V | NVanilla Nails
DE Book now
V | N
Legal

Privacy Policy

Last updated: 14 September 2026

Controller

General information

Protecting your personal data matters to us. We process data solely on the basis of applicable law (GDPR, Austrian DSG, TKG 2021). This notice describes what actually happens on the website vanillanails.at and when you call the studio.

Visiting the website

Visiting a page automatically produces technical connection data (e.g. IP address, time, the address requested), the kind any web server needs for secure delivery. We also anonymously count page views and a handful of clicks (e.g. "book an appointment") — with no name, no IP address and no identifier, so we cannot recognise you as an individual visitor. Purpose: operating, securing and improving the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest); no consent is required for the anonymous visit count, because no personal data results from it.

Appointment booking

If you request or book an appointment through the website, we process the details needed for that — in particular your name, phone number and preferred time — to fulfil the treatment contract. Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual measures).

If you book through the website, we record on the appointment the campaign details from the address (e.g. “utm_source”), the website that brought you to the booking page and the page you entered on. For this we only read the page address; without your consent nothing is stored in your browser, and the click identifier of an ad is left out. The details serve only our own evaluation of which advertising leads to appointments and are not passed on. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in cost-effective advertising). The details stay with the appointment for as long as we keep the appointment itself. You can object to this processing at any time (Art. 21 GDPR) — a message to hello@vanillanails.at is enough.

If you call the studio instead, the following also applies. Calling us

Parental consent

If a booked treatment requires the consent of a parent or guardian because the customer is a minor, we additionally record the name and phone number of that parent or guardian, solely to be able to prove this consent. We send an SMS with a confirmation link to that phone number, through which consent is given; for this we use our SMS provider Twilio. We store these details only with the individual appointment, not in your customer account. If you have your customer account deleted, we delete them along with it; otherwise they remain stored for as long as we keep the appointment itself for tax purposes. Legal basis: Art. 6(1)(b) and (f) GDPR (performance of the contract and legitimate interest in being able to prove consent).

Contact form

If you write to us through the form on the contact page, we process your name, your e-mail address and the text of your message in order to answer your enquiry. The message goes to our mailbox hello@vanillanails.at and from there into the inbox of our own app, where our team reads and answers it. Legal basis: Art. 6(1)(b) GDPR where the enquiry concerns an appointment or a treatment (pre-contractual measure), otherwise Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry). If a team member cannot read the language of a message, we have the text automatically translated in our inbox (Google Cloud Translation, processed in the EU); the same applies to SMS and WhatsApp messages and job applications.

To keep the form from being abused by machines, we count how many messages come from one IP address. That counter serves only to prevent abuse (Art. 6(1)(f) GDPR), not to recognise you, and it is deleted automatically after three days at the latest. For how long we keep your message, see "Retention period" below.

WhatsApp button

At the bottom right, in the menu and in the footer of every page you will find a WhatsApp button. It is a plain link (wa.me): as long as you do not tap it, nothing is sent to WhatsApp. If you tap it, WhatsApp opens with a prepared greeting; technical data such as your IP address then goes to WhatsApp Ireland Limited (Meta). WhatsApp's own privacy notice applies to your use of WhatsApp itself.

If you write to us, your message reaches the inbox of our own app through our provider Twilio, where our team reads and answers it. Legal basis: Art. 6(1)(b) GDPR where it concerns an appointment or a treatment, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry). For how long we keep it, see "Retention period" below.

Job applications

If you apply through the form on the jobs page, we process your name, your e-mail address, your phone number if you give it, and your text — solely in order to deal with your application. If you send us documents by e-mail later, the same applies to those. Legal basis: § 4(1) of the Austrian Data Protection Act together with Art. 6(1)(b) GDPR (pre-contractual measure).

Your application is sent as an e-mail to our mailbox hello@vanillanails.at and from there into the inbox of our own app. We do not file it anywhere else. If it does not lead to a job, we delete the application at the latest seven months after the rejection — that period follows from possible claims under the Equal Treatment Act. If you would like us to keep your documents for future openings, just tell us; if you would like them deleted sooner, a message to hello@vanillanails.at is enough.

