This notice explains how personal data is processed when you visit this website, book an appointment or send an enquiry. You can use the website without consenting to analytics.
Last updated: 17 September 2026
1. Controller and contact
Handkontakt · Denise Diana Hollstein
Alte Gasse 1
86152 Augsburg, Germany
Email: info@handkontakt.de
Telephone: +49 171 9666823
Please contact Denise directly with privacy questions or to exercise your rights.
2. Website hosting and security
Your browser sends information needed to deliver the website, including your IP address, request time and address, data volume, response status, browser and operating system details and, where transmitted, the referring page. This information is used to deliver the website and investigate faults and attacks. The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in secure and reliable operation.
The website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Website data is processed in German data centres for technical delivery. See ALL-INKL.COM privacy information. Technical logs are needed only as long as required for secure operation, troubleshooting or investigating a specific security incident. Information needed for an incident may be retained separately until it has been resolved.
Connections to this website use HTTPS encryption. Images, videos and fonts are served through our own website; they do not load external Google font libraries or YouTube players.
3. Your privacy settings
The banner offers “Essential only” and “Allow analytics”. Your choice is honoured for 180 days using the local browser storage entry handkontakt-consent-v1. It contains your selection, the settings version and an expiry time. This is necessary to respect your decision. The legal basis for necessary access to device storage is section 25(2)(2) TDDDG and, where personal data is involved, Article 6(1)(f) GDPR.
You can change your choice or withdraw analytics consent at any time using “Privacy settings” in the footer. This prevents further Analytics collection and deletes Analytics cookies accessible to this website. Withdrawal does not affect the lawfulness of earlier processing. Your choice applies to the particular browser and website address; deleting browser storage causes the banner to appear again.
4. Online appointments
Appointments are booked using Scinet Booking System on this WordPress website. Denise Hollstein developed this system and the mobile enquiry form herself under scinet studio for use by Handkontakt.
We process your name, email address, any telephone number provided, massage selection, appointment, duration, time zone, language and location. Records also include booking number, status, confirmation times and technical identifiers for managing, rescheduling or cancelling appointments. Online booking is not possible without the fields marked as required.
These details are used to arrange and provide your appointment and send associated confirmations, reminders and change notifications. The legal basis is Article 6(1)(b) GDPR. Records subject to statutory retention are processed under Article 6(1)(c) GDPR. A privacy acknowledgement in the form is not consent to advertising.
Booking data is stored in the website database and accessible to authorised appointment administrators and the technical providers required for operation. To limit abuse, the booking system uses a keyed identifier derived from your IP address, valid for ten minutes. The basis is Article 6(1)(f) GDPR, reflecting the interest in protecting the booking service.
Calendar connections
Connected Google and iCloud calendars are checked for availability. The website displays free times; private calendar contents are not published. New online bookings are entered in the designated Google calendar. This transfers your name, email address, any telephone number provided, massage, appointment, duration and location to Google. The Google connection uses the Scinet connection service. Mobile enquiries do not automatically create such an entry.
The Scinet connection service is also operated by Denise Hollstein under scinet studio and hosted at ALL-INKL.COM. Scinet does not refer to an independent booking platform operator in this context.
The EEA provider of Google services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. iCloud is provided to EEA users by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. See Google privacy information and Apple privacy information. Section 9 addresses possible processing outside the EEA.
Protection against automated bookings
The booking page loads Cloudflare Turnstile, provided by Cloudflare, Inc., USA. It checks IP addresses, browser identifiers, TLS fingerprints and website addresses to distinguish humans from bots. We use it against spam and abuse under Article 6(1)(f) GDPR. Cloudflare processes signals on our behalf to protect the website and as a separate controller to improve bot detection. See the Turnstile notice and Cloudflare privacy policy for further information, including storage and rights. Alternatively, request an appointment by telephone or email.
5. Mobile massage enquiries
The enquiry form requires your name, email address, preferred date and time, duration and location, postcode or hotel. Telephone number and message are optional. Please do not send diagnoses or other health information through the form.
Your details are stored in the protected WordPress administration area to assess and personally arrange your requested appointment. Denise receives an email linking to the enquiry. The form does not create a booking or calendar entry. An appointment requires personal confirmation. Processing is based on Article 6(1)(b) GDPR.
