PanfiliWien

Legal

Privacy Policy

This policy describes which personal data is processed when you visit panfili.at, for what purpose, and on what legal basis.

It describes only what this site actually does. Services that are not embedded are not mentioned: there is no contact form, no newsletter, no online shop and no embedded social media content. The typefaces are served from this site's own server; no font is loaded from a third-party service.

Controller

Company
Panfili GmbH
Address
Herrengasse 6–8, Stiege 1, Top 32, 1010 Vienna, Austria
Email
panfili@panfili.at
Telephone
+43 (0) 6601664717
VAT ID
ATU82246945

Open: the imprint names Panfili GmbH in its company block but Tatiana Comarschi as media owner and publisher. Those are two different legal persons, and only one of them can be the controller under Art 4(7) GDPR. This version names Panfili GmbH, because it runs the business and holds the trade licences. Who is actually the controller has to be confirmed before publication. The same conflict is open in the imprint.

Hosting

This site is hosted by Hostinger International Ltd, a company seated in Lithuania. Processing takes place in Germany. Both the company seat and the data centre are therefore inside the European Union; no transfer to a third country takes place for hosting.

The host processes the data solely in order to deliver the site, and not for its own purposes. The legal basis is Art 6(1)(f) GDPR: the legitimate interest in operating the site securely and reliably.

Open: whether a data processing agreement under Art 28 GDPR has been concluded with Hostinger International Ltd is not confirmed in this version. Such an agreement is required, and its existence has to be established before publication.

Server log files

When a page is opened, the host automatically records access data in server log files. This typically includes the address requested, the date and time of the request, the volume of data transferred, the referring page, the browser and operating system, and the IP address.

This data is not combined with any other source and serves the secure operation of the site and the defence against attacks. The legal basis is Art 6(1)(f) GDPR.

Open: which fields Hostinger International Ltd records in detail, and how long the log files are kept, is being confirmed with the host. The answer will be stated here once it is available.

Appointment booking

Online appointment booking uses Treatwell, operated by Treatwell DACH GmbH (Germany). Simply visiting this website loads nothing from Treatwell. The booking interface is fetched from Treatwell DACH GmbH only once you click an appointment button and the booking window opens. Your IP address is transmitted to Treatwell DACH GmbH at that point, and Treatwell sets its own cookies inside that window.

The legal basis for loading it is your consent under Art 6(1)(a) GDPR, which you give with that click. For carrying out a booked appointment it is Art 6(1)(b) GDPR. Whatever you type into the booking interface you enter directly with Treatwell; which cookies are set there, and how Treatwell DACH GmbH processes that data, is set out in their privacy policy: https://www.treatwell.at/info/datenschutzrichtlinien/

You can also arrange an appointment without the online booking. The same window carries the salon’s telephone number, WhatsApp, Instagram and email address, and none of those load anything from Treatwell.

What is collected

  • your IP address
  • device type, browser and operating system
  • the service, appointment time and stylist you choose
  • the details you enter in the booking panel yourself

Google Maps

A Google Maps frame can be shown in the footer of every page. It is not loaded by itself: as long as you have not allowed the “External media” category, the address stands there as text and nothing is sent to Google.

Once you agree, the map loads on every further page without asking again. Google Ireland Limited (Ireland) then receives your IP address and may set cookies of its own. Google also processes this data in the United States; the transfer relies on the safeguards under Chapter V GDPR.

The legal basis is your consent under Art 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, through “Cookie settings” in the footer or in the cookie policy. Google's privacy policy: https://policies.google.com/privacy

What is collected

  • your IP address
  • device type, browser and operating system
  • the page the map is embedded on

Getting in touch

This site has no contact form. Contact is made only through the channels stated on it: telephone, email, WhatsApp or Instagram.

If you call or write, the details you send are processed in order to deal with your enquiry. The legal basis is Art 6(1)(b) GDPR for an appointment enquiry and Art 6(1)(f) GDPR for a general one. The details are deleted once they are no longer needed and no statutory retention obligation applies.

WhatsApp and Instagram are linked on this site, not embedded: nothing is loaded unless you click the link. If you get in touch through either, Meta Platforms Ireland Ltd processes your data under that service's own terms. The salon has no influence over that.

Cookies and stored entries

This site distinguishes three categories: necessary entries, external media, and analytics. The necessary ones are currently your choice of language, your answer on the cookie bar, and a session note about the opening animation.

Exactly which entries those are, with name, purpose, lifetime and provider, is set out in full in the cookie policy. The selection can also be changed there at any time.

Analytics

No analytics or tracking service is embedded on this site. No audience measurement takes place, no usage profiles are built, and nothing is stored in the browser for that purpose.

Should an analytics service be introduced later, this section will name it before it goes into use.

Your rights

  • Access to the data held about you, Art 15 GDPR
  • Rectification of inaccurate data, Art 16 GDPR
  • Erasure, Art 17 GDPR
  • Restriction of processing, Art 18 GDPR
  • Data portability, Art 20 GDPR
  • Objection to processing based on legitimate interests, Art 21 GDPR
  • Withdrawal of consent with effect for the future, Art 7(3) GDPR

Right to complain

You have the right to complain to a supervisory authority if you believe that the processing of your data breaches the GDPR. In Austria the competent authority is:

Authority
Österreichische Datenschutzbehörde
Address
Barichgasse 40-42, 1030 Vienna, Austria
Telephone
+43 1 52 152-0
Email
dsb@dsb.gv.at
Web
https://dsb.gv.at

This version: August 2026.

Note: this text is a technical draft. It describes what this site actually does, and every statement was verified against the source code and a running server. It is not legal advice and does not replace a legal review. It must be reviewed by a lawyer before publication.