1 Controller
The controller responsible for the processing of personal data in connection with our offers is:
[full company name]
[street / house number]
[postcode / city]
[country]
Email: [privacy / contact email]
Phone: [phone number]
Where a data protection officer or data protection contact person has been designated for our company:
[name / contact or «not applicable»]
2 Purpose of this privacy policy
This privacy policy explains how we collect, process, use, disclose and store personal data.
It applies in particular to our customers, prospective customers, website visitors, shop customers, users of our online booking and persons who communicate with us by telephone, email, SMS, contact form, AI assistant or via other channels.
Individual processing activities described in this privacy policy only take place if we actually use the respective function.
3 Which data we process
Depending on the nature of the relationship, we may in particular process the following data:
— Master and contact data such as surname, first name, address, phone number and email address.
— Customer and account data.
— Appointment, reservation and booking information.
— Information about services used or of interest.
— Order, product, shopping cart, delivery and invoice information.
— Payment and transaction information.
— Communication data from email, SMS, telephone, contact forms or chat.
— Marketing and communication preferences.
— Information about the use of our website, our online shop and digital offers.
— Technical data such as IP address, browser information, device data or log data.
Where necessary and permissible for our specific activities, further information may be processed:
[special industry-specific data, e.g. allergies, health information, treatment information – or «none»]
4 Origin of the data
We primarily receive personal data directly from the data subject.
Data may also arise when a person uses our website, online booking, our shop, a customer account or other digital services.
Where permissible, we may also receive data from publicly accessible sources, contractual partners, payment providers or other third parties.
If data is not collected directly from the data subject, we comply with the applicable duties to inform.
5 Purposes of data processing
We process personal data in particular for the following purposes:
— Initiating and performing customer and contractual relationships.
— Handling enquiries.
— Appointment scheduling and online bookings.
— Performing our services.
— Selling and shipping products.
— Processing orders and payments.
— Customer management and customer service.
— Appointment confirmations and reminders.
— Handling complaints.
— Operating and securing our website and digital systems.
— Statistical analysis and improvement of our offers.
— Marketing and customer communication, where permissible.
— AI-supported assistance for our customer and business processes, where used.
— Compliance with legal and regulatory obligations.
— Enforcement or defence of legal claims.
6 Legal bases and processing principles
We process personal data in compliance with the applicable data protection law.
Depending on the processing, this may take place in particular in connection with the performance of a contract, on the basis of legal obligations, overriding legitimate interests or on the basis of consent.
Where consent is required, it can generally be revoked with effect for the future.
7 Appointments and online bookings
For appointment bookings, we process in particular contact details, the requested service, date, time, where applicable the employee or location, and other information provided by the customer.
We use this data to organise, confirm and carry out the appointment.
8 Appointment reminders
We may use contact details to remind you of an agreed appointment or to inform you of changes.
Such messages may be sent in particular by email or SMS.
9 Online shop and orders
For orders, we process in particular contact, billing, delivery, order and payment information.
The data is used to accept orders, process payments, provide or ship goods and handle customer enquiries.
10 Payment data
Payments may be processed by external payment service providers.
The information required to carry out a transaction may be transmitted directly to the respective payment service provider.
Depending on the payment method, we receive, for example, a payment confirmation, transaction reference or status information.
Payment service providers currently used: [e.g. Stripe / others]
11 Email and SMS
We may use email addresses and phone numbers for communication within the scope of an existing or requested business relationship.
This includes in particular appointment, booking, order, delivery, payment and service information.
Where we additionally use electronic contact details for marketing, we observe the applicable requirements and communication preferences.
12 Newsletter and marketing
If a person has subscribed to our newsletter or other marketing communication or has consented accordingly, we may use the contact details provided for marketing.
Marketing may in particular include information about offers, promotions, services, events or news.
Consent can be revoked at any time.
Unsubscribing or revocation: [email address or unsubscribe procedure]
13 Telephone communication
If a person contacts us by telephone or we contact them within the scope of existing or permissible communication, the phone number, time, duration and information required to handle the request may be processed.
14 AI voice and digital voice assistants
Where we use AI-supported voice assistants, these may be used to receive or conduct telephone calls.
Such an assistant may, for example, answer enquiries, record appointments, provide information, check available appointments, classify enquiries or prepare information for employees.
In such communication, in particular the phone number, conversation content, appointment or customer information and technical connection data may be processed.
