Skip to content

Privacy Policy of Beautylounge AG

Updated: 26 October 2026

In this policy, we, Beautylounge AG, explain which personal data we process, what we need it for and what rights you have. Personal data means any information relating to an identified or identifiable person. This policy is based on the Swiss Federal Act on Data Protection (FADP). Where the European General Data Protection Regulation (GDPR) applies in an individual case, for example because you live in France or Germany, it applies in addition.

This policy addresses all our clients, applicants and website visitors as “you”.

1. Controller and contact

The controller responsible for the data processing operations described here is:

Beautylounge AG
Reichensteinerstrasse 16A
4053 Basel
Switzerland
Email: info@beautylounge.ch
Telephone: +41 61 281 25 10

For all questions about data protection and to exercise your rights, the easiest way is to write to info@beautylounge.ch with the subject line “Datenschutz” (data protection).

2. What personal data we process

Depending on how you are in contact with us, we process the following data:

  • Contact and master data: name, address, email address, telephone number, date of birth, language.

  • Appointment and client data: treatments booked, appointments, studio, responsible team member, treatment history, notes on wishes and preferences, gift vouchers, loyalty points, product purchase history.

  • Health-related information, insofar as it is necessary for a safe treatment: for example allergies, skin condition, medication, pregnancy or contraindications for laser, permanent make-up and skin treatments. This information is sensitive personal data. We only collect it with your express consent by means of our consent forms before the treatment.

  • Photos and videos: we only take and use before-and-after pictures and recordings for our communications with your separate, voluntary consent (see section 9).

  • Payment data: payment method, amount, date. We do not process card data ourselves. This is handled by Nexi for card payments in the studios and by Stripe for the online payment of gift vouchers.

  • Communication data: content and time of emails, telephone calls, messages via WhatsApp, Instagram, Facebook Messenger and Telegram, chat histories and reviews.

  • Application data: CV, references and certificates, photos of work, information on training and experience (see section 8).

  • Website usage data: IP address, date and time of the visit, pages accessed, browser and device type used, referring website, approximate location at regional level (see sections 5 and 6).

3. What we need your data for and what legal basis we rely on

We process personal data for the following purposes:

  • Booking appointments, carrying out and following up on your treatments, selling products and gift vouchers, invoicing. Legal basis: performance of the contract with you.

  • Safe treatment and advice, including checking for contraindications. Legal basis: your consent and the protection of your health.

  • Appointment reminders, appointment confirmations and follow-up questions about your appointment by SMS, email or WhatsApp. Legal basis: performance of the contract.

  • Information about offers, news and promotions, requests for reviews after a visit, and our referral programme. Legal basis: our legitimate interest in maintaining client relationships, provided you have not objected, or your consent where the law requires it. You can unsubscribe from such messages at any time (section 10).

  • Operation, security and improvement of our website and our systems. Legal basis: legitimate interest.

  • Audience measurement and advertising on the internet. Legal basis: your consent in the cookie banner (section 6).

  • Answering enquiries, complaints and reviews. Legal basis: contract and legitimate interest.

  • Application process. Legal basis: initiation of an employment contract.

  • Compliance with legal obligations, in particular bookkeeping and retention obligations, and the assertion of and defence against legal claims.

You can withdraw any consent you have given at any time with effect for the future.

4. Appointment booking and client management with Phorest

We manage our appointments, client records, consent forms, gift vouchers and the loyalty programme in the salon software Phorest from Phorest Salon Software Ltd, Dublin, Ireland. Phorest processes this data on our behalf on servers in the European Union and is contractually obliged to ensure data protection.

When you book online, you are redirected from our website to Phorest’s booking page (phorest.com). There you enter your name, email address, telephone number and, where applicable, a password for your client account. The booking page sets its own technically necessary cookies. In addition, Phorest’s privacy policy applies.

We send appointment confirmations and appointment reminders by SMS and email via Phorest. With your consent, you will also receive information about offers, birthday greetings, review requests and messages from our loyalty and referral programme through the same channel. Every marketing message includes an option to unsubscribe. You can ask us to change the settings at any time in the studio or by email.

