Privacy policy

This is an English translation of our privacy policy. The German version is the legally binding one: Datenschutzerklärung.

Protecting your personal data matters to us. We process your data only on the basis of the law (General Data Protection Regulation – GDPR, Austrian Data Protection Act – DSG, Telecommunications Act – TKG 2021). This privacy policy explains the most important aspects of how we process data on our website and at our institute.

1. Controller

Vitalite Kosmo e.U. (trading as “Vitalité Esthetics”)
Owner: Yuliya Lapygina
Führichgasse 12, 1010 Vienna, Austria
Phone and WhatsApp: +43 664 5147222
E-mail: contact@vitalitekosmo.com

2. Hosting and server logs

Our website runs on WordPress and is hosted by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, in a data centre in the EU. OVH acts as our processor (Art 28 GDPR).

When you open the website, the server automatically processes the data your browser sends: IP address, date and time of access, the address requested, the page you came from, browser type and operating system. We need this data to deliver the website and to keep it secure and stable, for example to fend off attacks. Without further data sources it does not allow any conclusions about you; we do not combine it with other data and only analyse it if a malfunction or an attack requires it.

Legal basis: legitimate interest in a secure, working website (Art 6(1)(f) GDPR).

3. Cookies and your consent

Cookies are small text files stored by your browser. We set strictly necessary cookies without consent because the website would not work properly without them, for example to store your cookie choice. All other services – analytics, advertising, the chat and embedded videos – only load once you agree in the cookie banner. Your consent is voluntary; you can use our website without it.

The cookie banner is part of our website and runs on our own server; no external provider is involved. We store your choice in the cookie “cookieyes-consent” in your browser (12 months). As proof of your consent, we store on our server (OVH, see section 2) a random consent ID, your choice, the date and time, the page visited and your shortened IP address; we delete this data after three years. You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page; withdrawal applies to the future.

You can also set your browser to notify you when cookies are set or to block cookies; this may limit how well the website works.

The categories in the cookie banner:

• Necessary: stores your cookie choice.
• Functional: live chat by Superchat (section 4 d) and embedded YouTube videos (section 10 a).
• Statistics: Google Analytics, Microsoft Clarity and our first-visit cookie (section 7).
• Advertising: Meta Pixel (section 8).

Google services receive your choice via Google’s “Consent Mode”: as long as you have not agreed, they set no analytics or advertising cookies and send no measurement data.

Legal basis: for necessary cookies § 165(3) TKG 2021 and our legitimate interest in running the website (Art 6(1)(f) GDPR); for all other services your consent (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR); for keeping proof of consent our legal obligation (Art 6(1)(c) in conjunction with Art 7(1) GDPR).

4. Contact, enquiries and booking

a) Phone, e-mail, text message and WhatsApp

If you contact us by phone, e-mail, text message or WhatsApp, we process the data you give us (e.g. name, phone number, e-mail address, desired treatment, preferred appointment) to handle your enquiry, arrange and manage appointments and remind you of them.

If you contact us via WhatsApp, your data (phone number, message content, metadata) is also processed by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, or Meta Platforms under their own terms, possibly also in third countries (USA). By contacting us via WhatsApp you agree to this processing. For sensitive matters we recommend contacting us by e-mail or phone. WhatsApp’s privacy notice applies in addition.

Legal basis: performance of a contract or pre-contractual steps (Art 6(1)(b) GDPR), otherwise our legitimate interest in answering your enquiry and in simple customer communication (Art 6(1)(f) GDPR); for WhatsApp also your consent given by contacting us.

b) Enquiry form with confirmation by e-mail

The enquiry form on our website – for example for the welcome special (10% off your first treatment) or “Request a consultation” – lets you send us your name, e-mail address, phone number and your concern. We store the enquiry in our website, where it is not publicly visible, and receive it by e-mail so that we can contact you and arrange an appointment. We immediately send a confirmation to the e-mail address you entered, stating that your enquiry has arrived, with your concern and our contact details. To prevent spam we check a hidden field and the time taken to fill in the form; no cookies are set for this.

Legal basis: pre-contractual steps at your request (Art 6(1)(b) GDPR) and the consent you give when sending the form (Art 6(1)(a) GDPR). The enquiry is deleted automatically after 6 months.

