Privacy

This website has no user accounts and no advertising, and we do not create user profiles. To measure reach we use privacy-friendly analytics services (see sections 3 and 4). In line with the Swiss Federal Act on Data Protection (FADP), this policy explains which personal data is processed when you visit, why we process it, and what rights you have.

1. Controller

For data protection matters, reach us at these contact details. We have not appointed a data protection adviser under Art. 10 FADP; there is no obligation for us to do so.

2. Hosting and connection data

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit, Vercel processes technically necessary connection data: IP address, date and time of access, page requested, amount of data transferred, browser type and operating system. This processing is required for secure and stable operation (overriding interest in running the website).

Disclosure abroad: the website is delivered via Vercel's European network nodes; server-side processing (redirect to the booking system, SMS confirmation) takes place in Frankfurt, Germany. Vercel stores operating logs and the anonymous visit statistics (section 3) in the USA. Vercel is certified under the Swiss-U.S. Data Privacy Framework, which the Federal Council has recognised as providing an adequate level of data protection (Art. 16 para. 1 FADP). Vercel retains connection data only briefly for operation and security.

3. Web analytics

To understand how our website is used, we use Vercel Web Analytics, a service of the Vercel Inc. named above. It records page views, referrer, approximate location (country), browser, operating system and device type. No cookies are set and no data is stored in your browser. Your IP address is not stored; it is only used together with the browser to form a short-lived, anonymous identifier that expires after 24 hours at the latest. Individual persons are not identified and there is no tracking across other websites.

In addition, Vercel Speed Insights, also a service of Vercel Inc., measures how fast our pages load for you (so-called Web Vitals: loading time, responsiveness, layout stability). Only these measurements, the page visited, device type and connection type are transmitted – without cookies, without storing your IP address and without any personal identifier. The data is used solely to assess and improve the technical quality of the website.

The legal basis is our overriding interest in assessing the reach and functioning of the website. Section 2 applies to the transfer abroad.

In addition we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies (section 4) that recognise returning visits and evaluates page views, time on site, referrer, approximate location and device and browser details. Google truncates the IP address before storage and does not log it. We have disabled Google signals and personalised advertising; no data is merged with your Google account. Google also processes the data in the USA; Google LLC is certified under the Swiss-U.S. Data Privacy Framework. If your browser sends the "Do Not Track" signal, Google Analytics is not loaded. Data is deleted after 14 months. More information: policies.google.com/privacy.

4. Cookies and local storage

This website sets two kinds of cookies: the technically necessary confirmation cookie described in section 8, and the Google Analytics cookies (section 3, names beginning with "_ga", lifetime up to 13 months) that recognise returning visits. We set no marketing or advertising cookies. You can delete or block cookies in your browser at any time; the website works without them.

We store a single setting in your browser's local storage: your language choice, if you have made it via the language selector in the page header. This value contains no personal data, is not transmitted to us or to third parties, and can be deleted at any time via your browser settings.

5. Fonts

The fonts used are served directly from our server. No connection is made to Google Fonts or other external font providers.

6. Google Maps on the contact page

On the contact page we embed a Google Maps map. It loads automatically when the contact page is opened; no click on your part is required. Your IP address is transmitted to Google, and Google may use cookies or similar technologies. The purpose is to display our location and provide directions.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Disclosure abroad: Google also transfers data to Google LLC in the USA. Google LLC is certified under the Swiss-U.S. Data Privacy Framework. Further information: Google's privacy policy.

If you wish to avoid this transfer, do not open the contact page. Our address, phone number and all contact options are also shown in the footer of every other page.

7. Contact form

On the contact page we offer a form. The data entered there (name, email address, phone number and an optional message) is processed solely to answer your enquiry and for any follow-up questions. The basis is your enquiry itself; we need the fields marked with an asterisk to be able to reply to you.

