Privacy policy
Draft – to be reviewed before publication. The German Datenschutzerklärung is the binding version.
1. Controller
Tivapron Leppich
Bambus Oase – Massage & Wellness
Im Fuhlenbrock 121, 46242 Bottrop, Germany
Phone: 01577 219 14 67
E-mail: bambusoasebottrop@gmail.com
2. Visiting this website
When you open a page the web server processes technically necessary data (IP address, time, requested address, browser identifier) to deliver and secure the site (Art. 6(1)(f) GDPR). Fonts and images are served from this server, not from third parties. The website runs on servers in the EU provided on our behalf by Zabaiherz (processor under Art. 28 GDPR).
3. Menu, prices and opening hours
The massages, prices and opening hours shown on the home page are loaded from our booking system when the page opens. Apart from the technical data under section 2, no personal data is processed for this.
4. Online booking
To book an appointment we process the data you enter (name, phone number, e-mail address, chosen massage, appointment, optionally a preferred therapist and notes) to perform the contract (Art. 6(1)(b) GDPR). The booking system is operated on our behalf by Zabaiherz (processor under Art. 28 GDPR). You receive a confirmation by e-mail with a link to cancel the appointment.
Your contact details stored in your browser
So that you do not have to enter your contact details again next time, the booking form stores first name, last name, phone number and e-mail address in your browser's local storage on your device after a successful booking (zabaiherz.booking.customer). This copy stays on your device; you can delete it at any time in your browser settings.
Rating the booking flow
After a booking you may voluntarily rate with stars how easy the booking was. The rating is used only to improve the booking system.
Notices from the studio
Current notices (e.g. changed opening hours) are shown on the home page in a dialog. Whether you have already seen a dialog is remembered by your browser for the session (sessionStorage) or for one day (localStorage), so it does not appear again.
5. Card payment via Stripe
If you pay online by card, the payment data is processed directly by Stripe Payments Europe, Ltd. (Dublin, Ireland); we never receive full card data. Stripe loads its own scripts in the booking window for this (Art. 6(1)(b) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses. Depending on your device, Stripe's payment field may also offer Google Pay, Apple Pay or Link; to check whether these are available it may load resources from Google or Apple as soon as the payment step is shown. If you choose one of these methods, Google or Apple also process the payment under their own privacy policies. This serves the performance of the contract and is independent of the Google Ads consent (section 7). More: stripe.com/privacy.
6. E-mail after your visit
Where the booking form says so, we send you one e-mail after your appointment asking for a review, with a link to book again (§ 7(3) UWG, Art. 6(1)(f) GDPR). You can object at any time via the unsubscribe link in every e-mail or informally by e-mail to us. The links in this e-mail let us see whether a new booking came through the e-mail; no cookies are set for this.
7. Google Ads conversion measurement (only with consent)
With your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) we use Google Ads by Google Ireland Limited (Dublin, Ireland) to measure whether an ad led to a booking. The Google script loads only after you click "Accept"; it sets cookies (e.g. _gcl_*) and transmits usage data, possibly also to the USA. Without consent nothing is loaded from Google. Your choice is stored in your browser's local storage (zbh_consent), which is technically necessary to respect your decision.
Withdrawal: you can withdraw your consent at any time with effect for the future via the link "Withdraw cookie consent" in the footer of every page. The Google Ads cookies are deleted then.
8. Links to Google Maps, WhatsApp and the voucher shop
Maps, WhatsApp and the voucher shop are only linked, not embedded. Only when you follow a link do the privacy terms of the respective provider apply (Google, Meta, or Zabaiherz for the voucher shop).
9. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority, in North Rhine-Westphalia the Landesbeauftragte für Datenschutz und Informationsfreiheit NRW.
10. Retention
We keep booking data as long as it is needed for the appointment and for statutory retention duties (e.g. tax law).