Privacy policy

This is a courtesy translation. The German version of this privacy policy is the legally binding one.

Last updated: November 2026

1. Controller

The controller responsible for processing personal data on this website (Art. 4(7) GDPR) is:
Hannah Schaffer, Master Hairdresser, Fasanenweg 43, 94081 Fürstenzell, Germany
Phone 0049 151 10480215, email hannah.schaffer80@gmail.com

2. The key points at a glance

This website does not set any cookies for visitors and does not store anything on your device. Fonts and images are hosted on my own storage; no content from other providers is loaded – no maps or fonts from Google either. A YouTube video only loads once you tap play yourself (section 9).

3. Hosting and server logs

This website is hosted by Cloudflare (Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany; parent company Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Each time the site is accessed, Cloudflare processes technically necessary data: your IP address, the date and time, the address requested, the page you visited previously, your browser and operating system, and the amount of data transferred. This is necessary to deliver the site to your device, keep it stable and fend off attacks. From these requests, Cloudflare also produces aggregated visitor numbers (for example, page views per day) – without cookies and without profiles of individual visitors.

The legal basis is my legitimate interest in operating the website securely and reliably (Art. 6(1)(f) GDPR). Cloudflare processes this data as a processor under its data processing agreement. Where data is transferred to the USA in the process, the transfer is based on Cloudflare’s certification under the EU-US Data Privacy Framework (Art. 45 GDPR) and additionally on the EU Standard Contractual Clauses (Art. 46 GDPR). Log data is only stored for as long as is necessary for operation and security.

Visitor statistics. To see how my website is used, I count visits – without cookies and without storing or reading anything on your device. When you open a page, your browser reports this to my own server at Cloudflare. I count the page viewed, the page you came from (for example a search engine), the type of device (phone, tablet or computer), the country and whether you tap “Call”, WhatsApp, email, “Directions” or an appointment request. So that several views on the same day are counted only once, the server creates an encrypted checksum from the IP address and browser identifier that is valid for that day only and is deleted no later than the following day; the IP address itself is not stored for this purpose. Only aggregated daily figures that do not allow conclusions about individuals are kept, on servers in Western Europe. The legal basis is my legitimate interest in improving the website and measuring its benefit (Art. 6(1)(f) GDPR). You may object at any time (Art. 21 GDPR); without JavaScript in your browser nothing is counted.

4. Technical support

The website is set up and maintained on my behalf by my web service provider Lightvale Studios, Thomas Saxinger, Aubach 39A, 94051 Hauzenberg, Germany. He acts solely on my instructions and does not use the data for his own purposes (Art. 28 GDPR).

5. Encryption

The connection to this website is encrypted with TLS. You can recognise this by “https://” in your browser’s address bar.

6. Cookies and storage on your device

I do not set any cookies for visitors and do not store any data on your device. That is why I do not need consent under Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and do not show a cookie banner. Exceptions: if you tap play on a video, section 9 applies. And: when I log in as the owner with my password to change texts and photos, my device receives a technically necessary login cookie (Section 25(2) no. 2 TDDDG); it is valid for a maximum of eight hours and only concerns me.

7. Contacting me

If you call me or send me an email, I process the information you give me (for example your name, phone number and preferred appointment) in order to answer your enquiry and arrange your appointment. The legal basis is Art. 6(1)(b) GDPR, or otherwise my legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR). I receive emails via Google Gmail (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). If you write to me via WhatsApp, the message is handled by WhatsApp Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland); WhatsApp also processes data such as your phone number under its own responsibility, and data may be transferred to Meta Platforms, Inc. in the USA (EU-US Data Privacy Framework). If you prefer not to use WhatsApp, you can reach me just as well by phone or email. I delete your enquiry as soon as it has been dealt with, unless statutory retention obligations apply.

8. Links to Google and social networks

I only refer to my Google profile, route planners and social networks with simple links. No data is transferred to these services when you open this website. Only when you click on a link do you leave my site, and the respective provider then processes your data under its own responsibility.

9. Videos from YouTube

If I show a video on this website, it is embedded from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in privacy-enhanced mode via youtube-nocookie.com. Nothing is transferred to YouTube when you open my website. Only when you tap play does your browser load the video from YouTube. Google then receives your IP address, information about your browser and device and the address of my website; YouTube may also store data on your device and transfer data to Google LLC in the USA (EU-US Data Privacy Framework). The legal basis is your consent, which you give by tapping play (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). If you do not play a video, no data goes to YouTube. More information in Google's privacy policy: policies.google.com/privacy.

10. Your rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Where I process your data on the basis of my legitimate interest, you can object to this on grounds relating to your particular situation (Art. 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); the competent authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.