PanfiliWien
Book appointment

Legal

Privacy Policy

This policy describes which personal data is processed when you visit panfili.at, for what purpose, and on what legal basis.

It describes only what this site actually does. Services that are not embedded are not mentioned: there is no contact form, no newsletter, no online shop and no embedded social media content. The typefaces are served from this site's own server; no font is loaded from a third-party service.

Controller

Company
Panfili GmbH
Address
Herrengasse 6–8, Stiege 1, Top 32, 1010 Vienna, Austria
Email
panfili@panfili.at
Telephone
+43 (0) 6601664717
VAT ID
ATU82246945

Hosting

This site is hosted by Hostinger International Ltd, a company seated in Lithuania. Processing takes place in Germany. Both the company seat and the data centre are therefore inside the European Union; no transfer to a third country takes place for hosting.

The host processes the data solely in order to deliver the site, and not for its own purposes. The legal basis is Art 6(1)(f) GDPR: the legitimate interest in operating the site securely and reliably.

Server log files

When a page is opened, the web server automatically records access data in server log files: the IP address, the date and time of the request, the address requested, the status code, the volume of data transferred, the referring page, and the browser and operating system. The web server runs on the server the salon rents from Hostinger International Ltd and is operated by the salon itself.

This data is not combined with any other source and serves the secure operation of the site and the defence against attacks. The legal basis is Art 6(1)(f) GDPR.

The log files are kept for 14 days and then deleted automatically. No access log files are written for the audience measurement (stats.panfili.at).

Appointment booking

Online appointment booking uses Treatwell, operated by Treatwell DACH GmbH (Germany). Simply visiting this website loads nothing from Treatwell, nor does choosing a treatment and its options in the online booking. The booking interface is fetched from Treatwell DACH GmbH only once you click “Choose date & time” at the end and the booking window opens. Your IP address is transmitted to Treatwell DACH GmbH at that point, and Treatwell sets its own cookies inside that window. If you booked from a team member's page, that person is already selected in the booking interface.

The legal basis for loading it is your consent under Art 6(1)(a) GDPR, which you give with that click. For carrying out a booked appointment it is Art 6(1)(b) GDPR. Whatever you type into the booking interface you enter directly with Treatwell; which cookies are set there, and how Treatwell DACH GmbH processes that data, is set out in their privacy policy: https://www.treatwell.at/info/datenschutzrichtlinien/

You can also arrange an appointment without the online booking: the first page of the online booking gives the salon's telephone number and WhatsApp, and the footer of every page also gives Instagram and the email address. None of these load anything from Treatwell.

What is collected

  • your IP address
  • device type, browser and operating system
  • the service, appointment time and stylist you choose
  • the details you enter in the booking panel yourself

Google Maps

A Google Maps frame can be shown in the footer of every page. It is not loaded by itself: as long as you have not allowed the “External media” category, the address stands there as text and nothing is sent to Google.

Once you agree, the map loads on every further page without asking again. Google Ireland Limited (Ireland) then receives your IP address and may set cookies of its own. Google also processes this data in the United States; the transfer relies on the safeguards under Chapter V GDPR.

The legal basis is your consent under Art 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, through “Cookie settings” in the footer or in the cookie policy. Google's privacy policy: https://policies.google.com/privacy

What is collected

  • your IP address
  • device type, browser and operating system
  • the page the map is embedded on

Getting in touch

This site has no contact form. Contact is made only through the channels stated on it: telephone, email, WhatsApp or Instagram.

If you call or write, the details you send are processed in order to deal with your enquiry. The legal basis is Art 6(1)(b) GDPR for an appointment enquiry and Art 6(1)(f) GDPR for a general one. The details are deleted once they are no longer needed and no statutory retention obligation applies.

WhatsApp and Instagram are linked on this site, not embedded: nothing is loaded unless you click the link. If you get in touch through either, Meta Platforms Ireland Ltd processes your data under that service's own terms. The salon has no influence over that.

Cookies and stored entries

This site distinguishes three categories: necessary entries, external media, and analytics. The necessary ones are currently your choice of language, your answer on the cookie bar, and a session note about the opening animation.

Exactly which entries those are, with name, purpose, lifetime and provider, is set out in full in the cookie policy. The selection can also be changed there at any time.

Analytics

Plausible Analytics is used for audience measurement, operated by Panfili GmbH (Austria).

Retention: The salon runs the measurement itself, on its own server in the EU. Individual page views and events are stored, without IP address and without cookies. They are deleted automatically after 24 months.

The legal basis is your consent under Art 6(1)(a) GDPR insofar as the service sets cookies or uses comparable identifiers, and otherwise Art 6(1)(f) GDPR. The provider's privacy policy: https://plausible.io/data-policy

What is collected

  • the page opened
  • the referring page
  • device type, browser and operating system
  • the country, derived from the IP address, which is not itself stored
  • a visitor identifier, calculated from the IP address and browser with a key that changes daily and is deleted after two days at most; after that the identifier can no longer be linked to anyone
  • how long a page is open and how far down it is read
  • the events listed above, with no personal details
  • in online booking: which steps are viewed and which treatment, price and, where applicable, which team member is chosen, with no information about you
  • clicks on links to other websites, such as Instagram, WhatsApp, Treatwell or Google Maps, with the link's address

You can object to the audience measurement at any time (Art 21 GDPR). One click is enough; it applies to this browser on this device.

Your rights

  • Access to the data held about you, Art 15 GDPR
  • Rectification of inaccurate data, Art 16 GDPR
  • Erasure, Art 17 GDPR
  • Restriction of processing, Art 18 GDPR
  • Data portability, Art 20 GDPR
  • Objection to processing based on legitimate interests, Art 21 GDPR
  • Withdrawal of consent with effect for the future, Art 7(3) GDPR

Right to complain

You have the right to complain to a supervisory authority if you believe that the processing of your data breaches the GDPR. In Austria the competent authority is:

Authority
Österreichische Datenschutzbehörde
Address
Barichgasse 40-42, 1030 Vienna, Austria
Telephone
+43 1 52 152-0
Email
dsb@dsb.gv.at
Web
https://dsb.gv.at

This version: October 2026.