Where the specific use requires notice, approval or consent, this is taken into account accordingly.
15 Call recording and transcription
Where telephone calls are recorded, transcribed or summarised, we provide information about this in accordance with the applicable requirements.
Our current setting:
[«Calls are not recorded» / «Calls may be recorded and/or transcribed after prior notice»]
Recordings or transcriptions are only kept for as long as necessary for the respective purpose or required by law.
16 AI engine and intelligent customer support
We may use AI-supported systems to support our employees in customer service, appointment scheduling, capacity management, analysis of existing customer relationships, communication or internal business processes.
In doing so, for example, previous appointments, booking behaviour, purchased products, services used, communication preferences or other available customer data may be evaluated.
Such systems may, for example, generate indications of possible appointment needs, suitable services, available capacity or useful customer contacts.
Such a technical recommendation does not automatically mean that contact for advertising purposes is permissible. Before any marketing communication, the applicable communication and consent requirements are taken into account.
17 Automated decisions
Where we make fully automated decisions that have significant legal or similarly significant effects on a data subject, we observe the applicable statutory information and data subject rights.
Ordinary automated appointment confirmations, reminders, technical sorting or non-binding AI suggestions do not necessarily constitute such a decision.
18 Personalisation
Where permissible, existing data may be used to better tailor content, services or communication to existing customer relationships and interests.
Marketing-related personalisation only takes place within the scope of the respectively permissible purposes and communication preferences.
19 Technical platform xselia®
For our digital business processes, we may use the xselia® Cloud as a technical platform.
Via this platform, in particular customer management, bookings, shop, communication, marketing, AI functions and other business processes may be technically provided.
P/Card International AG or the technical service providers used for xselia® may process personal data within the scope of the technical provision and in accordance with the respective contractual and data protection roles.
20 Other processors and recipients
We may use external service providers where this is necessary or expedient for providing our services.
These may in particular include providers from the following areas:
— Hosting and cloud infrastructure.
— Payment processing.
— Email and SMS delivery.
— Telephony and AI voice.
— IT and software services.
— Analytics and statistics.
— Marketing services.
— Shipping and logistics.
— Accounting and administration.
— Consultants and professional service providers.
— Authorities or other recipients, where there is a legal obligation.
Further customer-specific recipients: [other service providers / categories or «none»]
21 Data transfer abroad
When using certain service providers, personal data may also be processed outside Switzerland.
In such cases, we observe the applicable legal requirements for international data transfers and, where necessary, take appropriate safeguards.
The specific providers and processing locations used may change depending on the functions used.
Special customer-specific transfers abroad: [countries / providers, if additionally applicable]
22 Storage and retention
We only store personal data for as long as necessary for the respective purposes or as long as statutory or contractual retention obligations exist.
Business and accounting-relevant information may in particular be stored in accordance with statutory retention periods.
Specific customer-side retention rules: [if special periods apply / otherwise «no additional rules»]
23 Data security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or unlawful alteration.
However, absolute protection cannot be guaranteed for electronic data transmission or storage.
24 Website and server logs
When visiting our website, technically required information may be processed.
This may in particular include the IP address, time of access, page accessed, browser, operating system, device data and technical log information.
This information may be used in particular to provide, stabilise and secure the website.
25 Cookies
Our website may use cookies and similar technologies.
Further information can be found in our Cookie Policy.
26 Social media
Where we operate profiles or content on social media platforms or integrate such services into our website, data may also be processed by the respective platform operators.
The privacy policies of the respective platform additionally apply to the processing that takes place there.
Social media services used by us: [Instagram / Facebook / LinkedIn / TikTok / others / none]
27 Rights of data subjects
Within the scope of the applicable data protection law, data subjects may in particular request information about the personal data concerning them.
Depending on the requirements, they may also in particular request the rectification, erasure or release of certain data as well as other rights provided for by law.
Requests can be addressed to: [privacy email]
28 Revocation of consent
Where data processing is based on consent, it can generally be revoked at any time with effect for the future.
The lawfulness of processing already carried out is not retroactively affected.
29 Complaints
Data subjects can first contact us directly with questions or complaints.
Where the statutory requirements are met, they may also contact the competent data protection supervisory authority.
30 Changes
We may amend this privacy policy if our data processing, technologies used, services or legal requirements change.
The currently published version applies.
31 Version
Version: [month / year]