We are delighted that you are interested in our website. The protection of your privacy is very important to us. Below we inform you, in accordance with Art. 13 of the General Data Protection Regulation (GDPR), about which personal data we process when you use the website www.skinflow.de, for what purpose this happens and what rights you have.
1. Controllers
For our head office and the Bogenhausen, Pasing, Schwabing, Dachau and Wolfratshausen locations, and for the operation of this website, the controller is:
Rodger Bothmann skinflow, dauerhafte Haarentfernung Spiegelstraße 6 81241 München
Telephone: +49 (0) 89 88951870 Email: info@skinflow.de Web: www.skinflow.de
For the Unterhaching location, the controller is:
David Hilmer skinflow, dauerhafte Haarentfernung Unterhaching Albrecht-Dürer-Straße 1 82008 Unterhaching
Telephone: 089 99122230 Email: unterhaching@skinflow.de
Both controllers are sole traders. A data protection officer has not been appointed, because the conditions of Art. 37 GDPR are not met. For questions about data protection you can reach us using the contact details above, preferably by email.
Where this policy refers to "we", the respective competent controller is meant. Where a processing operation concerns only one of the two, we say so explicitly.
2. Hosting and technical operation
Rodger Bothmann is the controller for the operation of this website and of the booking system (section 1). This website and the booking system run on the same server. This server is operated and technically maintained for us by:
Gert Zumtobel (NEXPROmedia) Neue Straße 22 56472 Hof Germany
The server is located in Germany. The service provider named is our processor within the meaning of Art. 28 GDPR and processes data only on our instructions. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable operation of the website).
Backup copies of the website are created daily at 02:00. These backups are stored in encrypted form exclusively on the service provider's servers in a German data centre. They are kept for a maximum of 14 days; older backups are deleted automatically on an ongoing basis.
3. Server log files
When you access this website, the web server automatically records the operation in log files. The following are recorded:
- IP address of the requesting device
- date and time of access
- the address requested
- the previously visited page, insofar as your browser transmits it
- browser type and browser version
- operating system
- the status code returned and the volume of data transferred
Your IP address is stored in full, it is not truncated.
We need this data in order to provide the website technically and to defend against attacks. It is not combined with other data sources and is not used to identify you personally. The legal basis is Art. 6(1)(f) GDPR.
The log files are rotated daily and seven previous versions are kept. Together with the file currently in use, your data is therefore stored there for a maximum of eight days and is then deleted automatically. If we detect an attack or a malfunction, we retain only those entries required to investigate it for as long as it takes to resolve the incident.
4. Cookies and consent management
Cookies are small text files that your browser stores on your device. We distinguish two cases. Technically necessary cookies are required for the operation of the website and cannot be refused; they are permitted without consent under Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). All other cookies and all embedded external services are only used after you have expressly agreed (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
We manage your decision with the consent tool Borlabs Cookie:
Borlabs GmbH Hamburger Str. 11 22083 Hamburg Germany borlabs.io
The tool runs on our own server. It does not transmit your decision to the manufacturer.
As long as you have not agreed, and also if you refuse, exactly three cookies are set on this website:
| Cookie | Purpose | Lifetime |
|---|---|---|
wp-wpml_current_language | remembers the language you have selected | session, deleted when you close the browser |
borlabs-cookie | stores your consent decision | 60 days |
borlabs-cookie-gcs | stores which services you have consented to | 60 days |
No analytics, advertising or third-party cookie is set before you consent, and no connection to Google, Meta or Microsoft is established before you consent.
You can withdraw your consent at any time with effect for the future. At the bottom left of the screen you will find a small icon on every page labelled "Open Privacy Preference dialog". Clicking it reopens the consent dialog, where you can change your selection or refuse everything. You can also simply notify us of your withdrawal by email to info@skinflow.de. The lawfulness of the processing carried out until withdrawal remains unaffected (Art. 7(3) GDPR).
We are legally obliged to obtain your consent and to be able to demonstrate that you gave it. That is what we need this tool for (Art. 6(1)(c) GDPR, Section 25(1) TDDDG, Art. 7(1) GDPR).
5. Online appointment booking
On the German-language home page and on the German-language location pages a booking window is embedded, allowing you to request an appointment directly. It is provided under our own address buchen.skinflow.de; who maintains the server on which the booking system runs, and on what legal basis, is set out in section 2. On the page of an individual location that location is already preselected in the booking window, on the home page you can choose the location freely. The English-language pages do not contain this booking window. If you use the English-language pages, you can request an appointment through the form described in section 6 or through the German-language pages. Independently of the booking window, the forms described in section 6 are available to you at any time.
Please note the difference from the maps described further below: The booking window is deliberately loaded without prior consent, so that you can request an appointment at any time and without a detour. In doing so, your IP address is transmitted to our server, just as when you access any other page of this website. No cookies are set when the booking window is merely accessed and displayed.