If you also tick the optional box for skin tips and offers by e-mail, we send your first name, e-mail address, phone number and your concern to our newsletter service Klaviyo (section 9 a) and then send you skin tips and offers by e-mail. The legal basis is your consent (Art 6(1)(a) GDPR, § 174 TKG 2021); you can unsubscribe at any time via the link in every e-mail.

c) Online booking and gift vouchers (Phorest)

You book appointments online through the Phorest booking system and buy gift vouchers in Phorest’s voucher shop. Both open on Phorest pages via links on our website. There we process your details (e.g. name, contact details, chosen treatment and appointment, for vouchers also order and payment data) to manage appointments, send confirmations and reminders and issue vouchers. Online payments – for vouchers and any deposits – are made by card through PhorestPay, Phorest’s payment service. The provider is nDevor Systems Ltd T/A Phorest, 66/67 Great Strand Street, Dublin 1, D01 RW84, Ireland, acting as our processor (Art 28 GDPR).

Legal basis: performance of a contract or pre-contractual steps (Art 6(1)(b) GDPR).

d) Live chat (Superchat)

If you agree to the “Functional” category, we load the Superchat chat window. You can use it to write to us or switch directly to WhatsApp and other messengers. Superchat processes your messages, the contact details you provide and technical data such as your IP address, and may store information in your browser for this purpose. The provider is SuperX GmbH, Prenzlauer Allee 242–247, 10405 Berlin, Germany, acting as our processor (Art 28 GDPR).

Legal basis: your consent to loading the chat window (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR); we answer your message to prepare a contract (Art 6(1)(b) GDPR).

5. Treatment: medical history, records and photos

a) Treatment and health data (medical history)

Before your first laser treatment we use a medical history form to collect information about your health (e.g. pregnancy, medication, skin conditions, allergies) insofar as this is necessary to carry out the treatment safely. We process this health data solely on the basis of your explicit consent (Art 9(2)(a) GDPR), which you give on the form. You can withdraw this consent at any time with effect for the future; without this information, however, a treatment is not possible for safety reasons.

We keep treatment records (treatments carried out, settings used, course of treatment) for quality assurance and to protect legal claims.

Legal basis: consent (Art 9(2)(a) GDPR), legitimate interest in keeping records (Art 6(1)(f) GDPR).

b) Photos

Before-and-after photos are only taken with your separate written consent and only used for the purpose stated in it. They are only published (e.g. on our website or on social media) with your explicit consent, which you can withdraw at any time for the future.

Legal basis: consent (Art 6(1)(a), Art 9(2)(a) GDPR).

c) Payment reminders and debt collection

If a payment is not made (e.g. a cancellation fee under our terms and conditions), we use your name, your contact details (e-mail, phone), the appointment details and the outstanding amount to remind you of the payment by e-mail or WhatsApp. If the payment is still not made after a reminder, we can hand the claim over to a collection agency (Kreditschutzverband von 1870 GmbH) and transfer the data required for this.

Legal basis: performance of a contract (Art 6(1)(b) GDPR) and our legitimate interest in enforcing our claims (Art 6(1)(f) GDPR).

6. Purchases of products and vouchers, beauty subscription

When you order through our website or at the institute, we process your order, delivery and payment data to fulfil the contract and to meet tax and commercial retention obligations. The same applies to treatment packages (blocks) and the beauty subscription. You buy vouchers online in Phorest’s voucher shop and pay by card through PhorestPay (section 4 c).

Legal basis: performance of a contract (Art 6(1)(b) GDPR), legal obligation (Art 6(1)(c) GDPR).

7. Statistics: Google Tag Manager, Google Analytics, Microsoft Clarity and first visit

a) Google Tag Manager

Our website loads Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland. It embeds the services in sections 7 and 8 and only starts them once you have agreed in the cookie banner. Tag Manager itself sets no cookies and analyses nothing; when it loads, however, your IP address is sent to Google, and a transfer to the USA is possible (section 11).

Legal basis: legitimate interest in embedding these services in an orderly way and in technically applying your cookie choice (Art 6(1)(f) GDPR).

b) Google Analytics

If you agree to the “Statistics” category, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland to understand how our website is used and to improve it. It records, for example, the pages you view, time spent, approximate location (country, city), device and browser, clicks on “Book now”, WhatsApp, calls and vouchers, forms sent (without their content) and newsletter sign-ups. Google Analytics does not store full IP addresses. Cookies: “_ga” and “_ga_…” (up to 2 years each). The data is deleted after 14 months at the latest; a transfer to Google LLC in the USA is possible (section 11). Details: policies.google.com/privacy.