For delivery we use the Web3Forms service. Only when you click "Send" are the form data and your IP address transmitted to this service, which converts them into an email and forwards it to us. The transfer is encrypted. Web3Forms does not store enquiries permanently. Disclosure abroad: Web3Forms processes data in the USA; data protection is ensured by contractual safeguards (Art. 16 para. 2 let. d FADP). Merely opening the contact page transmits no data to the service.

Enquiries reach us as email at info@elegance-hairandmore.ch. Our email service is operated by Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil-Jona, Switzerland; the data therefore remains in Switzerland. We keep enquiries for as long as needed to handle them and any follow-up questions, but no longer than 12 months after the enquiry is closed.

8. SMS confirmation before booking

To prevent false bookings, before you first open the appointment booking we ask once for your mobile number and send you a six-digit confirmation code by SMS. The number is used solely to send and verify this code, is held only for as long as the code is valid and is not linked to your booking. The code is valid for ten minutes.

For sending we use the ASPSMS service of VADIAN.NET AG, Katharinengasse 10, 9000 St. Gallen – a Swiss telecommunications provider registered with OFCOM. The number is transmitted to this service for that purpose; processing takes place in Switzerland.

After successful confirmation we set a cookie that marks this device as confirmed for 90 days, so you are not asked again at every booking. The cookie contains no personal data and no phone number, only an expiry date with a signature. It is technically necessary for this function and can be deleted at any time via your browser settings. To prevent abuse we temporarily count requests per number and IP address; these counters are deleted within 48 hours at the latest.

9. Appointment booking via Klara

For online appointment booking we link to the external booking system Klara, operated by ePost Service AG, Wilhelmshöhe 1, 6003 Lucerne. When you click "Book appointment" you leave this website. Klara's privacy policy applies to data processing on the booking platform; we process the booking data in our salon to fulfil the appointment.

Protection against misuse: We have repeatedly been affected by fake bookings. We therefore keep our own access log: for every page view, as well as when "Book appointment" is clicked and when an SMS code is requested or checked, we store the time, IP address, the approximate location derived from it (country, region, town, postal code and coordinates of the network node, not of your device), network operator, technical browser and connection characteristics (browser type, operating system, browser language, transmitted request headers), the page visited and the previously visited page, the interaction steps in the booking dialog (opening, submitting – only the number of digits, not the number itself –, closing, leaving the page, chosen alternative routes, technical error messages of the browser) together with device characteristics (time zone, screen resolution and pixel density, platform, number of processor cores, touch capability, languages), a technical fingerprint of the encrypted connection (JA4), and - for the SMS procedure - the mobile number in truncated and hashed form. This data is used solely to detect and prevent fake bookings and is deleted automatically after 90 days. It is stored in Switzerland (Supabase Inc., Zurich data centre). The legal basis is our overriding interest in protecting our business from misuse.

10. Contacting us by other means

If you contact us by email, phone or WhatsApp, we likewise process your details only to answer the enquiry. We do not pass this data on to third parties without your consent. For WhatsApp, the privacy policy of WhatsApp Ireland Limited additionally applies; data is also transferred to Meta Platforms, Inc. in the USA, which is certified under the Swiss-U.S. Data Privacy Framework.

References to our Instagram profile are plain links. No connection to Instagram is established when you view our pages; you only leave this website when you click the link.

11. Data security

The website is delivered exclusively over encrypted HTTPS. There are no customer accounts; the sections above describe what data individual features involve. Access to our email mailbox is protected by password and restricted to the salon managers.

12. Your rights

Under the FADP you have the following rights towards us:

• Access to whether and which personal data we process about you (Art. 25 FADP)
• Rectification of inaccurate data (Art. 32 FADP)
• Erasure of data that is no longer needed
• Release of the data you have given us, in a common electronic format (Art. 28 FADP)
• Objection to processing that is not necessary (Art. 30 FADP)

Contact us at the address given in section 1. Access is generally free of charge and provided within 30 days. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch.

13. Changes

We update this policy when the website or the services used change. The version published here applies in each case.

Version: 7 October 2026