Only once you have selected an appointment and proceed to enter your contact details is a technically necessary session cookie set. Choosing a location and choosing an appointment themselves take place without any cookie at all:
| Cookie | Purpose | Lifetime |
|---|---|---|
gpsk_session | keeps track of where you are in the booking process and protects it against misuse by external websites | 2 hours |
Anyone who only views the page without starting the booking does not receive this cookie.
The legal basis for embedding and displaying the booking window is Art. 6(1)(f) GDPR (legitimate interest in offering you the appointment request directly and without an additional hurdle), for the session cookie likewise Art. 6(1)(f) GDPR in conjunction with Section 25(2) no. 2 TDDDG (strict necessity for the service you have requested), and for processing the appointment data you enter Art. 6(1)(b) GDPR.
How long your appointment request remains stored in the booking system: it remains stored there until the appointment has been held or finally cancelled and the related communication with you has been concluded. After that we delete it in the booking system, at the latest six months after the appointment. If you withdraw your request, we delete it as soon as the withdrawal has been dealt with. Information that subsequently becomes part of a contract or accounting record is kept only for as long as the statutory retention periods applicable to those records require.
For appointment enquiries at the Unterhaching location, the following special case applies in addition.
Special case Unterhaching location: joint controllership for appointment enquiries
Rodger Bothmann is solely responsible for all other locations and for the operation of this website. Only the Unterhaching location is subject to a special arrangement: when you request an appointment for that location, the two controllers named in section 1 work together. Rodger Bothmann provides the website and the booking system and determines how the appointment request works technically. David Hilmer, the controller for the Unterhaching location, receives the appointment request and uses it to arrange the appointment with you and to treat you at his location. Because both jointly decide what your enquiry is used for and by which route this happens, they bear joint responsibility for this step (joint controllers within the meaning of Art. 26 GDPR).
How an appointment request works technically is the same for all locations and is described above in this section. You can also select the Unterhaching location in the forms described in section 6.
The joint controllership is limited to this one operation: to receiving your appointment request for the Unterhaching location through the shared booking system, to storing and deleting it there, and to making it available to the Unterhaching location. Everything that follows, in particular arranging the appointment with you, the treatment itself and the records created in the process, is the sole responsibility of David Hilmer.
This is how we have allocated the tasks between us:
- The information obligations under Art. 13 and 14 GDPR are fulfilled jointly by both through this privacy policy.
- Rodger Bothmann ensures the technical security of the booking system and of the website.
- The booking system is operated by Rodger Bothmann. He ensures that your appointment request is stored there and deleted on time.
- David Hilmer receives your appointment request as a recipient and uses it to arrange the appointment with you and to carry it out.
- Your requests for access, rectification, erasure, restriction, objection and data portability concerning this processing are handled and answered by Rodger Bothmann. David Hilmer handles and answers them alone where they concern arranging the appointment, the treatment or the records created in the process at the Unterhaching location.
- Rodger Bothmann, info@skinflow.de, serves as the point of contact for your questions about this processing.
Regardless of who is responsible internally, you can exercise your rights under the GDPR with and against each of the two controllers (Art. 26(3) GDPR). So please feel free to contact whichever party is more convenient for you.
The legal basis for processing your appointment request is Art. 6(1)(b) GDPR (performance of pre-contractual measures at your request). How long your appointment request remains stored is set out above in this section. Deletion in the booking system is carried out by Rodger Bothmann, including for the Unterhaching location.
6. Contact and appointment forms
On our "Make an appointment" page you can reach us via a form. The form asks for your first name, your last name, your telephone number, your postcode, your email address, a free-text field for your question and a selection of the institute your enquiry relates to (a choice between our locations). The field labels on that page are in German. In addition, you confirm that you have read this privacy policy. Our contact page (contact-us) does not contain a form; there you can reach us only by email (info@skinflow.de) and telephone, so no form data is collected on that page. For enquiries concerning the Unterhaching location, the special case at the end of section 5 applies in addition.
The form data is processed on our own server. If you have consented to the "Marketing" category, an encrypted hash value of your email address, telephone number and address is additionally transmitted to Google when you submit the form; see section 10 for details. Without that consent, no information from the form leaves our server. When you submit a form, your IP address and the date and time of submission are additionally recorded for technical reasons.
Please do not enter any information about your health in the free-text field. We do not need such information at this stage for an initial consultation.
The purpose is to process and answer your enquiry and, where applicable, to initiate a contract. The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry serves the initiation or performance of a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
Your enquiry remains stored for as long as we are processing it, and beyond that for as long as statutory retention periods require. If the enquiry leads to a business transaction, the six-year period under Section 147(3) of the German Fiscal Code (Abgabenordnung) applies in particular. After that, we delete the data.