For spam protection, a keyed identifier derived from the IP address is used for one hour. An enquiry identifier prevents duplicate records within 24 hours. These measures are based on Article 6(1)(f) GDPR. The plain IP address is not stored as part of the enquiry; this does not affect technical processing when accessing the website.
6. Email, telephone and WhatsApp
When you contact us, your contact details and message are used to respond and handle necessary follow-up questions. Article 6(1)(b) GDPR applies to enquiries about services or appointments; other correspondence is handled under Article 6(1)(f) GDPR in our legitimate interest in answering your message.
Email hosting is provided by ALL-INKL.COM, identified in section 2. Website notifications are sent through the hosting environment using WordPress email delivery. Addressing information and message contents are processed for delivery and handling your correspondence.
WhatsApp is an optional contact channel. Opening the link or using the service establishes a connection to WhatsApp. WhatsApp processes information including your telephone number, communication and connection data in accordance with its privacy policy for the European region. You can use email or telephone instead.
7. Google Analytics – only with consent
Selecting “Allow analytics” consents to Google Analytics 4, provided by Google Ireland Limited. The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. We use it to understand how content is used and improve the website. The Analytics script is not loaded without consent. Analytics remains disabled on booking and enquiry form pages even with consent.
Analytics may process pseudonymous browser identifiers, page views, device and browser information and approximate location. Our integration sends page addresses without query parameters or fragments and only the origin of the referring page. Google Signals and advertising personalisation are disabled. This integration does not send form details such as names, email addresses or booking information to Analytics.
Cookies such as _ga and _ga_… recognise browsers. Our integration limits their lifetime to 180 days and does not renew it on each visit. Google states that EU IP addresses are used to derive approximate location information but are not logged or stored in Analytics. This does not make the other usage data anonymous.
User and event data have the standard retention period of two months. New activity may restart retention for a user identifier. Expired data is removed through Google’s monthly deletion process. Cookie lifetime and Google’s data retention are separate. Aggregated reports can be excluded from the deletion of individual user and event data.
Consent is optional and not required to visit the website or book. Withdraw it through “Privacy settings” in the footer. Further information: EU data processing, Analytics data retention and Google privacy policy.
8. External links
Instagram, Facebook, X, Joyclub and map services are linked using ordinary links. Merely displaying them does not load embedded social media or map modules. When you open a link, the destination provider’s privacy information applies. If you are logged into that service, the provider may associate your visit with your account.
9. Recipients and international processing
Depending on the functions you use, the hosting, email, calendar, security and analytics providers identified above may receive data. Tax advisers and competent authorities may also receive information where necessary to meet legal obligations. Booking or sending an enquiry does not itself result in disclosure for advertising purposes.
International services, particularly Google, Apple, Cloudflare and WhatsApp, may process data outside the EEA, including in the USA. Providers explain their transfer grounds and safeguards in the linked privacy notices. These may include adequacy decisions under Article 45 GDPR for covered recipients and services, and standard contractual clauses under Article 46 GDPR. Information about safeguards applicable to your data and a copy can be requested at info@handkontakt.de. See also Google’s data transfer frameworks.
10. Retention and deletion
Retention of enquiries and appointments depends on handling your request, providing the appointment, outstanding questions, billing and potential legal claims. We delete completed matters when these purposes cease and no retention obligation applies. Required business and tax documents are subject to the applicable statutory periods; these do not automatically apply to all form data. Limited retention for establishing or defending legal claims may be based on Article 6(1)(f) GDPR.
Deletion of bookings, mobile enquiries, associated emails and calendar entries is handled administratively. Cancellation alone does not delete every record. Deleted data may remain in backups until the backup is replaced in its normal cycle; backups serve recovery following data loss. You can request deletion at info@handkontakt.de. Separate periods for browser storage, abuse protection and Analytics are described above.
11. Your rights
Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction and portability under Articles 15–20 GDPR. You can withdraw consent at any time for future processing.
Objection: Where processing relies on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. Objections to direct marketing do not require such grounds.
You may complain to a supervisory authority, particularly where you live or work or where an alleged infringement occurred. The Bavarian State Office for Data Protection Supervision (BayLDA) supervises private businesses in Bavaria.
Our website services do not involve decisions based solely on automated processing producing legal or similarly significant effects within Article 22 GDPR.