Privacy Policy

1. About this policy

This privacy policy explains which personal data we process when you visit our website, contact us, book an appointment or visit our studio as a client, what we use it for and what rights you have.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO). Where the EU General Data Protection Regulation (GDPR) applies in an individual case, we also comply with it.

2. Controller

The controller responsible for processing your data is:

• Sabina’s Nail & Beauty, owner Sabina Dreni
• Bertiswilstrasse 38, 6023 Rothenburg, Switzerland
• Phone and WhatsApp: +41 79 937 64 28

You can reach us at these contact details at any time with questions about data protection or to exercise your rights.

3. Data we process

Depending on how you get in touch with us, we process the following personal data:

• Contact details: name, phone number and, depending on the channel, your WhatsApp, Instagram or TikTok profile.
• Request and appointment details: the treatment you want, your preferred appointment and the content of your message.
• Client details: booked and completed appointments, treatments, your preferences (for example colour, shape or length) and cancellations.
• Health information: allergies, intolerances or the condition of your nails and skin, if you tell us about them for a safe treatment. This is sensitive personal data.
• Payment and accounting data: amount, payment method and receipts.
• Communication data: content and time of your calls and messages by phone, WhatsApp, Instagram or TikTok.
• Photos: pictures of your nails or brows, only with your consent (see section 7).
• Technical data when you visit the website: IP address, date and time, page visited, browser and operating system.

We usually receive this data directly from you. Providing it is voluntary, but without contact details we cannot arrange an appointment with you.

4. Purposes and legal bases

We process your personal data for the following purposes:

• answering your requests and arranging, confirming, rescheduling and cancelling appointments
• carrying out your treatment, including taking allergies and intolerances into account
• invoicing, accounting and complying with statutory retention obligations
• operating the website securely and reliably, and protecting it against abuse and attacks
• publishing photos of our work, only with your consent

Where the GDPR applies, we rely on the following legal bases: steps prior to entering into a contract and performance of the contract with you (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c) GDPR), our legitimate interest in operating the website securely and communicating efficiently (Art. 6(1)(f) GDPR), and your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), for example for health information and photos. You can withdraw your consent at any time with effect for the future.

5. Contact by phone, WhatsApp, Instagram and TikTok

When you contact us by phone, WhatsApp, Instagram or TikTok, we process your details and the content of your message to answer your request and arrange appointments.

For users in Switzerland, WhatsApp is provided by WhatsApp Ireland Limited and Instagram by Meta Platforms Ireland Limited, each with data transfers to Meta Platforms, Inc. in the USA. TikTok is provided by TikTok Technology Limited, Ireland, which also transfers data to countries outside Europe. These providers also process data for their own purposes and under their own responsibility, and their privacy policies apply. If you do not want this, please give us a call.

6. Cookies, analytics and links to other services

This website sets no cookies, uses no analytics or tracking services, shows no advertising and embeds no social media plugins. Fonts are loaded from our own server; there is no connection to Google Fonts.

The links to Instagram, TikTok, WhatsApp and Google Maps are plain links. No data is sent to these providers until you click such a link. From then on, the provider’s privacy policy applies.

7. Photos

We like to show our work on Instagram and on this website. We only publish photos of your nails or brows with your express consent, and without your face or name unless you wish otherwise. You can withdraw your consent at any time, and we will then remove the photo from our channels.

8. Service providers and transfers abroad

We only share personal data where this is necessary for the purposes described, and we never sell data. We use a single service provider to run this website:

• Netlify, Inc., USA: hosting and delivery of the website through a global server network. Technical data such as IP addresses are recorded in server logs.

Authorities only receive data where we are legally obliged to provide it.

As a result, technical data may be transferred to the USA and to other countries where Netlify operates servers, in particular EU and EEA member states. The Swiss Federal Council has recognised these as providing adequate data protection. For the USA, the Federal Council’s adequacy decision on the Swiss-U.S. Data Privacy Framework applies where the provider is certified under it; otherwise, the European Commission’s standard contractual clauses apply, recognised by the Federal Data Protection and Information Commissioner (FDPIC) and with the adjustments required for Switzerland.

9. Retention

We only keep personal data for as long as necessary for the purposes described or as required by law:

• The hosting provider’s server logs: usually a few days.
• Client details and health information: for the duration of our client relationship and no more than 2 years after your last appointment, unless you ask us to delete them sooner.
• Accounting records such as receipts: 10 years (Art. 958f Swiss Code of Obligations).
• Photos: until you withdraw your consent.

10. Data security

We protect your data against loss, misuse and unauthorised access with appropriate technical and organisational measures, including encrypted transmission (HTTPS) and password-protected accounts. However, no one can guarantee absolute security for data transmitted over the internet.

11. Your rights

Under applicable data protection law, you have in particular the right to:

• know whether and which personal data we process about you
• have inaccurate or incomplete data corrected
• have your data erased, unless we are legally required to keep it
• object to processing and, where the GDPR applies, have processing restricted
• receive your data or have it transferred in a common electronic format
• withdraw consent you have given, with effect for the future

To do so, contact us by phone, by WhatsApp or in writing by post to the address above. To make sure nobody else receives your data, we may ask you to prove your identity. We usually reply within 30 days, generally free of charge.

You can also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland: www.edoeb.admin.ch. Where the GDPR applies, you may also complain to a data protection supervisory authority in the EU.

12. No automated decisions

We do not make automated individual decisions and do not carry out profiling.

13. Changes

We update this privacy policy when our services, service providers or legal requirements change. The version published on this website applies.