Privacy policy
Controller
Mobile PMU Owner: Fanny Kananga Kumande Ottostraße 9 47198 Duisburg Germany Phone and WhatsApp: +49 151 26949335 Email: contact@mobilepmu.com
Visiting this website
This site is hosted by Vercel. On each visit the host processes technically necessary server logs, including your IP address, the time and the page requested. The legal basis is Art. 6(1)(f) GDPR — legitimate interest in operating the site securely.
Booking, payment and home visits
For your request we process your name, phone number, email, postcode, treatment, appointment, language and consents. Your home-visit address follows confirmation. Booking data is stored in Supabase. Email uses the configured delivery provider, Hostinger Email or Resend. If you use PayPal, it receives the required payment and reference data. Confirmed home visits are added to Fanny’s Google Calendar with contact details and address. WhatsApp messages to you are sent only with separate consent and an active connection. Fanny may be notified of a new request by WhatsApp; that message contains only your first name and the appointment, no contact details.
Address lookup and travel time
A home visit can only be planned once the address and the travel time to it are known. While you type your address, our server fetches address suggestions from Google Places; once you pick one, we resolve the coordinates and use Google Routes to calculate the drive from Duisburg. These requests go through our server only. Your browser never connects to Google, and Google sets no cookies on your device. Only the address you typed or selected is sent — no name, no treatment, nothing else. Calculated travel times are cached so the same route is not requested twice. The legal basis is Art. 6(1)(b) GDPR: without an address and a travel time the home visit cannot be offered.
Preparation and health information
When a preparation form is available for your appointment, health information is saved only after your explicit consent. Health data is a special category of personal data; the legal basis is your explicit consent under Art. 9(2)(a) GDPR, which you can withdraw at any time with future effect. You and authorised administrators can access it. The form shows its consent wording and retention period before submission. Expired preparation records are deleted automatically.
Private treatment photos
Treatment photos are stored only with separate, optional consent in the client portal. Access is limited to the client and Fanny. Photos are not automatically published or used for advertising. Storage ends within one year. Withdrawal blocks access immediately, after which automatic processing deletes the stored files. Previously issued private image links expire within 60 seconds. For a completed treatment you can also send Fanny healing photos yourself from the client area. The photo is made smaller on your device first, which removes embedded details such as where it was taken. You can remove photos you sent there at any time.
Invoice records
Invoices contain the required issuer and recipient details, treatment, service date and amounts. Access is restricted to the authorized client and owner accounts. Issued documents remain unchanged; corrections create a separate linked document. Statutory retention obligations are not removed by deleting an account.
Gift vouchers
When you buy a gift voucher, we process your name, your email address and – optionally – your phone number, as well as the recipient's name, your personal message, the chosen voucher, the payment method and the payment status. This is needed to fulfil the purchase, match the payment, send you the voucher card by email and check the voucher when it is redeemed (Art. 6(1)(b) GDPR). The name and message are printed on the card, which you pass on yourself. If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. processes the payment data. The card is sent via our email service; data is stored with Supabase in the EU. We keep the voucher records until the statutory tax and commercial retention periods end (eight years for accounting records, section 147 German Fiscal Code); we do not use them for anything else. Orders that were never paid are deleted after 90 days.
