SA Aesthetics Logo

Privacy Statement

1. Privacy Overview

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information can be found in the subsequent sections of this privacy statement.

Data Collection on this Website

Data processing on this website is carried out by the website operator. You can find their contact details in the section "Responsible Party".

Data is collected in part by you providing it to us (e.g., via email, phone, or contact request). Other data is automatically collected or with your consent when you visit the website through our IT systems (e.g., technical access data, cookies, consent status).

2. Responsible Party

The responsible party for data processing on this website is:

Themistoklis Stavrakis, Fasanenstraße 74, 10719 Berlin

Phone: +49 30 459 529 00

Email: info@stavrakis-aesthetics.com

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

3. General Information and Mandatory Information

Privacy Policy

We treat your personal data confidentially and in accordance with the legal data protection regulations (especially GDPR and BDSG) as well as this privacy statement.

We would like to point out that data transmission over the Internet (e.g., communication via email) may have security vulnerabilities. Complete protection against access by third parties is not possible.

Storage Duration

Unless a more specific storage duration is stated within this privacy statement, your personal data will remain with us until the purpose of data processing ceases. If you make a legitimate deletion request or withdraw consent, your data will be deleted unless there are legally permissible reasons for further storage (e.g., tax or commercial law retention periods).

Legal Bases

We process personal data depending on the case based on:

  • Art. 6 para. 1 lit. a GDPR (consent),
  • Art. 6 para. 1 lit. b GDPR (Contract / Pre-contractual Measures),
  • Art. 6 para. 1 lit. c GDPR (Legal Obligation),
  • Art. 6 para. 1 lit. f GDPR (Legitimate Interest).

Withdrawal of Your Consent

Many processing operations are carried out only with your explicit consent. You can withdraw your consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to Object (Art. 21 GDPR)

If the processing is based on Art. 6 para. 1 lit. e or f GDPR, you have the right to object to the processing at any time for reasons arising from your particular situation. If personal data is processed for the purpose of direct marketing, you have the right to object to this processing at any time.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work, or the location of the alleged infringement.

Further Rights of Data Subjects

You have the right, within the framework of legal provisions, in particular to:

  • Access (Art. 15 GDPR),
  • Rectification (Art. 16 GDPR),
  • Erasure (Art. 17 GDPR),
  • Restriction of Processing (Art. 18 GDPR),
  • Data Portability (Art. 20 GDPR).

4. Hosting and Technical Provision

Our website is technically provided by the hosting service provider Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The provision is done through a global edge/CDN network (Content Delivery Network). When accessing the website, technical information is automatically collected by the server (e.g., IP address, date/time, requested resource, browser type). This processing is necessary to provide the website securely and stably (Art. 6 para. 1 lit. f GDPR).

We have entered into a Data Processing Agreement (DPA) with Vercel Inc. in accordance with Art. 28 GDPR. Since the service provider is based in the USA, there may be a transfer of personal data to a third country as part of the hosting. The transfer is based on appropriate safeguards, in particular the EU Standard Contractual Clauses (SCC) in accordance with Art. 46 para. 2 lit. c GDPR (Decision of the EU Commission 2021/914). Vercel Inc. is also certified under the EU-U.S. Data Privacy Framework.

5. Cookies and Consent Management

We use cookies and similar technologies. Non-essential technologies (e.g., analytics, maps, YouTube) are only activated after your consent.

Through our cookie banner, you can manage the following categories:

  • Functional (necessary) – always active
  • Analytics (Google Analytics)
  • Maps (Google Maps)
  • YouTube Embeds
  • Instagram Embeds
  • Google Reviews

The legal basis for necessary technologies is Art. 6 para. 1 lit. f GDPR; for all optional categories, Art. 6 para. 1 lit. a GDPR.

Your selection will be stored in a consent cookie so that your preferences can be taken into account during future visits.

6. Analytics Tool: Google Analytics

If you have consented, we use Google Analytics for the statistical analysis of the use of our website.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (possibly data transfer to Google LLC, USA).

Processed data may include:

  • shortened IP address (IP anonymization),
  • device/browser information,
  • usage behavior on the website,
  • page views and interactions.

Legal basis: Your consent (Art. 6 para. 1 lit. a GDPR). You can revoke your consent at any time via the cookie settings.

7. Embedded Content and External Services

Google Maps

Some pages may include map content from Google Maps. This content is only loaded after your consent. When loading, personal data (e.g., IP address, technical usage data) may be transmitted to Google.

Legal basis: Art. 6 para. 1 lit. a GDPR.

YouTube

Some pages may include YouTube videos. These are only loaded after your consent. When loading, personal data may be transmitted to YouTube/Google (e.g., IP address, usage data, cookies).

Legal basis: Art. 6 para. 1 lit. a GDPR.

Google Reviews (Google Business Profile)

On our website, we embed reviews that have been submitted through our Google Business Profile. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When loading this section, a connection to Google's servers is established, which may transmit your IP address and other technical data (e.g., browser type, operating system) to Google. The embedding occurs only after your consent. Legal basis: Art. 6 para. 1 lit. a GDPR.

