Privacy policy

Protecting your personal data matters to us. We process your data exclusively on the basis of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

In brief

This website sets no cookies and therefore shows no cookie banner. We do count which pages are read — by a method that works without cookies, recognises nobody and builds no profile. Fonts and images come solely from our own server; the only thing loaded from another server is the counting script. The one further exception is the Google map on the contact page — and that is loaded only once you explicitly ask for it with a click.

Controller

Heilmassage Zentrum Schwedenplatz Hafnersteig 10, 1010 Vienna, Austria Phone: +43 660 79 88 888 Email: massagezentrumschwedenplatz@hotmail.com

Access data when you visit this website

When you open this website, the hosting provider processes technically necessary access data in server log files. This typically includes:

• the IP address of the requesting device,
• the date and time of access,
• the page or file requested,
• the browser and operating system used,
• the previously visited page (referrer), where transmitted.

Purpose and legal basis: this processing is necessary in order to deliver the website technically, to ensure its stability and to defend against attacks. The legal basis is our legitimate interest in a secure and functioning web presence (Art. 6(1)(f) GDPR).

Hosting: this website is delivered through Cloudflare Workers, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, represented in the European Union by Cloudflare Germany GmbH, Rosental 7, 80331 Munich. Delivery runs over Cloudflare’s network; requests from Austria are as a rule answered from a location inside the European Union. A transfer of access data to the United States is therefore not excluded. It is based on the European Commission’s Standard Contractual Clauses and on Cloudflare’s certification under the EU–US Data Privacy Framework. Further information is available in Cloudflare’s own privacy statement.

We ourselves have no access to these log files and produce no analyses from them.

Measuring reach

To measure reach we use Cloudflare Web Analytics, a service of the Cloudflare, Inc. named above.

The method works without cookies and without identifiers stored in your browser. Nothing is stored on your device and nothing is read from it. Individual people are not recognised, neither on a return visit nor on another device, and no profile is built.

What is collected: the address called up, the page visited before, browser, operating system and device type, the country of origin, and measurements of loading speed. Your IP address is not stored for the evaluation.

Purpose and legal basis: we want to see which content is needed and whether our pages load quickly enough. The legal basis is our legitimate interest in a website that meets demand and works properly (Art. 6(1)(f) GDPR). As no information is stored on or read from your device, no consent under § 165(3) of the Austrian Telecommunications Act 2021 is required.

Objection: you can object to this measurement at any time by preventing the counting script from loading in your browser, for instance with a content blocker. The website then works exactly as before.

Contacting us

If you contact us by email, telephone or WhatsApp, we process the data you provide (name, contact details, the content of your enquiry) in order to deal with your request.

Legal basis: Art. 6(1)(b) GDPR (steps prior to, or performance of, a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Retention: we keep enquiries for as long as is necessary to deal with them, and beyond that only where statutory retention periods apply.

Note on WhatsApp: if you contact us via WhatsApp, the privacy terms of WhatsApp Ireland Limited apply in addition. We have no influence over their processing. If you would prefer to avoid this, you can reach us at any time by phone or email.

Appointment requests through the form

On our appointment page you can send us the time you would like. For this we ask for your name, email address and phone number, the treatment with its duration, day and time, whether you would like to be treated by a woman or a man, and any further notes you wish to add.

When you send the form, your details pass through Cloudflare (see "Hosting" above) and reach our inbox as an email. Nothing is stored on the website itself.

To fend off large numbers of automatically submitted requests, Cloudflare briefly counts how many requests come from the same IP address when you send the form; more than five in a minute are turned away.

If you write anything about your health under "Anything else", we treat that information as described below under "Treatment data at the practice".

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract).

Retention: we delete the email containing your request at the latest 24 months after the appointment, or, if no appointment is made, 24 months after our last reply.

Booking through Treatwell

For online booking we link to the external booking system operated by Treatwell (Wahanda Ltd.). The link is only followed when you click it — no data is transmitted to Treatwell before that. Once you open the Treatwell page, their privacy terms and their responsibility apply.

The Google map

The contact page first shows a sketch of the way here that we drew ourselves. Nothing is loaded from elsewhere for it. Only when you click “Load the Google map” do we embed the map from Google Maps. That click transmits your IP address and details about your device and browser to Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); onward transfer to Google LLC in the United States cannot be ruled out. Google may set cookies in this context. If you do not click, nothing happens — the sketch on its own is enough to find us.

Legal basis: your consent under Art. 6(1)(a) GDPR, given by that click. You can withdraw it at any time by reloading the page and not pressing the button.

Google's privacy policy: policies.google.com/privacy

Treatment data at the practice

Information you give us in the course of a treatment — about complaints, prior conditions or a doctor’s referral — constitutes health data within the meaning of Art. 9 GDPR. We process it solely for the purposes of treatment and invoicing, treat it confidentially and do not pass it on to third parties unless you expressly instruct us to do so (for example to submit it to your health insurer).

Legal basis: Art. 9(2)(h) GDPR in conjunction with Art. 6(1)(b) GDPR.

No automated decision-making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

Your rights

In relation to your personal data you have the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR)

To exercise any of these rights, an informal message to the email address above is sufficient.

Right to lodge a complaint

If you believe that the processing of your data infringes data protection law, you may lodge a complaint with the supervisory authority:

Austrian Data Protection Authority (Datenschutzbehörde) Barichgasse 40–42, 1030 Vienna dsb.gv.at

Changes to this policy

We update this privacy policy whenever our processing or the legal situation changes. The version published on this page is the one that applies.