for safe, suitable treatment requires separate explicit consent (Art. 6(1)(a) and 9(2)(a)); ordinary bookings do not depend on it. Withdraw in your account. Any other legal basis needs separate assessment. Photos require a suitable legal basis, and publication requires separate permission. We receive data from you, your booking or salon staff creating a record/appointment at your request.
4. Messages, offers and staff reassignment
Confirmation, email reminders and staff/time change messages help fulfil appointments. If staff is absent, an available qualified replacement is sought at the same date/time; an email link lets you confirm or cancel free of charge. Email offers are optional; consent and withdrawal timestamps are recorded. Withdraw through your account or the salon. Visit/loyalty totals are calculated for your profile. This booking workflow does not provide solely automated decisions producing legal or similarly significant effects.
5. Recipients and international transfers
Relevant salon staff and necessary hosting, maintenance, email and payment/accounting providers may access data. [COMPLETE: actual providers, purposes, locations and Art. 28 processing agreements]. Consented maps (Google Maps, OpenStreetMap/Nominatim, CARTO) and Google Analytics can receive IP, browser and usage data. Google may process data outside the EEA. [COMPLETE: recipients, countries, actual adequacy decisions/standard contractual clauses and how to obtain safeguards]. Unverified agreements or transfer safeguards are not represented as already in place.
6. Cookies, operation and security
Session, CSRF, language and choice storage support requested functions (§25(2) TDDDG). Optional device access/processing requires consent (§25(1) TDDDG and GDPR Art. 6(1)(a)). Technical access/security records, including IP addresses, support reliable operation and abuse prevention under Art. 6(1)(f); the legitimate interest is a secure, available service. [COMPLETE: server log fields and deletion period]. See cookie information. Analytics and external maps are off by default.
7. Retention and erasure
Contact, profile and appointment data are needed while the account/contract and outstanding matters continue, then must be deleted or limited to necessary records. [COMPLETE: approved periods for inactive accounts, appointments, messages, consent proof, photos, health data, logs and backups]. Required accounting records follow the applicable statutory period, assessed for the document concerned. Account deletion removes/anonymises active profile data and revokes sessions; required business records and separate systems/backups may remain for separate review. Immediate deletion of every copy is not promised.
8. Rights and complaints
You can request access/copies, correction, erasure, restriction, portability and object to Art. 6(1)(f) processing (Art. 15–21). You may object to direct marketing at any time. Withdraw consent prospectively without losing ordinary booking access; earlier lawful processing is unaffected. Use your account for export, preferences and deletion, or contact the controller even without an account. Requests are normally answered within one month; any necessary extension is explained. You may complain to your competent authority, including the Bavarian State Office for Data Protection Supervision (www.lda.bayern.de) for private businesses in Bavaria.
9. Children and updates
Parents/guardians should manage children’s bookings. A minor’s own online consent is subject to applicable age/representation rules; the salon must check necessary authority. This notice describes existing features, not every possible processing activity. New providers, purposes or legal bases require updates; updating the notice alone does not authorise a new purpose requiring consent.
10. Optional staff notifications
Staff may voluntarily enable Web Push for newly confirmed bookings. We store the browser push endpoint, technical keys, staff and device association, and delivery status. The message contains no customer data. Delivery sends an encrypted message to the browser provider’s push service (for example Apple, Google or Mozilla), which receives technical connection data and may operate outside the EEA. [COMPLETE: actual providers and transfer safeguards]. Staff can disable this in their portal; signing out unregisters the device. Invalid endpoints are deleted.