7. Contact by email and telephone
When you write us an email or call us, we process your information in order to deal with your request. Incoming emails to our addresses first pass through a security filter provided by Hornetsecurity, which sorts out malware and unwanted messages. They are then stored in our mailbox. We operate our mailboxes at Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; section 15 applies accordingly to the transfer to the USA. The legal bases are Art. 6(1)(b) and (f) GDPR. The same storage period applies as for form enquiries.
8. Google Tag Manager
In order to load and control the analytics and advertising services described below, we use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
The Tag Manager is a management tool. It does not set a cookie itself. It is only loaded after you have consented to the "Statistics" category. If you refuse or make no decision, it is not loaded, and no connection to Google is established.
The legal basis is Art. 6(1)(a) GDPR (consent). Google's privacy policy: policies.google.com/privacy.
9. Google Analytics
After you have consented to the "Statistics" category, we use Google Analytics in order to understand how our website is used and where we can improve it. The provider is Google Ireland Limited (address see section 8).
Among other things, the pages accessed, the time spent, the approximate origin, information about your device and browser, and your IP address are collected. According to Google, the IP address is shortened or discarded before logging.
The following cookies are set:
| Cookie | Purpose | Lifetime |
|---|---|---|
_ga | distinguishes visitors | 400 days |
_ga_Y3D401HJ52 | holds the session state for the first of our three separate analyses | 400 days |
_ga_WG9VXEVSDQ | holds the session state for the second analysis | 400 days |
_ga_S9BELFE8D5 | holds the session state for the third analysis, which is linked to our advertising account | 400 days |
The two analyses _ga_Y3D401HJ52 and _ga_WG9VXEVSDQ start as soon as you have consented to the "Statistics" category. The third, _ga_S9BELFE8D5, belongs to our Google advertising account and only starts if you additionally consent to the "Marketing" category. The cookie _ga belongs to all three.
If you consent only to the "Marketing" category, but not to the "Statistics" category, no analytics or advertising service is loaded on this website at all, because all services run through the Tag Manager and this is assigned to the "Statistics" category.
The legal basis is Art. 6(1)(a) GDPR (consent). For the transfer to the USA, see section 15.
10. Google Ads and conversion measurement of advertisements
We run advertisements via Google Ads, a service of Google Ireland Limited (address see section 8). After you have consented to the "Statistics" and "Marketing" categories, we measure whether an advertisement has led to an enquiry, and we can show you our advertisements again if you have already visited our website.
| Cookie | Purpose | Lifetime |
|---|---|---|
_gcl_au | attributes an enquiry to a previously clicked advertisement | 90 days |
IDE (domain doubleclick.net) | recognises your browser for the delivery and measurement of advertising | 390 days |
test_cookie (domain doubleclick.net) | checks once whether your browser accepts cookies | 15 minutes |
NID (domain google.com) | recognises you across Google services | 183 days |
The settings of our Google advertising account currently also have the "enhanced conversions" function activated. It means that, when a form is submitted, the email address, telephone number and address you have entered may be transmitted to Google in encrypted form (as a hash value), so that Google can attribute an enquiry to an advertisement more precisely. Such a hash value looks like a random string of characters, but it is not anonymisation: whoever enters the same email address always produces the same hash value. Google can use it to recognise you again, even though it does not see your address in plain text. This function is tied to your consent to the "Marketing" category. If you do not consent to this category, the transmission does not take place.
If you consent to the "Statistics" category but refuse the "Marketing" category, the Tag Manager reports that refusal to Google. In doing so, a connection to a Google advertising address (pagead2.googlesyndication.com) is established and your IP address is transmitted. No advertising cookie is set in the process, and your refusal is expressly communicated. Without this notification, Google could not take the refusal into account.
The legal basis is Art. 6(1)(a) GDPR (consent). For the transfer to the USA, see section 15.
11. Microsoft Clarity
After you have consented to the "Statistics" and "Marketing" categories, we use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA).
Clarity records how you move on a page: mouse movements, clicks and how far you scroll. This produces aggregated analyses and session recordings that help us identify where our pages are unclear or inconvenient. Among other things, your IP address, information about your device and browser, and your interactions with the page are processed.
For us, Clarity is deliberately tied to both consents, to "Statistics" and to "Marketing". It is therefore only loaded once you have consented to both categories. If you consent only to the "Statistics" category, Clarity remains fully switched off.
| Cookie | Purpose | Lifetime |
|---|---|---|
_clck | assigns your sessions to an identifier | 365 days |
_clsk | groups the page views of a session | 24 hours |
MUID (domains clarity.ms and bing.com) | recognises your browser across Microsoft services | 390 days |
SM | technical control of the recording | session, deleted when you close the browser |
ANONCHK | technical control of the recording | 10 minutes |
MR (domains clarity.ms and bing.com) | Microsoft advertising identifier | 7 days |
SRM_B (domain bing.com) | Microsoft advertising identifier | 390 days |
As the table shows, Clarity additionally loads identifiers of the Microsoft advertising platform (domain bing.com). This is precisely why we do not classify the service as pure statistics.