Shop and orders
When you order in the shop, we process your name and e-mail address and, for goods, the delivery address or the appointment chosen for handover and a separate billing address if you enter one, as well as the products ordered, prices, shipping costs, payment method and payment status and the order, contract and shipping messages. This is necessary to conclude and perform the contract, match the payment, deliver the goods or provide the download, and handle legal guarantee (warranty) claims and withdrawals (Art. 6(1)(b) GDPR). Mandatory fields are marked. For digital content we do not ask for a postal address, only for your country of residence, because we sell downloads only to customers in the EU and the EEA. We do not need a phone number. You can order without a client account. An order without an account does not create a client account. We link it to your treatment data only if you choose handover at your appointment: we then store with the order which appointment we will bring the goods to. You can reach your order through the link in your order confirmation until it has been processed. If you order while signed in to the client area, we assign the order to your account so that you can see it there. We do not use your order history for advertising or product recommendations unless you have separately consented. Payment: If you pay with PayPal, we send PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, the amount, the order number and, for goods, the delivery address. PayPal processes this data as an independent controller. After the payment, PayPal sends us your name, your e-mail address, the country of your PayPal account and the payment status. We store only the PayPal payment identifiers needed for refunds, no payment instruments. If you pay by bank transfer, we process the details of your transfer (name, IBAN, amount, payment reference) to match it to the order and, where necessary, refund it. For digital content we use the country of your PayPal account or the country of your bank (from the IBAN) as tax evidence of your country of residence (Art. 6(1)(c) GDPR in conjunction with Articles 24b and 24f of Implementing Regulation (EU) No 282/2011). Shipping: For delivery we pass your name and delivery address to the shipping company used (for example DHL Paket GmbH, Deutsche Post AG, DPD, GLS or Hermes), which processes the data as an independent controller (Art. 6(1)(b) GDPR). We do not pass your e-mail address or phone number to the carrier; we send you the tracking link ourselves. Digital content: We store when we sent the download link, when you first used it and whether, when and with which wording you consented to early performance. This lets us prove provision and the expiry of the right of withdrawal (Art. 6(1)(b) and (f) GDPR). We do not store IP addresses for this. Advertising and measurement: shop orders do not trigger any purchase event at Meta or any other advertising service. Intolerances: If you report a reaction to a product to us, for example a skin reaction, we process the details you give us. This is health data. We use it to handle the case, to report serious undesirable effects to the competent authority and to the manufacturer’s responsible person as required by law (Art. 9(2)(i) GDPR in conjunction with Article 23 of Regulation (EC) No 1223/2009), and to clarify claims (Art. 9(2)(f) GDPR). These reports do not contain your name or contact details. We delete your details on 1 January of the fourth year after the case is closed; the reporting register keeps only an entry that does not identify you. Basket: When you add the first item to the basket, we set the cookie pmu_cart. It only contains the identifiers of the items you chose and the quantities, is deleted when you close the browser and is not read by anyone else; we do not store the basket on our server and recalculate prices and availability on every visit. The cookie is strictly necessary for the basket you asked for and needs no consent (section 25(2) no. 2 TDDDG). For hosting, database and e-mail delivery we use the processors listed in the section “Processors”. Retention: We keep invoices and accounting vouchers for eight years and order data used as records of our bookkeeping for ten years (section 147 AO, section 257 HGB, section 14b UStG). We keep order and contract confirmations and other business letters for six years. The periods start at the end of the calendar year. We then use this data only for statutory retention (Art. 6(1)(c) GDPR). Invoices and business letters contain your name, for goods your address and for e-mails your e-mail address; these details remain in them until the end of the relevant period and are blocked for any other use. If the tax assessment period for the year concerned has not yet expired or legal proceedings are pending, we keep the documents until that period has expired or the proceedings have ended (section 147(3) sentence 5 AO). In the order itself we delete your contact and delivery details on 1 January of the fourth year after the last event of your order (delivery, withdrawal, refund or complaint), because claims under the contract may exist until then (Art. 6(1)(f) GDPR); if legal guarantee or other claims are still running, we delete them only afterwards. Orders that never became a contract and for which no money was paid, for example because the PayPal payment was cancelled, are deleted after 90 days.
Online withdrawal function
If you withdraw from a contract using “Withdraw from contract”, we process your name, your e-mail address, your details of the contract and the parts withdrawn, and the date and time of receipt. We need this data to receive your withdrawal, send you the acknowledgement of receipt required by law and handle the withdrawal (Art. 6(1)(c) GDPR in conjunction with section 356a BGB, and Art. 6(1)(b) GDPR). To prevent abuse we briefly count how many notices come from one connection. For this we do not store your IP address, only a hash of it formed with a secret key that changes daily, and we delete it after one day at the latest (Art. 6(1)(f) GDPR). We keep the notice of withdrawal and our acknowledgement as business letters for six years from the end of the calendar year (section 147 AO, section 257 HGB) so that we can prove what was received and when; where the notice serves as the voucher for a refund, for eight years. Notices that we cannot match to any contract with you are deleted on 1 January of the fourth year after receipt.
