Legal

Privacy notice

This is an English version of our German Datenschutzerklärung. Both describe the same processing. If you notice a difference, please let us know at kontakt@cosvionsolutions.com.

1. Controller

For any questions about data protection, an email to this address is all it takes.

We have not appointed a data protection officer, because the legal requirements for doing so (Section 38 of the German Federal Data Protection Act, BDSG) are not met.

Visitors from the United Kingdom: in addition to the EU General Data Protection Regulation (GDPR), the UK GDPR and the Data Protection Act 2018 also apply to the extent that they cover our processing of your data. Where this notice refers to articles of the GDPR, the corresponding provisions of the UK GDPR apply in that case as well.

2. The key points in brief

• This website does not set any cookies for analytics or advertising purposes and does not use any tracking.
• There is no newsletter, no social media plug-ins and no advertising networks.
• Fonts are loaded from our own web server, not from third parties.
• No booking calendar is currently embedded on this website. We arrange demo appointments by phone, WhatsApp or email.
• The calculator on the home page and on the pricing page runs only in your browser. We do not store your entries in cookies or in your browser's local storage. As soon as you choose a treatment, the treatment and your figures appear in the address of the page. Our hosting provider Cloudflare receives this address when you reload the page or when further pages or images of this website are loaded afterwards (server log files, see section 3). Beyond that, your entries only leave your browser if you click the WhatsApp link under “Not quite ready?” (the pre-filled text then contains the treatment and the number of clients, see section 6) or share your salon link (your figures are then in the address of the link, which you pass on yourself).
• On the Cosvion Solutions pages (under /unternehmen/), the self-check and the moving particle field in the background run only in your browser. Your answers in the self-check are neither stored nor sent to us or to third parties; they are gone once you reload or close the page.
• You can read this entire website without disclosing any data about yourself.

3. Hosting and server log files

This website is provided via Cloudflare Pages by Cloudflare, Inc. (USA). Cloudflare delivers the pages through a worldwide network of data centres and protects them against attacks. When you visit the website, the hosting provider processes technically necessary data, in particular your IP address, the date and time of access, the page accessed, browser type and operating system, and the previously visited page (server log files).

The purpose is to provide the website securely and reliably. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure operation of the website.

This information relates only to the website. We store the client and appointment data that salons process in the Cosvion Rebook product on servers in Germany, with the system itself hosted by netcup in Nuremberg. For the use of AI in the product, see section 9.

Cloudflare processes this data as a processor; the data processing agreement under Art. 28 GDPR forms part of Cloudflare's contractual terms. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. We therefore base the transfer to the USA on the European Commission's adequacy decision (Art. 45 GDPR). Where Cloudflare processes data in data centres in other countries without an adequacy decision, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR), which form part of that agreement.

4. Cookies and storage on your device

We do not set any cookies for analytics, advertising or profiling purposes and do not store any information in your browser that is not required to operate the website. Consent under Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) is therefore not required, and we deliberately have no cookie banner. For visitors from the United Kingdom, the same applies under regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

If you open a booking link that we send you, Cal.com may set its own cookies on its website (see section 5).

5. Appointment booking via Cal.com

We currently arrange demo appointments by phone, WhatsApp or email; no booking calendar is embedded on this website. If we send you a link to our booking calendar with the service Cal.com, Inc. (USA) and you open it, content is loaded from Cal.com; in the process, Cal.com receives technical data such as your IP address. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest lies in showing you available appointments at your request and making booking easy.

When you book, we process the details you enter yourself (usually your name, email address, chosen appointment and any voluntary details) in order to arrange and hold the demo. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract).

The demo takes place as a video call via Cal Video, Cal.com's video service; you receive the link with the booking confirmation. In the process, Cal.com processes your name, your IP address, device and connection data, and picture and sound if you switch on your camera and microphone. The legal basis here is also Art. 6(1)(b) GDPR; the information on Cal.com further down in this section applies.

Further information: Cal.com privacy policy. Cal.com processes the booking data on our behalf as a processor (Art. 28 GDPR). Cal.com, Inc. is certified under the EU-U.S. Data Privacy Framework. We therefore base the transfer to the USA on the European Commission's adequacy decision (Art. 45 GDPR).

6. Contact by email, phone and WhatsApp

If you email or call us, we process your details in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if the enquiry is aimed at a contract, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering your enquiry.