Beautylounge app: In our app for Android and iOS, you can open a client account (with a verification code), view your client card and discounts, and book appointments. We store the account, client card and discounts on our own server at DigitalOcean in Frankfurt (Germany); appointments are handled via Phorest. We send push notifications via Firebase Cloud Messaging from Google Ireland Ltd; for this purpose, a device identifier is stored at Google, and Google may transfer data to the USA. You can switch off push notifications at any time in your phone’s settings. The terms of the Google and Apple app stores also apply.

5. Website: hosting, server logs and necessary cookies

Our website beautylounge.ch is operated on a server of Hetzner Online GmbH in Falkenstein, Germany. Whenever a page is accessed, the server automatically logs the IP address, date and time, the address accessed, the amount of data transferred, browser and operating system, and the referring page. We need these logs to operate the website securely and reliably and to detect attacks. They are deleted after 30 days at the latest, unless they are needed for longer to investigate a specific incident. We make encrypted backup copies of the website every day.

Technically necessary cookies and storage entries that are set without consent:

  • Session and security cookies of our system (Statamic), which maintain the session and protect the forms against misuse during your visit. They expire after two hours.

  • The storage of your cookie choice in the browser, so that we do not have to ask you on every visit. It remains valid for six months.

  • The language choice of the translation function (section 7).

We deliver fonts and images from our own server. No fonts are loaded from Google or other providers.

6. Cookie banner, statistics and advertising

On your first visit, we ask you in the cookie banner which services we may use. Without your consent, only the necessary functions run. You can change or withdraw your choice at any time via the cookie symbol at the bottom left of every page.

The services are integrated via Google Tag Manager from Google Ireland Ltd, Dublin. The Tag Manager itself does not set any cookies; it only controls which of the following services are loaded after your consent.

Category “Statistics”, only with consent:

  • Google Analytics 4 (Google Ireland Ltd, Dublin, Ireland). Measures how our website is used: pages accessed, time spent, source of visits, device type, approximate location. The IP address is used by Google only briefly to determine the region and is not stored. Google may transfer the data to the USA. Google LLC is certified under the Swiss-U.S. Data Privacy Framework. The usage data is deleted by Google after 14 months.

Category “Marketing”, only with consent:

  • Google Ads conversion tracking and remarketing (Google Ireland Ltd). Shows whether someone books an appointment after clicking on our ad, and allows us to show visitors to our website relevant ads on Google later.

  • Meta Pixel (Meta Platforms Ireland Ltd, Dublin, Ireland). Serves the same purpose for ads on Facebook and Instagram. If you are logged in there, Meta can associate the visit with your account. Meta Platforms Inc. is certified under the Swiss-U.S. Data Privacy Framework.

  • TikTok Pixel (TikTok Technology Ltd, Dublin, Ireland). Serves the same purpose for ads on TikTok. Data may be transferred to countries outside Switzerland and the EU; TikTok safeguards such transfers with the standard contractual clauses of the European Commission.

We use Google Consent Mode. As long as you have not given your consent, Google, Meta and TikTok do not receive any cookies or personal identifiers from our website. In part, the providers also process the data for their own purposes; they are themselves responsible for this. You can find their privacy policies at policies.google.com/privacy, facebook.com/privacy/policy and tiktok.com/legal/privacy-policy.

7. Translation with Weglot

For the English language version, we use the translation service Weglot from Weglot SAS, Paris, France. When you switch language, your browser loads a script from Weglot. In the process, the texts of the page you are viewing and your IP address are transmitted to Weglot, and Weglot stores your language choice in a cookie. Weglot processes the data on our behalf in the EU.