Legal basis: your consent (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings”.

c) Microsoft Clarity

If you agree to the “Statistics” category, we also use Microsoft Clarity from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. In heatmaps and recorded sessions, Clarity shows us how visitors use the website – for example where they click and how far they scroll – so that we can find errors and make the site easier to use. Text typed into form fields is masked. Cookies: “_clck” (1 year), “_clsk” (1 day) and Microsoft cookies such as “MUID” (1 year). Microsoft deletes recordings after 30 days and analyses after 9 months; a transfer to Microsoft Corporation in the USA is possible (section 11). Details: Microsoft privacy statement.

Legal basis: your consent (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR).

d) First-visit cookie

If you agree to the “Statistics” category, our website stores in the cookie “nms_ft” (90 days) through which page and which source (e.g. Google search, an ad or Instagram) you first visited us. This information is sent to Google Analytics together with the statistics data (section 7 b), so that we can see which content leads to enquiries and bookings. The cookie is set by our own server; it contains neither your name nor any contact details, and nothing about it is stored on our server.

Legal basis: your consent (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR).

8. Advertising: Meta (Instagram, Facebook)

We advertise our treatments on Instagram and Facebook. If you agree to the “Advertising” category, we measure whether our ads lead to bookings or enquiries and may show you our offers again later (remarketing).

a) Meta Pixel and Conversions API (Instagram, Facebook)

We use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It records pseudonymously which pages you view and whether you, for example, book an appointment, contact us, send the form, subscribe to the newsletter or want to buy a voucher. We use this to measure the effect of our ads on Instagram and Facebook, to build audiences (e.g. visitors to our website or people similar to them) and to show relevant ads. If you are signed in to Instagram or Facebook, Meta may link this data to your account.

If you have consented, we may also send the same events directly from our server to Meta (Conversions API) so that they are counted even with ad blockers or browser restrictions; a shared event ID prevents double counting. Details such as e-mail address or phone number are only sent in encrypted (hashed) form.

Cookies: “_fbp” and “_fbc” (90 days each). We are jointly responsible with Meta for collecting the data on our website and sending it to Meta (Art 26 GDPR); we have concluded an agreement with Meta on this. Meta alone is responsible for any further processing: facebook.com/privacy/policy. A transfer to Meta Platforms, Inc. in the USA is possible (section 11). Your ad preferences: facebook.com/adpreferences.

Legal basis: your consent (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR).

9. Newsletter and marketing messages

a) Newsletter (Klaviyo)

If you subscribe to our newsletter – via a sign-up field on our website or the box in the enquiry form (section 4 b) – we send you offers, promotions, skin tips and news from Vitalité Esthetics by e-mail. We need your e-mail address for this. We send your details directly from our server to Klaviyo as soon as you submit the form. The time and source of your sign-up are stored as proof. We see whether newsletters are opened and links clicked in order to improve them.

We send the newsletter with Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02111, USA, acting as our processor (Art 28 GDPR). Klaviyo is certified under the EU-U.S. Data Privacy Framework; EU standard contractual clauses apply in addition (section 11).

Legal basis: your consent (Art 6(1)(a) GDPR, § 174 TKG 2021). You can unsubscribe free of charge at any time – via the link in every e-mail or by writing to contact@vitalitekosmo.com. You will then receive no more newsletters; we keep a note that you unsubscribed so that it stays that way.

b) Marketing messages to existing customers

If you have booked a treatment with us or bought a product or voucher and gave us your contact details (phone number, e-mail address) in doing so, we use this data for 6 months from your last appointment or purchase to inform you about our own similar services and offers (e.g. reminders for follow-up treatments, promotions, new treatments).

Legal basis: legitimate interest in direct marketing to existing customers (Art 6(1)(f) GDPR, recital 47) in conjunction with § 174(4) TKG 2021.

Right to object: you can object to this use of your contact details free of charge at any time – when you give us your details, in any message you receive or informally by e-mail to contact@vitalitekosmo.com. After an objection you will receive no more marketing messages; your data will then only be used to perform the contract.

Health data is never used for marketing.

c) Marketing messages to prospective customers (consent)

If you give us your details via our contact or booking form and expressly agree to receive marketing information (tick box), we use your contact details (name, e-mail address, phone number) for 6 months from the date of consent to inform you by e-mail, text message or WhatsApp about offers, promotions and services of our institute. After this period we no longer contact you for marketing purposes, unless you have become a customer in the meantime (then section 9 b applies) or have consented again.

