Privacy policy.
Information about the processing of personal data at Enkleana Aesthetics.
Preamble
Last updated: September 2026
This privacy policy explains which personal data we process when you use our website, contact us or use our online services, the purposes of such processing and the legal bases on which it is carried out.
Personal data means any information relating to an identified or identifiable natural person.
This privacy policy applies in particular to our website, the contact options offered through it and links to external online presences.
Controller
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
Enkleana Kuliqi
Enkleana Aesthetics
Bahnhofstraße 2
64859 Eppertshausen
Germany
Email:
kontakt@enkleana-aesthetics.de
Phone:
0162 / 9819498
Overview of processing activities
The following categories of personal data may in particular be processed in connection with our website and contact options:
- Master data, in particular name
- Contact details, in particular phone number and email address
- Appointment and enquiry data
- Communication and content data
- Contract and service data
- Usage data
- IP addresses
- Technical communication, metadata and log data
Data subjects may in particular include visitors to our website, prospective customers, customers and communication partners.
Processing is carried out in particular to provide and secure our website, handle contact and appointment enquiries, communicate with prospective customers and customers, initiate and perform our business services and present our company and services.
Applicable legal bases
We process personal data exclusively in accordance with applicable data protection law.
Depending on the processing activity, the following legal bases may apply in particular:
- Art. 6(1)(a) GDPR – consent
- Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures
- Art. 6(1)(c) GDPR – compliance with legal obligations
- Art. 6(1)(f) GDPR – legitimate interests
The relevant national data protection provisions of the Federal Republic of Germany also apply.
Security measures
Taking into account the state of the art, the scope and purposes of processing and the relevant risks, we implement appropriate technical and organisational measures to protect personal data.
These measures are intended in particular to protect personal data against loss, manipulation, unauthorised access and other unlawful processing.
For security reasons and to protect the transmission of confidential content, our website uses SSL/TLS encryption. An encrypted connection can be recognised in particular by the internet address beginning with “https://”.
Provision of the website
When our website is accessed, technically necessary data is processed so that the website's content can be transmitted to the user's device and the security and functionality of the website can be ensured.
This may include the IP address, date and time of access, pages and files accessed, browser type and version, operating system used, referrer URL and technical connection and log data.
Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in providing a secure, stable and functional online service.
Web hosting by IONOS
This website is hosted by the following provider:
IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany
When our website is accessed, IONOS may process technically necessary data, in particular IP addresses, access times, pages and files accessed, browser and device information and technical log data.
Processing takes place for the purpose of providing this website securely, reliably and functionally on the basis of Art. 6(1)(f) GDPR.
Where IONOS processes personal data on our behalf, this is done in accordance with the requirements for processing on behalf of a controller under Art. 28 GDPR.
Further information about the processing of personal data by IONOS is available at:
IONOS privacy information
Fonts
The “Italiana” and “DM Sans” fonts used on this website are hosted locally on our server.
No connection to Google Fonts or any other external font provider is established when the fonts are loaded.
Cookies and similar technologies
Our website currently does not use analytics or marketing services such as Google Analytics, Meta Pixel or comparable tracking technologies.
When the contact page is accessed, a technically necessary session cookie named PHPSESSID is set.
This session cookie is required for the secure technical provision of the contact form. It is used in particular to assign a CSRF security token and temporarily manage form status, error messages and any form data previously entered.
The cookie is configured as a session cookie and is not used for analytics, tracking or marketing purposes. It is technically configured with the Secure, HttpOnly and SameSite=Lax security attributes.
Where storing information on the device is strictly necessary for the expressly requested use of the contact form, this is based on Section 25(2) no. 2 TDDDG. The related processing of personal data is based on Art. 6(1)(b) GDPR where the enquiry concerns the initiation or performance of a service, and on Art. 6(1)(f) GDPR for other enquiries.
If analytics, tracking, marketing or comparable technologies requiring consent are used in the future, they will only be used after the necessary consent has been obtained and this privacy policy will be updated accordingly.
Contact and enquiry management
Enkleana Aesthetics can be contacted in particular through the website contact form, by phone, by email and via WhatsApp Business.
When you contact us, we process the information you provide. This may include your name, phone number, email address, message content and information about the requested appointment or service.
Where the contact concerns the initiation or performance of a service, processing is carried out in particular on the basis of Art. 6(1)(b) GDPR.
For other enquiries, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in properly handling and responding to incoming enquiries.
Contact form
A contact form is available on our website for appointment and other enquiries.
The following information may in particular be processed through the form: name, email address, phone number, requested treatment or service and the content of the message.
A CSRF security token is used to protect the form technically. A honeypot field is also used to protect against automated spam submissions. No external CAPTCHA service is used for this purpose.
Form status, error messages and any form data previously entered may be stored temporarily within the technically necessary PHP session.
The information submitted through the form is forwarded to our business email address for the purpose of processing the relevant enquiry.
The contact form application code does not additionally store the IP address or user agent for the purpose of processing the enquiry. This does not affect the technically necessary processing of connection data as part of web hosting.
For enquiries concerning the initiation or performance of a service, processing is based on Art. 6(1)(b) GDPR. For other enquiries, processing is based on Art. 6(1)(f) GDPR.
Communication via WhatsApp Business
WhatsApp Business can be used to contact us and arrange appointments.
Users can be redirected to WhatsApp through links and buttons on our website. WhatsApp is only opened when such a link is clicked.