The legal basis is Art. 6(1)(a) GDPR (consent). For the transfer to the USA, see section 15. Microsoft's privacy policy: privacy.microsoft.com/en-us/privacystatement.
12. Meta Pixel
After you have consented to the "Statistics" and "Marketing" categories, we use the Meta Pixel, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (parent company: Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA).
The pixel measures the success of our advertisements on Facebook and Instagram and makes it possible to show you our advertisements there again. Among other things, your IP address, information about your browser and device, and the pages you have visited are processed. The cookie _fbp is set with a lifetime of 90 days.
For the collection and transmission of this event data to Meta, we and Meta Platforms Ireland Limited are joint controllers within the meaning of Art. 26 GDPR. Meta provides the essence of the applicable agreement at www.facebook.com/legal/controller_addendum. What Meta subsequently does with the data for its own purposes is Meta's sole responsibility; we have no influence over this.
The legal basis is Art. 6(1)(a) GDPR (consent). For the transfer to the USA, see section 15. Meta's privacy policy: www.facebook.com/privacy/policy.
13. Google Maps
On some pages we display a directions map from the Google Maps service, an offering of Google Ireland Limited (address see section 8).
The map is only loaded after you have consented. Until then, you see a placeholder with a notice in its place; no connection to Google takes place beforehand. Only once you consent are your IP address and information about your browser transmitted to Google, and Google sets the cookie NID (domain google.com, lifetime 183 days).
The legal basis is Art. 6(1)(a) GDPR (consent). For the transfer to the USA, see section 15.
14. Fonts and other delivery services from Google
Together with the map, fonts and other display components are loaded from Google servers (fonts.googleapis.com and gstatic.com). In doing so, your IP address is transmitted to Google. No cookies are set in the process.
These services run only together with the embedded content from section 13 and are therefore, like that content, only loaded after you have consented. The legal basis is Art. 6(1)(a) GDPR (consent). For the transfer to the USA, see section 15.
15. Transfer to third countries
The services named in sections 9 to 14 belong to corporate groups based in the USA. If you consent to them, your data may be transferred to the USA and processed there.
For the USA, the European Commission has determined, through the EU-US Data Privacy Framework, that certified companies offer an adequate level of protection (adequacy decision under Art. 45 GDPR). The official participant list at dataprivacyframework.gov, which we check regularly, records the following status:
- Google LLC: actively certified
- Microsoft Corporation: actively certified
- Meta Platforms, Inc.: actively certified, recertification currently under review
Two questions have to be kept apart here. Whether we may use any of these services at all depends on your consent under Art. 6(1)(a) GDPR. The transfer to the USA itself is based, for the companies listed above as certified, on the adequacy decision of the European Commission (Art. 45 GDPR). Consent is not what carries the transfer in those cases: the derogations in Art. 49(1) GDPR expressly apply only where no adequacy decision and no appropriate safeguards are in place.
Without your consent, none of these transfers takes place.
16. Rights of data subjects
You have the following rights with regard to the personal data concerning you:
- right of access (Art. 15 GDPR)
- right to rectification (Art. 16 GDPR)
- right to erasure (Art. 17 GDPR)
- right to restriction of processing (Art. 18 GDPR)
- right to data portability (Art. 20 GDPR)
- right to object to the processing (Art. 21 GDPR)
- right to withdraw a consent given (Art. 7(3) GDPR)
To exercise your rights, please contact us directly: info@skinflow.de, and for the Unterhaching location unterhaching@skinflow.de. If your request concerns an appointment enquiry for Unterhaching, you can contact either of the two parties (see the special case at the end of section 5).
Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.
Providing your data in our forms is neither legally nor contractually required. However, without the information marked as mandatory we cannot process your enquiry.
17. Right to object
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR (legitimate interest). If you object, we will no longer process the data concerned, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. An informal notice to info@skinflow.de is sufficient for the objection.
18. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for both controllers is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) (the Bavarian State Office for Data Protection Supervision, the supervisory authority competent for both controllers) Promenade 18 91522 Ansbach Postal address: Postfach 1349, 91504 Ansbach Web: www.lda.bayern.de
19. SSL/TLS encryption
For security reasons, this website uses SSL/TLS encryption for the transmission of confidential content. You can recognise an encrypted connection by the "https://" at the beginning of the address bar of your browser.
20. Currency of this privacy policy
We reserve the right to adapt this privacy policy if the technology used or the legal situation changes. You will always find the current version on this page.
Last updated: 17 August 2026