Legal basis: your consent (Art 6(1)(a) GDPR).

Consent is voluntary; handling your enquiry or booking does not depend on it. You can withdraw it free of charge at any time with effect for the future – in any message you receive or informally by e-mail to contact@vitalitekosmo.com.

10. Videos, maps, social media and fonts

a) Videos (YouTube)

Videos on our website are hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland). A video only loads once you have agreed to the “Functional” category and click on it – before that there is no connection to YouTube. The player then loads via youtube-nocookie.com; Google receives your IP address and may store information in your browser, and a transfer to the USA is possible (section 11).

Legal basis: your consent (§ 165(3) TKG 2021 in conjunction with Art 6(1)(a) GDPR).

b) Google Maps

Links such as “Get directions” open Google Maps. Data is only sent to Google once you click; from then on Google’s privacy policy applies: policies.google.com/privacy.

c) Social media

We run profiles on social networks (e.g. Instagram). On our website we only link to them; the Instagram images on our home page are stored on our own server, and we do not use social media plugins that send data as soon as the page loads. When you visit our profiles, the privacy terms of the respective provider apply. Where we are jointly responsible with the provider (e.g. page insights), the processing is based on our legitimate interest in public relations (Art 6(1)(f) GDPR).

d) Fonts

The fonts of our website are stored on our own server. No data is sent to font providers such as Google Fonts when they load.

11. Transfers to third countries

Some providers (Google, Meta, Microsoft, Klaviyo) also process data in the USA. For companies certified under the EU-U.S. Data Privacy Framework – which applies to these providers – the European Commission found an adequate level of data protection on 10.07.2023 (Art 45 GDPR). In addition, the providers have concluded EU standard contractual clauses (Art 46(2)(c) GDPR).

12. Recipients of the data

We only pass on your data where this is necessary for the purposes described or required by law. Recipients are the service providers named above – OVH (hosting) and our e-mail provider, Phorest (booking, vouchers and online payments), Superchat (chat), Klaviyo (newsletter), Google, Meta and Microsoft (statistics and advertising, only with consent), our marketing agency (website support and analysis, as a processor) – as well as shipping providers (for product orders), our tax advisers, authorities within the scope of legal obligations and, in case of late payment, a collection agency (Kreditschutzverband von 1870 GmbH, Wagenseilgasse 7, 1120 Vienna) and, where applicable, legal representatives to enforce our claims.

Contracts under Art 28 GDPR are in place with our processors. We do not sell your data.

13. Retention periods

• Appointment and contact data: for the duration of the customer relationship
• Enquiries via the form, e-mail or chat: 6 months, unless they lead to an appointment or contract
• Contact data for marketing: 6 months from the last appointment or purchase (section 9 b) or from consent (section 9 c), no marketing use after that
• Newsletter: until you unsubscribe
• Accounting data (invoices, payments): 7 years under § 132 BAO
• Outstanding claims (e.g. cancellation fees, reminders): until paid, at most 3 years from the due date (limitation period); if handed over to a collection agency, until the proceedings are concluded
• Medical history and treatment records: for the duration of the customer relationship and beyond as long as necessary to protect legal claims (10 years after the last treatment)
• Proof of your cookie consent: 3 years (section 3)
• Statistics: Google Analytics up to 14 months, Microsoft Clarity 30 days (recordings) or 9 months (analyses)
• Cookies: as stated for each service (sections 3, 7 and 8)
• Data based on consent: until consent is withdrawn

After that, the data is deleted or destroyed.

14. Your rights

You have the right of access (Art 15 GDPR), rectification (Art 16), erasure (Art 17), restriction of processing (Art 18), data portability (Art 20) and objection (Art 21). You can withdraw consent at any time with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal – consent to cookies via “Cookie settings” at the bottom of every page.

An informal message is enough to exercise your rights: contact@vitalitekosmo.com

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at

15. No automated decision-making

We do not make automated decisions, including profiling (Art 22 GDPR). For advertising (section 8), Google and Meta analyse your usage pseudonymously to select ads; this has no legal or similarly significant effect on you.

16. Data security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Our website is delivered over an encrypted connection (SSL/TLS).

17. Changes to this privacy policy

We may update this privacy policy if the law or our data processing changes. The version published on this page applies.