The provider for users in the European region is:
WhatsApp Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
When contacting us via WhatsApp, the phone number, profile name, communication content and communication and metadata may in particular be processed.
Contact via WhatsApp is voluntary. The other contact options listed on our website are available as alternatives.
Where the communication concerns the initiation or performance of a service, our processing is based in particular on Art. 6(1)(b) GDPR. For other enquiries, processing is based on Art. 6(1)(f) GDPR.
When WhatsApp is used, WhatsApp also processes data independently. Further information is available at:
WhatsApp privacy policy
Where possible, please do not send sensitive health information via WhatsApp that is not required to arrange an appointment. Health and medical history data is collected separately in connection with a treatment.
Business services
Enkleana Aesthetics provides cosmetic and aesthetic services.
Personal data of prospective customers and customers may be processed to initiate, schedule and perform our services.
This may include the name, contact details, appointment information, details of the requested service and related communications.
Processing is carried out in particular to take pre-contractual measures and perform the relevant contract on the basis of Art. 6(1)(b) GDPR.
Where processing is required to comply with legal obligations, it may additionally be based on Art. 6(1)(c) GDPR.
Customers receive separate privacy information for personal data, in particular health and medical history data, that is only collected during a treatment in the studio.
Social media presences
Enkleana Aesthetics maintains business presences on social networks to present the company and its services and communicate with prospective customers and customers.
Our website only contains links to our social media profiles. Social media posts, videos and comparable content are not embedded directly in our website.
The external platform is only opened when the relevant link is clicked. When the platform is used, data is processed by the respective platform operator in accordance with that operator's privacy policy.
Enkleana Aesthetics maintains an account under the username @enkleana.aesthetics as a business presence on Instagram.
The following entity is primarily responsible for users in the European region:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
Instagram is used in particular to present our company and services and for communication and public relations.
When our Instagram profile is visited, Meta processes personal data in accordance with its own privacy policy.
Our website only contains a link to our Instagram profile. Instagram content is not embedded directly in our website.
Our Instagram profile is available at:
instagram.com/enkleana.aesthetics
Further information is available in Meta's privacy policy:
Meta privacy policy
TikTok
Enkleana Aesthetics maintains an account under the username @enkleana as a business presence on TikTok.
The following entity is primarily responsible for processing in connection with the TikTok platform for users in the European Economic Area:
TikTok Technology Limited
The Sorting Office
Ropemaker Place
Dublin 2
D02 HD23
Ireland
TikTok is used in particular to present our company and services and for public relations.
When our TikTok profile is visited, TikTok processes personal data in accordance with its own privacy policy.
Our website only contains a link to our TikTok profile. TikTok content is not embedded directly in our website.
Our TikTok profile is available at:
tiktok.com/@enkleana
Further information is available in TikTok's privacy policy:
TikTok privacy policy
General information about data storage and deletion
As a general rule, we only store personal data for as long as is necessary for the relevant processing purpose.
When the processing purpose no longer applies, the data concerned is deleted unless statutory retention, documentation or evidence obligations or other legal grounds prevent deletion.
Where statutory retention periods apply, the data concerned is retained for the relevant period and then deleted unless another legal basis for storage applies.
Recipients of personal data
Personal data is only transferred to external parties where a data protection law basis exists for doing so.
These may in particular include hosting and IT service providers required to operate our website and the communication and platform providers named in this privacy policy.
As part of statutory accounting, tax, documentation and retention obligations, tax-relevant personal data may also be transferred to tax advisers, tax authorities or other authorised bodies.
Where an external service provider processes personal data on our behalf, the statutory requirements governing processing on behalf of a controller are observed.
International data transfers
When certain external services are used, personal data may be processed outside the European Union or European Economic Area.
Such a transfer is carried out in compliance with the statutory requirements of Art. 44 et seq. GDPR. Depending on the recipient and third country, an adequacy decision by the European Commission or appropriate safeguards for the transfer may apply in particular.
Further information about international data transfers can be found in the privacy information of the respective providers.
Requirement to provide personal data
As a general rule, there is no statutory or contractual obligation to provide personal data.
However, certain information, in particular a name and suitable contact details, may be required to process an enquiry, arrange an appointment or conclude and perform a contract.
Without this information, the relevant enquiry or service may not be processed or performed.
Automated decision-making
No solely automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.
Rights of data subjects
Subject to the statutory requirements, data subjects have the following rights in particular:
- Right of access under Art. 15 GDPR
- Right to rectification under Art. 16 GDPR
- Right to erasure under Art. 17 GDPR
- Right to restriction of processing under Art. 18 GDPR
- Right to data portability under Art. 20 GDPR
- Right to object under Art. 21 GDPR
- Right to withdraw consent under Art. 7(3) GDPR
Consent may be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
Right to lodge a complaint with a supervisory authority
Under Art. 77 GDPR, data subjects have the right to lodge a complaint with a data protection supervisory authority if they believe that the processing of their personal data infringes data protection law.
The following supervisory authority is particularly relevant for the registered location of Enkleana Aesthetics in Hesse:
The Hessian Commissioner for Data Protection and Freedom of Information
Wilhelmstraße 7
65185 Wiesbaden
Germany
Email:
poststelle@datenschutz.hessen.de
Changes and updates
We update this privacy policy where necessary due to changes in our data processing, the technical design of our website, the service providers used or legal requirements.
The current version published on our website applies.