Partnership enquiries

If you ask about a place with us through the form on the “Partnership” page, we process your name, your e-mail address, your phone number if you give it, your answers on place, trade licence and own clients, and your text — solely in order to answer your enquiry and prepare a possible partnership. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measure). The enquiry takes the same route as an application: as an e-mail to hello@vanillanails.at and from there into the inbox of our app. If no partnership comes about, we delete it no later than seven months after our reply; a message to hello@vanillanails.at is enough to have it deleted sooner.

Course enquiries

If you ask about a course through the form on the course page, we process your name, your e-mail address, your phone number if you give it, your answers on prior knowledge and course language, and your text — solely in order to answer your enquiry and arrange the course. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measure). The enquiry is sent as an e-mail to hello@vanillanails.at and from there into the inbox of our app. If no course comes about, we delete it no later than seven months after our reply; a message to hello@vanillanails.at is enough to have it deleted sooner.

Reviews and the map (Google)

Star ratings and opening hours are displayed from our public Google Business Profile; no data about you as a visitor is sent to Google for this. The map on the contact page only loads once you actively click it — only then is data (including your IP address) sent to Google. Legal basis for the map: Art. 6(1)(a) GDPR (your consent, given by clicking).

Analytics (Google Analytics 4, Microsoft Clarity)

On your first visit we ask whether we may analyse how the site is used. Only after your explicit yes do we load Google Analytics 4 (Google Ireland Limited) and Microsoft Clarity (Microsoft Ireland Operations Limited); before that, none of it is loaded and no cookie of these services is set. What is processed: a shortened IP address, device and browser, the pages you open and how long you stay, and — with Clarity — mouse movement, clicks and scrolling as a pseudonymised recording of how the page was used. The legal basis is your consent (Art. 6(1)(a) GDPR); this may involve a transfer to the USA, covered by the Standard Contractual Clauses and the EU-US Data Privacy Framework. You can withdraw your consent at any time, with effect for the future, via “Cookie settings” in the footer of every page.

Ad measurement (Google Ads)

We advertise with ads on Google. To learn whether an ad led to an appointment, we ask for your consent — in the notice on your first visit (“Ad measurement”) or, if you came through an ad and have not chosen anything there, with a separate, voluntary tick box when booking. You can book with or without consent.

With your consent we remember in your browser which ad or campaign you came through (the ad’s click identifier, campaign details, first page, referring website): the click identifier for at most 90 days, the other details for at most 30 days. If you book an appointment, we record these details on the appointment and may tell Google Ireland Limited that a booking took place — with the value of the appointment and your phone number in hashed form (SHA-256). This is not anonymous: Google matches this hash against its own data to determine whether the booking goes back to an ad; Google does not receive your phone number in plain text from us. If the appointment is attended, cancelled or missed, we may report that afterwards as well. For ad measurement itself we load no Google script in your browser. If you have also consented to analytics, Google Analytics loads and may set its own advertising cookies.

The legal basis is your consent (Art. 6(1)(a) GDPR). Google processes the hashed phone number and the appointment value as our processor (Google Ads Data Processing Terms); for evaluating the click identifier within Google Ads, Google is also responsible in its own right; a transfer to the USA is possible, covered by the Standard Contractual Clauses and the EU-US Data Privacy Framework. We delete the click identifier on the appointment no later than 100 days after booking. You can withdraw your consent at any time, with effect for the future, via “Cookie settings” in the footer of every page; the details remembered in your browser are deleted at the same time. If you consented with the tick box when booking, a message to hello@vanillanails.at is enough to withdraw it.

Recipients

Depending on how you contact us, we share data with the following processors or providers:

Retention period

We keep personal data only for as long as needed for its purpose, or until you ask us to delete it — unless a statutory retention obligation says otherwise. Purely technical connection data is deleted automatically after a short time.

Your rights

Just get in touch at hello@vanillanails.at.

Right to complain

If you believe the processing of your data breaches data-protection law, you can lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna). dsb.gv.at