Erols Hairdesign

1. Controller

Erols Hairdesign

Owner: Erol Onanmis

Pilgersheimer Straße 64

81543 Munich

Germany

Telephone: 089 221099

Email: kontakt@erols.de

2. Hosting and server log data

Our website is hosted by Fritz Managed IT GmbH, Ötterichweg 7, 90411 Nuremberg, Germany. When you access the website, technically necessary log data may be processed. This may include, in particular, your IP address, the date and time of access, the page or file requested, the volume of data transferred, browser type, operating system, referrer URL and access status messages.

Processing is carried out to ensure the secure, stable and error-free provision of the website and to prevent misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website. Log data is deleted as soon as it is no longer needed for these purposes, unless statutory retention obligations apply.

3. Encrypted connection

Our website uses an encrypted HTTPS connection. This protects data you send us against unauthorised interception during transmission.

4. Contact and contact form

If you contact us via our contact form, by email or by telephone, we process the data you provide. For the contact form, this includes in particular your name, email address, telephone number and message. We use this data solely to handle your enquiry and contact you.

If your enquiry concerns an appointment or a potential contract, the legal basis is Article 6(1)(b) GDPR. Other enquiries are processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest is responding to your enquiry. Data is deleted once the enquiry has been fully dealt with, provided no statutory retention requirements or legitimate reasons for further storage apply.

Please do not submit health data or other particularly sensitive personal information in the free-text message field.

5. Appointment booking and management

When you arrange an appointment by telephone, in person or online, we process the information necessary to organise and provide the service. This includes, in particular, your name, contact details, appointment time, selected service, preferred stylist and organisational messages concerning your appointment. Online bookings may also generate technical access data.

We use this data to confirm appointments, process rescheduling and cancellations, and prepare for and provide the booked service. The legal basis is generally Article 6(1)(b) GDPR (contractual and pre-contractual measures). Article 6(1)(f) GDPR may also apply to the security and reliable operation of our appointment management system. Our legitimate interest is secure and orderly appointment management.

If we use service providers for the technical operation of our online booking system, they receive the data necessary for their respective tasks. We regularly review details of such providers and any potential transfers to third countries.

6. Customer records, consultations and treatment documentation

During your salon visit, we may document contact details and information about booked and completed services, consultations, formulations, colour treatments, hair and care preferences and relevant previous appointments in a customer record. This helps us provide the agreed service professionally and in line with your wishes. Where necessary to provide the service, the legal basis is Article 6(1)(b) GDPR.

You are not required to provide additional voluntary information. Please share particularly sensitive information, such as health or allergy details, only to the extent necessary for a safe treatment. Such information is processed only where a specific legal basis exists, in particular your explicit consent under Article 9(2)(a) GDPR where required.

7. Digital check-in card and signatures

When our digital check-in card is used, we may collect your basic details, requested services, consultation notes, recorded declarations and, where applicable, your signature. Depending on their content, the data serves contract performance, documentation of customer preferences or proof of the declaration you have made.

Where a declaration is based on consent, that consent is voluntary and may generally be withdrawn at any time with effect for the future. Necessary appointments or treatments are not generally made conditional on consent to optional advertising or photo publication.

8. Customer photographs – documentation and publication

Before-and-after photographs may be offered as part of a consultation or hair treatment. We explain the purpose and legal basis of internal photographic documentation separately. We use photographs on our website, social media, in advertisements or other public publications only where separate appropriate authorisation exists, usually your expressly given and documented consent (Article 6(1)(a) GDPR).

Consent to publication is voluntary. You may withdraw it at any time with effect for the future. Please note that publications already made, or copies created by third parties on the internet, may not always be fully retrievable or removable.

9. Appointment messages and advertising

We may use the contact details you provide to send necessary information about an appointment, change or cancellation, insofar as this is required to perform the contract. We send promotional messages, such as offers or targeted customer reactivation, only where there is an appropriate legal basis and the applicable rules on electronic advertising are observed. You may withdraw any consent with effect for the future at any time.

10. Cookies and consent

Technically necessary cookies or comparable storage technologies may be used where required to provide a function you have expressly requested. Other services that store or access information on your device are activated only after you have given consent. You may withdraw consent at any time with effect for the future.

11. Google Maps

A Google Maps map is planned for our website. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is intended to load only after you expressly activate it. When it loads, your IP address, device and browser information, usage data and, where applicable, location data may be transferred to Google. If you are signed in to a Google account, Google may associate your use with that account.

The legal basis is your consent under Article 6(1)(a) GDPR. Any storage of or access to information on your device is likewise based on your consent. Transfers of data to countries outside the European Union cannot be ruled out. Further information can be found in Google's privacy policy.

12. External libraries and content

Technical libraries such as Bootstrap and Swiper may be loaded from external servers to provide website presentation and functionality. For technical reasons, your IP address in particular is then transmitted to the respective provider. Wherever possible, we will host these components locally on our own web server to reduce external connections.

13. Recipients of data

Personal data is disclosed only where necessary to provide our services, operate our systems, comply with legal obligations or on the basis of valid consent. Recipients or technical service providers may include hosting, email, appointment management and IT service providers, as well as tax advisers and authorities where required by law. Data processing agreements are concluded with service providers acting on instructions where required. Whether transfers to third countries occur, and which safeguards may apply, depends on the services actually used.

14. Retention periods

We generally store personal data only for as long as necessary for the relevant purpose. Appointment and customer record data is regularly reviewed for continued necessity and deleted or anonymised in accordance with applicable deletion rules, unless another permissible legal basis or retention obligation applies. Records of consent may be kept longer where necessary as evidence. Relevant statutory retention periods apply to documents subject to tax and commercial law. We will explain specific periods and criteria upon request.

15. Your data protection rights

Subject to statutory requirements, you have the following rights in particular:

Access to personal data held about you (Article 15 GDPR),

Rectification of inaccurate data (Article 16 GDPR),

Erasure of your data (Article 17 GDPR),

Restriction of processing (Article 18 GDPR),

Data portability (Article 20 GDPR),

Objection to processing (Article 21 GDPR),

Withdrawal of consent with effect for the future (Article 7(3) GDPR).

To exercise your rights, please contact kontakt@erols.de.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The following authority is particularly responsible for private-sector businesses in Bavaria:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)

Promenade 18

91522 Ansbach

www.lda.bayern.de

17. Obligation to provide data and automated decisions

You are generally not obliged to provide voluntary personal information. However, we need the information required to arrange an appointment and provide the requested service. Without this information, a booking or service may not be possible in some cases. Voluntary information and consent, particularly for promotional photo publication, are separate from this. To the best of our current knowledge, no decision-making based solely on automated processing, including profiling, within the meaning of Article 22 GDPR takes place.

18. Updates to this privacy policy

We update this privacy policy when our website, the services we use or legal requirements change.

Last updated: November 2026