Privacy policy

Last updated: August 2026

1. Controller

Responsible for the data processing is:

Hello Laser Owner: Viktoria Feller Röchlingstraße 16 73447 Oberkochen Phone: 0176 20987018

Email: info@hellolaser.de
Website: www.hellolaser.de

This policy applies to our website and to the booking system through which you book appointments and manage your customer account.

2. When you visit the website

When our pages are called up, the browser used on your device automatically sends information to the server, which is stored temporarily in a log file:

IP address of the requesting computer
date and time of access
name and URL of the file retrieved
website from which the access is made (referrer URL)
browser used and, where applicable, the operating system of your computer as well as the name of your access provider

The data mentioned are processed by us for the following purposes:

ensuring a smooth connection to the website
ensuring comfortable use of our website
evaluating system security and stability
for further administrative purposes

The legal basis for the data processing is Art. 6 (1) (f) GDPR. Our legitimate interest follows from the purposes listed above.

3. Fonts

We load no fonts, icons or scripts from third-party servers. Our pages use exclusively the system fonts present on your device. As a result your IP address is not transmitted to third parties — unlike with providers such as Google Fonts.

This also applies to the voice consultation (number 12): its program part is on our own server, and we have removed the font request to Google that it originally contained. A connection to a third party arises only when you expressly start the consultation.

The same applies to the map on the contact page: it is only loaded when you click “Load map”. No connection to Google is established before that. When you click, your browser loads the map section from a server of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; in doing so your IP address as well as details about your browser and device are transmitted to Google, and if you are signed in to Google at the time, Google can associate the request with your account. Data may also be transferred to Google LLC in the USA. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR); further details in the Google privacy policy (opens in a new tab). The address is shown as text alongside even without the map — anyone who does not click will still find us.

4. Appointment booking

When you book an appointment we process:

name, email address and telephone number
your form of address
the treatment areas chosen or, for the trial appointment, the desired zone you have stated
date, time and duration of the appointment as well as its status
the price determined and the agreed method of payment
in the case of cancellations or postponements, the time and any reason, so that compliance with the cancellation period can be verified

These data are required in order to perform the treatment contract; without them we cannot allocate an appointment. The legal basis is Art. 6 (1) (b) GDPR.

5. Customer account

You can book appointments as a guest or create a customer account. For the account we process your email address and your password; the password is stored exclusively as a cryptographic hash and is not readable by us. In the account you see your appointments, your packages with the session status, your points account and your consents.

If you first book as a guest and later create an account with the same confirmed email address, we assign your previous bookings to that account so that you can manage your appointments in one place. The legal basis is Art. 6 (1) (b) GDPR.

6. Customer file, packages and payment records

For your care we keep a customer file with form of address, first and last name, email address and telephone number as well as internal notes on the course of treatment. If you have purchased a treatment package, we store the contract with price and number of sessions as well as a session account that records every session used and credited, with date and reason.

If you pay in the studio, we only record that the appointment has been settled — without amount or payment method. The legal basis is Art. 6 (1) (b) GDPR, and for the retention of tax-relevant information Art. 6 (1) (c) GDPR.

If you pay online, the payment is processed by the payment service provider Stripe. We transmit the amount, the description of the item and an internal reference for the transaction. You enter your payment details directly with Stripe — card numbers, bank details or PayPal login data never reach us and are not stored by us.

In return, we receive whether the payment was successful, the amount, the payment method used, a transaction reference and the billing address and email address you entered with Stripe. We add the address to your customer file because an invoice over 250 euros must contain it (§ 14 (4) UStG). The legal basis is Art. 6 (1) (b) GDPR, and for retention Art. 6 (1) (c) GDPR.

7. Confirmations and reminders by email

After a booking you receive a confirmation by email containing the appointment details and a calendar entry. If you pay online, we send you the invoice as a PDF by email once the payment has been received. For dispatch we use the service provider Resend (see number 11). The legal basis is Art. 6 (1) (b) GDPR.

We send appointment reminders only if you have agreed to them. We record your consent and any later withdrawal with time and order, in order to be able to prove the decision currently in force. The legal basis is Art. 6 (1) (a) GDPR; you can withdraw your consent at any time with effect for the future, in your account or informally by email.

8. hello points and referrals

If you take part in the points programme, we keep a points account with all entries, their reason and expiry date, as well as your reward redemptions. If you refer us, we store the link between the referring and the referred person in order to assign the credit. We show the referring person only the initials of the referred person, not their full name. The legal basis is Art. 6 (1) (b) GDPR.

9. Cookies and local storage

We only set cookies for advertising or analytics if you have expressly consented in the cookie notice; more on that below. Without that consent, the only things used are:

Session cookies for signing in. They keep you logged in after you sign in and are set only if you use an account. Without them no protected area is possible.
A cookie for the display (hl-theme), which remembers your choice between the light and dark view.
Local storage in your browser for your selection in the price calculator and for the chosen language of the site (hl-sprache), so that neither is lost when you move between pages. This information does not leave your device.

This storage is necessary for the functions you have requested (§ 25 (2) no. 2 TDDDG); no consent is required for it. You can delete or block cookies in your browser; signing in will then no longer work.