The home page and the pricing page contain links to WhatsApp. No data is transferred until you click one. The link under “Not quite ready?” on the home page pre-fills a message to us with the treatment and number of clients from the calculator; the “Ask on WhatsApp” buttons pre-fill a demo request only. On the Cosvion Solutions pages, the button “Per WhatsApp einen Termin anfragen” (request an appointment via WhatsApp) pre-fills a request for an initial consultation only. You can see and change the text before sending it. If you write to us via WhatsApp, WhatsApp Ireland Ltd. (Meta) processes your phone number, your message and other connection data. Meta may also process data outside the EU. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in answering your enquiry through the channel you have chosen. If you would rather reach us without WhatsApp, please send us an email.

When beauty salons reply to emails we have sent them, we use Anthropic’s AI model Claude to sort the replies and suggest a draft response. Kai reviews and sends every reply himself. Anthropic does not use this information for training, deletes it after 30 days at the latest and may also process it in the USA. We base the transfer on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a prompt and appropriate reply.

7. Fonts and images

The fonts used (Bricolage Grotesque, Manrope, IBM Plex Mono, Mrs Saint Delafield) and all images are stored on our own web server. Loading them does not create any connection to Google Fonts or other third parties. The website does not embed any videos.

8. What we do not do

• No web analytics, no tracking, no audience measurement.
• No newsletter and no marketing emails via this website.
• No social media plug-ins. References to external profiles are simple links: no data is transferred until you click them.
• No disclosure of your data for advertising purposes, no sale of data.

9. Client data in the Cosvion Rebook product

Client and appointment data within the Cosvion Rebook product is processed on behalf of the respective salon on the basis of a data processing agreement under Art. 28 GDPR. The salon is the controller within the meaning of the GDPR; this privacy notice applies to the website and not to that processing.

We store the salons' client and appointment data on servers in Germany, with the system itself hosted by netcup in Nuremberg. For text suggestions, we use Anthropic’s AI model Claude. In doing so, we transmit only the first name, the type of treatment, the time since the last visit and the type of message, no surnames and no phone numbers. Anthropic does not use this information for training, deletes it after 30 days at the latest and may also process it in the USA.

Cosvion Rebook is not publicly accessible on the internet. Access is via a private, encrypted network and only from devices that we have authorised for this purpose.

10. Recipients of your data

• Cloudflare, Inc.: provision of the website (server log files)
• Cal.com, Inc.: appointment booking via booking links that we send you, and the demo video call (Cal Video)
• IONOS SE (Montabaur, Germany): email mailbox, sending and receiving messages
• WhatsApp Ireland Ltd.: only if you write to us via WhatsApp
• Anthropic Ireland, Limited: draft replies to emails from beauty salons (section 6) and text suggestions in the product (section 9)

Beyond this, we only pass on data where we are legally obliged to do so.

Where personal data is transferred from the EU to the United Kingdom, we rely on the European Commission's adequacy decision for the United Kingdom (Art. 45 GDPR). For data that reaches us in Germany from the United Kingdom, UK data protection law recognises the EU as providing an adequate level of protection.

11. Storage period

We store personal data only for as long as is necessary for the respective purpose or as statutory retention obligations require. In detail:

• Server log files: Cloudflare stores them only for as long as is necessary to deliver the website and to defend against attacks, and then deletes them automatically; Cloudflare does not state a fixed period for this. We do not analyse them and do not store them ourselves.
• Demo bookings: if no contract is concluded, we delete your booking data no later than six months after the appointment.
• Emails and messages: we delete them as soon as your matter has been dealt with, unless statutory retention obligations apply (for example six years for business letters under Section 147 of the German Fiscal Code, Abgabenordnung). The legal basis for this retention is Art. 6(1)(c) GDPR.

12. Obligation to provide data

You do not have to provide any data in order to read this website. To book an appointment, we need your name and email address; without these details we cannot arrange an appointment. Any further details are voluntary.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)).

You also have the right to lodge a complaint with a data protection supervisory authority, for example with the authority responsible for us:

If you are in the United Kingdom, you can also complain to the Information Commissioner's Office (ICO), ico.org.uk. If you are in Ireland, you can also complain to the Data Protection Commission, dataprotection.ie.

For any request, an email to kontakt@cosvionsolutions.com is all it takes.

Right to object under Art. 21 GDPR

If we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If we process your data for direct marketing purposes, you can object to this processing at any time without giving reasons. We will then no longer process your data for this purpose.

An informal email to kontakt@cosvionsolutions.com is sufficient to object.

14. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website. In the Cosvion Rebook product, too, a person at the salon decides on every message to a client.

15. Encryption

This website uses TLS encryption. You can recognise it by “https://” in the address bar.

16. Changes to this privacy notice

We update this notice when the website or the legal situation changes. The version published on this page at the time applies.

German version as of October 2026. English translation: October 2026.