Signing in to the client area
You sign in to the client area without a password: you receive a one-time sign-in link and a code by email. An account exists only once you have booked with us – open registration is not possible. After signing in, your browser stores a necessary session cookie so that you stay signed in. There you see your appointments, payments, invoices, your preparation form and aftercare; you can move or cancel appointments yourself up to 48 hours before, send requests to Fanny and download your data. The legal basis is Art. 6 (1) (b) GDPR (performance of the contract).
Device notifications
You can optionally enable appointment notifications for your device in the client portal and disable them there or in your browser settings. We store the technical push address and associated keys. Your browser’s push service delivers general notices without treatment or health details. Processing is based on your consent.
Email notification
Waitlist for the booking launch: if you sign up to hear when online booking opens, we store your email address, your language, where you signed up, a referral code if you arrived through a referral link, and when you signed up, confirmed, were notified and unsubscribed. You first receive an email with a confirmation link (double opt-in) that is valid for seven days; only after you confirm are you on the list. When booking opens, you receive one email with the link to book. We delete sign-ups that were never confirmed after 30 days, unsubscribed addresses 30 days after unsubscribing, notified addresses 30 days after the notification, and all others after 12 months at the latest. Flexible dates: if you sign up in the booking area for available appointments near you, you also first receive an email with a confirmation link. We send automatic appointment offers by email only after you confirm. Fanny sees your sign-up straight away and may also contact you personally about a suitable appointment. In each case the legal basis is your consent under Art. 6(1)(a) GDPR. Each of these emails contains an unsubscribe link; an informal message to the contact address above is also enough. Withdrawal applies to the future.
Beauty tips and offers
For optional beauty tips and offers, we store your email address, language and subscription and confirmation dates. Your subscription becomes active only after email confirmation. Processing is based on your consent. Every newsletter includes an unsubscribe link; unsubscribing also stops queued campaigns. Hostinger Email delivers these messages. An unsubscribed address is deleted 30 days after unsubscribing, and a sign-up that was never confirmed after 30 days. You can request access or deletion using the contact address above.
WhatsApp contact
Our pages have buttons that let you message us on WhatsApp. They are plain links: until you click one, no connection to WhatsApp or Meta is made, no Meta script is loaded and nothing is stored on your device. When you click, your browser opens wa.me or api.whatsapp.com and then the WhatsApp app or WhatsApp Web. WhatsApp receives your IP address, technical browser and device data and the pre-filled text, and may set its own cookies. The pre-filled text only names the topic you chose, contains nothing about you, and you can change it before sending. WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, is responsible for your own use of WhatsApp. If you write to us, we process your phone number, WhatsApp name and messages to reply – for questions about a treatment or appointment to take steps towards or perform a contract (Art. 6(1)(b) GDPR), otherwise on our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Fanny replies in the WhatsApp Business app; once the Business connection is active, messages also appear in the protected admin area, visible only to Fanny and authorised administrators. WhatsApp and Meta process these messages on our behalf. Messages stored in the admin area are deleted after 180 days. Please don't send health details or photos of skin or healing over WhatsApp; use the preparation form and your client area at my.mobilepmu.com. WhatsApp is optional – you can reach us just as well at contact@mobilepmu.com.
Referral link
Referral and campaign information is stored only with your consent. Referral cookies remain for up to 60 days and campaign cookies for up to 30 days. Use “Cookie settings” in the footer to change your choice and clear these cookies.
Referral programme
If you book through a client’s referral link, she sees in her client area your first name with the first letter of your last name and whether her referral reward has been earned or paid – no appointments, prices, contact or health details. The legal basis is our legitimate interest in accounting for the reward transparently (Art. 6(1)(f) GDPR). You can object at any time by email.
Advertising measurement with your consent
With your marketing consent, we associate your booking with the campaign page and campaign identifiers. After the deposit arrives, our server may send a purchase event to Meta: amount, currency, event time, a booking identifier, and SHA-256 hashed email and phone details. Hashed contact details are pseudonymised and can be matched by Meta. Without marketing consent, this event is not created. You can book without agreeing to advertising measurement.