Instagram

On our homepage, we embed an Instagram feed that automatically displays our latest posts. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta"). This embedding is only loaded after your consent. When loading, a connection to Meta's servers is established, which may transmit your IP address and other technical data (e.g., browser type, operating system) to Meta, regardless of whether you have an Instagram account. Data transfer may also occur to the USA; Meta has submitted to the EU-US Data Privacy Framework. Legal basis: Art. 6 para. 1 lit. a GDPR. More information: https://privacycenter.instagram.com/policy

WhatsApp Contact

On certain pages, we offer you the option to contact us directly via WhatsApp. The provider is WhatsApp Ireland Limited, a subsidiary of Meta Platforms, Inc. When you use this feature, the WhatsApp application or website will open, and the privacy policies of WhatsApp/Meta will apply. The exchange of messages and the data generated (e.g., phone number, message content) will be processed by WhatsApp/Meta, over which we have no control. Legal basis: Art. 6 para. 1 lit. a GDPR (your voluntary decision to use this contact method). Online Appointment Booking (Shore) An external booking tool may be integrated for appointment scheduling (Shore GmbH). When used, the privacy policies of the respective provider also apply. By using it, data may be transmitted directly to the service provider and processed there. Legal basis: Art. 6 para. 1 lit. b GDPR (pre-contractual/contractual fulfillment), possibly Art. 6 para. 1 lit. a GDPR.

Online Appointment Booking (Shore)

An external booking tool may be integrated for appointment scheduling (Shore GmbH). When used, the privacy policies of the respective provider also apply. By using it, data may be transmitted directly to the service provider and processed there.

Legal basis: Art. 6 para. 1 lit. b GDPR (pre-contractual/contractual fulfillment), possibly Art. 6 para. 1 lit. a GDPR.

8. Contact (Email, Phone)

If you contact us via email or phone, we process your information to handle your inquiry as well as for any follow-up questions.

Legal bases:

  • Art. 6 para. 1 lit. b GDPR (contractual/pre-contractual communication),
  • Art. 6 para. 1 lit. f GDPR (legitimate interest in efficient communication),
  • possibly Art. 6 para. 1 lit. a GDPR (in case of voluntarily granted consent).

The data will remain with us until the purpose ceases or you request deletion, unless there are legal retention obligations to the contrary.

9. Recipients and Data Processing

We only share personal data when it is legally permitted, you have consented, or sharing is necessary for contract fulfillment.

With service providers that process data on our behalf, we enter into data processing agreements in accordance with Art. 28 GDPR. Specifically, we currently use the following processors:

Vercel Inc. (Hosting and technical provision) 440 N Barranca Ave #4133, Covina, CA 91723, USA Purpose: Provision and operation of the website via an edge/CDN network; processing technical access data (e.g., IP address, date/time, requested resource, browser type). Legal basis: Art. 6 para. 1 lit. f GDPR. Note on third-country transfer: see section 4 (DPA, EU standard contractual clauses, EU-U.S. Data Privacy Framework).

Prismic SAS (Content Management System / CMS) 9 rue de la Pierre Levée, 75011 Paris, France Purpose: Provision and management of website content. When the page is accessed, content is loaded from our servers from the CMS; typically, no personal data of website visitors is transmitted to Prismic. Legal basis: Art. 6 para. 1 lit. f GDPR (technical operation of the website).

Google Ireland Limited (Analytics, Maps, Embedded Videos) Gordon House, Barrow Street, Dublin 4, Ireland Purpose: Google Analytics, Google Maps, YouTube embeddings, display of Google reviews (each with consent). Legal basis: Art. 6 para. 1 lit. a GDPR (consent); possibly data transfer to Google LLC, USA (see sections 6 and 7 as well as section 10).

Meta Platforms Ireland Limited (Instagram embedding, WhatsApp) 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Purpose: Display of the Instagram feed (with consent); provision of the WhatsApp contact channel (when used). Legal basis: Art. 6 para. 1 lit. a GDPR.

Shore GmbH (Online Appointment Booking) Rosenheimer Str. 141, 81671 Munich, Germany Purpose: Provision of the booking tool for appointment requests/bookings. When used, the data you enter is transmitted directly to Shore and processed there. Legal basis: Art. 6 para. 1 lit. b GDPR (pre-contractual/contractual fulfillment), possibly Art. 6 para. 1 lit. a GDPR.

STRATO AG (Email Dispatch) Pascalstraße 10, 10587 Berlin, Germany Purpose: Sending and delivery of emails in the context of contact inquiries via our domain. Legal basis: Art. 6 para. 1 lit. b GDPR or lit. f GDPR.

If necessary, contracts for data processing in accordance with Art. 28 GDPR will be concluded with these service providers or corresponding contractual conditions (e.g., standard DPA of the provider) will be part of the usage.

10. Data Transfer to Third Countries

If services from providers based outside the EU/EEA are used (e.g., USA), a transfer will only occur based on suitable guarantees (e.g., EU standard contractual clauses) and in compliance with legal requirements.

11. Currency and Changes

We reserve the right to adjust this privacy policy to ensure it always meets current legal requirements or to implement changes to our services.

As of: July 2, 2026