Privacy Policy
Last updated: July 28, 2026
Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Leon HardungHuman Design – Dr. LeonAlarichstraße 5350679 KölnPhone: +49-1515-5714280Email: info@masterinaesthetics.de
The most important points at a glance
- Without your consent, we only process connection and security data that is technically necessary to provide the website.
- Statistics, marketing and external media services only load after your explicit consent.
- We use contact form details to process your enquiry and any necessary follow-up questions.
- You can withdraw your consent at any time via the “Cookie settings” link in the footer.
Hosting and server log files
This website runs on a virtual server located in Germany and provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner provides the server infrastructure and processes personal data on our behalf.
When you access the website, the server processes technically necessary connection data. This includes in particular the IP address, date and time, requested address, amount of data transferred, status code, referrer and information about the browser and operating system. Where this information is stored in access logs, we shorten IP addresses. We retain the logs only for as long as necessary to operate the website securely and to prevent or investigate attacks. They are deleted afterwards. If a specific security incident occurs, the affected log data may be retained until the investigation is complete and, where necessary, until any related legal claims have been resolved.
The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in providing the website securely, reliably and without technical errors. We have entered into a data processing agreement with Hetzner under Art. 28 GDPR. As the server used is located in Germany, hosting the website does not involve a transfer of website data to a third country.
Form protection and error logs
To protect the contact form against automated and abusive requests, we limit the number of requests. For this purpose, we store the IP address in the server's memory for no more than 10 minutes. The entry is then removed automatically.
If a technical error occurs, we store the time, requested function, a request identifier, error details and a shortened IP address in an error log. The retention criteria described in the section “Hosting and server log files” apply. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in preventing abuse and resolving technical faults.
Cookies and consent (consent banner)
On your first visit, a consent banner asks for your consent. We store your choice for 12 months in the technically necessary cookie “site_consent”. It contains your choice for each category together with time and version information, but no usage or profile data.
Four categories apply: Necessary (always active), Statistics, Marketing and External Media. All non-necessary categories are disabled by default. Services in these categories only load after your explicit consent.
The consent cookie is necessary to provide the settings you have selected and is covered by § 25 (2) TDDDG. We only use non-essential cookies on the basis of your consent under § 25 (1) TDDDG. The associated data processing is based on Art. 6 (1) (a) GDPR.
You can withdraw or adjust your consent at any time with effect for the future via the “Cookie settings” link in the footer of every page. When you withdraw consent, the website deletes the Google tracking cookies that it can access.
Contact form and getting in touch
If you send us an enquiry via the contact form, we process your name and email address together with any phone number and message you provide voluntarily. Your name and email address are required so that we can identify and answer your enquiry. We cannot process the form without this information. The same applies to enquiries by email or phone.
To deliver form messages, we use our email mailbox provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Our server hands the message to STRATO's mail server over a TLS-encrypted connection, where it is stored in our mailbox. No additional email delivery provider is involved, and sending the message does not entail any transfer to a third country. STRATO processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.
Once we have received your enquiry, you will automatically receive a confirmation email at the address you provided. It sets out the next steps in the admissions process and includes the application form as an attachment. It is sent by the same route.
The legal basis is Art. 6 (1) (b) GDPR where your enquiry concerns the initiation or performance of a contract. In all other cases, Art. 6 (1) (f) GDPR applies. Our legitimate interest lies in handling your enquiry. We generally delete enquiries 6 months after they have been fully resolved. We retain documents relevant to a contract or accounting for longer where statutory retention periods require this.
Google Tag Manager, Analytics and Ads (only after consent)
We use Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager manages the measurement and marketing tags. Each integrated service only loads after you have consented to its assigned Statistics or Marketing category. The tags in the container follow your selection.
Google Analytics processes page views, interactions, approximate location, and browser and device information in particular. The “_ga” cookie and other cookies whose names begin with “_ga_” may be stored for up to 2 years. We set a retention period of 2 months for user and event data in Google Analytics. Google Ads processes click identifiers and conversion events to measure the success of our advertisements.
We also use Google Consent Mode v2. The website does not load Google Tag Manager without your consent. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time through the cookie settings.
Fonts
We use the Montserrat typeface. The font files are stored on our own server and delivered from there. Visiting the website therefore does not establish any connection to Google Fonts or another external server, and no IP address is transferred to third parties.
External media
We currently do not embed any external media. This website contains no map services, videos or other content loaded from third-party servers.
The “External media” category is nevertheless available in the consent banner. Should we embed such content in future, for example a map showing how to find us, it will only load after your explicit consent. In that case this privacy policy will be updated with the relevant provider details beforehand.
Your rights
With regard to your personal data, you have the following rights:
- Access to the data processed (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)
To exercise your rights, an informal message to info@masterinaesthetics.de is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
Status and changes to this privacy policy
We adapt this privacy policy as soon as the services used or the legal situation change. The version published on this page at the relevant time applies. You can find the date of the current version at the top of this page.