Understanding visits and booking steps
Only with analytics consent do we record public page visits and booking steps on our own servers. Events include a random identifier for the current browser session, language, device category, approximate network country and, where available, campaign. Names, form entries, full addresses and private booking links are excluded from this analytics data. For abuse prevention, the IP address is hashed using a secret and a daily date component; the raw IP is not stored in the analytics database. Raw events are deleted after 90 days. Do Not Track and Global Privacy Control prevent collection. Without analytics consent, we can still report on booking and payment records needed to run the service.
How long we keep data
We keep data only as long as it is needed; the system applies the following periods itself every night. Client data – name, contact details, appointments, addresses, notes: up to three years after your last appointment (limitation period, section 195 BGB), after which it is deleted. We keep invoices and accounting vouchers for eight years (section 147 AO, section 14b UStG); an invoice keeps the details printed on it, for example name and address. Requests that did not lead to an appointment and for which nothing was paid: 6 months. Interest in flexible appointments: 12 months. The waiting list for the booking launch: sign-ups never confirmed 30 days, unsubscribed addresses 30 days after unsubscribing, 30 days after the booking-launch notification, otherwise 12 months at most. Newsletter sign-ups that were never confirmed, and unsubscribed addresses: 30 days. Requests for a sign-in link: 30 days. Notifications sent, including their content: 90 days. Unpaid voucher orders: 90 days. Shop orders and online withdrawals: see the sections “Shop and orders” and “Online withdrawal function”. The periods in the relevant sections apply to health information, photos, WhatsApp messages and measurement data. On request we delete earlier where there is no duty to retain; data we only still have to retain is blocked for any other use.
Processors
Processing on our behalf: Vercel Inc. — hosting for this website and its server logs. Based in the USA; the server functions run in the Dublin region (Ireland), and pages are delivered through Vercel’s global network. Supabase Pte. Ltd. (Singapore) — database, sign-in and file storage. The project runs in the AWS region eu-west-1 (Ireland). Hostinger — sending the emails you receive. Resend — alternative email delivery when the main route is unreachable. Google Ireland Limited — address suggestions and travel-time calculation (see “Address lookup and travel time”) and the calendar entry for a confirmed home visit. WhatsApp Ireland Limited and Meta Platforms Ireland Limited, Ireland — transmitting and storing the WhatsApp messages between you and us (WhatsApp Business app and WhatsApp Cloud API), under the WhatsApp Business Data Processing Terms. Processing as independent controllers: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg — payments for deposits, balances, vouchers and shop orders, under PayPal’s own privacy terms. Shipping companies such as DHL Paket GmbH, Deutsche Post AG, DPD, GLS or Hermes, depending on the shipment — delivery of shop orders (name and delivery address). Joint controllers with us (Art. 26 GDPR): Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland — for the collection and transmission of purchase events for bookings (section “Advertising measurement with your consent”), only with your marketing consent. An arrangement (https://www.facebook.com/legal/controller_addendum) sets out that we inform you about the collection and transmission and that Meta ensures you can exercise your rights under Art. 15 to 20 GDPR for the data stored by Meta. Meta alone is responsible for any further processing (https://www.facebook.com/privacy/policy). Transfers to countries outside the EU/EEA: Vercel Inc. (USA), Google LLC (USA) and Meta Platforms, Inc. (USA) are certified under the EU-US Data Privacy Framework; the basis is the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). There is no adequacy decision for Singapore; we have therefore agreed the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914) with Supabase Pte. Ltd. (Art. 46(2)(c) GDPR). Resend (Plus Five Five, Inc., USA) is also certified under the EU-US Data Privacy Framework (Art. 45 GDPR); in addition, the standard contractual clauses in Resend's data processing agreement apply (Art. 46(2)(c) GDPR). We will send you a copy of the standard contractual clauses on request to contact@mobilepmu.com.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to complain to a supervisory authority. An email to the address above is enough. On request you receive a copy of all data stored about you as a file (Art. 15 and 20 GDPR), and we erase it unless a statutory retention duty applies (Art. 17 GDPR).