Only with your consent: Google Analytics. On your first visit, a notice at the bottom of the screen asks whether we may use a tool to measure reach. Only if you choose “Accept” does your browser load Google Analytics 4. The service sets cookies, records your page views and bookings and transmits them together with your IP address and details about your browser and device to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also reach Google LLC in the USA; the company is certified under the EU-US Data Privacy Framework. The property is linked to our Google Ads account: a completed booking is reported there as the success of an ad, so that we can see which ad led to an appointment. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. We remember your decision for six months in a cookie named hl-einwilligung. You can change or withdraw it at any time via “Cookie settings” at the bottom of the page; processing carried out until then remains unaffected. If you choose “Decline”, none of this is loaded. You can book either way.

10. Reach measurement

We count how often our pages are opened and at which point of a booking visitors break off. We do this on our own server — no analytics service is involved, and nothing leaves your device in the direction of a third party.

What is stored: the page opened, the step of a booking reached, the address of the page you came from, the time, and a short code for browser and device. We store neither your IP address nor any identifier that makes you recognisable. So as not to count the same visit twice, we form a checksum from IP address and browser identifier that changes daily and from which the original values cannot be recalculated; the original values themselves are not stored.

For this counting we place nothing on your device — no cookie, no identifier in browser storage. Consent under § 25 TDDDG is therefore not required. The legal basis is our legitimate interest in recognising whether our booking process is understandable and where it gets stuck (Art. 6(1)(f) GDPR). The counting data are deleted after twelve months.

You may object to the counting under Art. 21 GDPR; the address is given in section 1. As we do not recognise you, an informal notice suffices — technically, the simplest way to prevent the counting is to block the execution of scripts for this site in your browser.

11. Recipients and processors

We do not sell your data; the advertising and analytics services in section 9 run only with your consent. For operations we use the following service providers as processors under Art. 28 GDPR:

Supabase — database and sign-in management. The data is held in a data centre within the European Union (Ireland region).
Vercel — operation and delivery of the website and the booking system. Delivery takes place via the Frankfurt am Main region; the company is based in the USA.
Resend — dispatch of the confirmation and reminder emails. The company is based in the USA.
Stripe — processing of online payments including card, Apple Pay, Google Pay and PayPal. The contracting party is Stripe Payments Europe, Limited, based in Ireland; the group is based in the USA. Which data is transferred is set out in section 6.
ElevenLabs — voice consultation on this website (number 12). It is loaded only when you start it. The company is based in the USA.

Insofar as data is transferred to the USA, we base the transfer on the standard contractual clauses of the EU Commission or on the respective provider's participation in the EU-US Data Privacy Framework.

Beyond this we transfer your data only if:

you have expressly consented (Art. 6 (1) (a) GDPR),
this is necessary in order to perform a contract with you (Art. 6 (1) (b) GDPR),
there is a legal obligation (Art. 6 (1) (c) GDPR) — for example towards the tax office or our tax advisers, or
the disclosure is necessary to protect legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in the data not being disclosed (Art. 6 (1) (f) GDPR).

12. Voice consultation

At the bottom right you can start a consultation by voice. It is loaded only when you click : as long as you do not confirm the notice, neither is your microphone accessed nor is a connection to a third party established.

If you confirm, ElevenLabs Inc. (USA) conducts the conversation. The following are processed:

your voice input, its transcript and the agent's replies,
your IP address and technical connection data,
characteristics of your device and browser — including screen, graphics and audio properties — which the program evaluates for recognition and abuse prevention.

The legal basis is solely your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). It applies only to the current visit; the next time you call up the page you will be asked again. You can withdraw it at any time by ending the conversation and reloading the page. Number 11 applies to the transfer to the USA. Conversation recordings and transcripts are held at ElevenLabs and are deleted there after the period set in our account.

The agent does not book appointments, has no access to your customer account and receives no data from our customer records. Please do not give it any information about your health — we clarify that in person at the trial appointment. If you do so anyway, this information becomes part of the conversation recording at ElevenLabs.

13. Getting in touch

If you contact us by email or telephone, your details, including the contact data you provide there, are stored with us for the purpose of handling the enquiry and in case of follow-up questions. We do not pass these data on without your consent.

14. Storage period

Server log files are kept only briefly for troubleshooting and attack detection.
Appointment and customer data we store for the duration of the business relationship. After that we delete them, unless a retention obligation stands in the way.
Invoice and payment-related documents we keep for up to ten years under commercial and tax law (§ 147 AO, § 257 HGB).
Consents and their withdrawal we record as evidence for as long as obligations or claims can arise from them.

15. Your rights

You have the right:

to request information about the personal data we hold about you (Art. 15 GDPR),
to request without delay the correction of incorrect data or the completion of the data we hold about you (Art. 16 GDPR),
to request the erasure of the personal data we hold about you (Art. 17 GDPR),
to request the restriction of the processing of your data (Art. 18 GDPR),
to object to the processing of your personal data (Art. 21 GDPR),
to receive your personal data in a structured, commonly used and machine-readable format (right to data portability, Art. 20 GDPR),
to withdraw a consent you have given at any time with effect for the future (Art. 7 (3) GDPR).

To exercise your rights an informal message to the following is sufficient:
Email: info@hellolaser.de

Irrespective of this, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

16. Currency and amendment of this privacy policy

This privacy policy is dated August 2026.

As our services develop further, or because of changed legal or official requirements, it may become necessary to amend it. You will always find the current version at www.hellolaser.de/datenschutz.