8. Chat assistant Ella, gift vouchers, applications and payments

Chat, WhatsApp, Instagram, Facebook Messenger, Telegram and email: On our website, via WhatsApp, in direct messages on Instagram, Facebook and Telegram, and in emails to our studios and to info@beautylounge.ch, our digital assistant “Ella” answers questions and books, reschedules and cancels appointments. Ella is an AI-powered assistant, not a human being. Where necessary, Ella passes the request on to our team. Ella is operated by aleksa.ai, a service offered by Spalevic Consulting Kft., Budapest, Hungary. The messages, your telephone number, email address or profile name or, as the case may be, an anonymous chat identifier, and the information required for the booking are processed on the platform of aleksa.ai. To look you up and book appointments, Ella accesses your client record in Phorest. The conversations and the associated files are held in a database at Supabase in Frankfurt (Germany); supplementary technical services run at Railway in Amsterdam (Netherlands). The chat interface on our website is delivered via the Netlify service; in the process, your IP address is processed, and Netlify may transfer data to the USA. To formulate responses, aleksa.ai transmits the content of the conversation to OpenAI’s AI models. The use of this data for training and improving the models is switched off, and OpenAI does not additionally store the responses; the conversation history is held only in the database of aleksa.ai. OpenAI may keep time-limited security logs to detect misuse. In the process, data may reach the USA (see section 12). If you mention important information about your appointment in the conversation, for example an allergy or that you are running late, Ella can save it in Phorest as a note on your appointment so that the studio is informed. We record detailed health information in the studio by means of the consent form; please do not send it in the chat. If you send photos in connection with a complaint, Ella stores them unchanged in non-public storage at Supabase in Frankfurt and passes them on to the studio via a protected link or adds the link to the appointment concerned. If you would like, via WhatsApp, an appointment that becomes available at short notice, the system regularly checks the calendar until the end of your preferred period and gets in touch automatically if a slot becomes available. We store the conversations so that we can answer follow-up questions and improve the quality of the responses. Closed conversations are automatically deleted twelve months after the last contact, together with the photos. Open requests remain stored until they have been resolved. If the studio has received a photo by email, the retention period for email correspondence applies to that copy (section 13). For WhatsApp, Instagram, Facebook and Telegram, the privacy policies of the respective providers also apply.

Gift voucher orders: Using the form on the gift voucher page, we collect name, address, email address, amount, recipient and your message. Payment is processed via Stripe (Stripe Payments Europe Ltd, Dublin, Ireland). You enter your card details directly on Stripe’s payment page; we only see whether the payment has been made. Stripe may transfer data to the USA; Stripe, Inc. is certified under the Swiss-U.S. Data Privacy Framework. We store the order data in our website’s system and send it by email to our office. We keep it for as long as the gift voucher is valid and thereafter in accordance with the retention obligations for business records.

Applications and trial week: You can apply via our job pages and upload your CV, references and certificates, and photos of your work. This data is sent to our HR department (hr@beautylounge.ch) and is used exclusively for the application process. If no employment relationship is established, we delete the documents no later than six months after the end of the process, unless you agree that we may keep them for future vacancies.

Email and telephone: If you write to us or call us, we process your details in order to respond to your request. Our email mailboxes are operated by cyon AG in Basel on servers in Switzerland.

Card payments in the studio: If you pay by card in the studio, Nexi processes the payment via its card terminal. We only receive the amount, date, card type and a truncated card number.

9. Photos, videos and reviews

We only take and publish before-and-after pictures of your treatment, and photos or videos in which you can be recognised, with your separate written consent. This consent is voluntary and independent of the treatment. You can withdraw it at any time with effect for the future; we will then remove posts that have already been published, insofar as this is technically within our control.

Reviews that you post on Google, Tripadvisor or other platforms are public. We show selected reviews on our website with first name, date and source. If you would like us to stop showing a review there, an email is sufficient.

10. Unsubscribing from marketing

You can unsubscribe from promotional SMS, marketing emails and messages from the loyalty and referral programme at any time: via the unsubscribe link in the message, by replying “STOP” to an SMS, in the studio or by email to info@beautylounge.ch. You will continue to receive appointment confirmations and appointment reminders as long as you have appointments with us.

11. Social media and external links

Our website links to our profiles on Instagram, Facebook, TikTok, YouTube and LinkedIn, to WhatsApp and to Google Maps. These are simple links, not embedded plug-ins; these providers do not receive any data from you when you merely visit our website. If you click on a link, the privacy policy of the respective provider applies. We are jointly responsible with Meta for the statistics of our Facebook and Instagram pages; Meta only provides us with anonymised analyses.

12. Disclosure to third parties and transfers abroad

We only pass on personal data where this is necessary for the purposes stated, namely to:

  • Processors who process data on our behalf and are contractually bound by our instructions: Phorest (salon software, Ireland), Hetzner (website hosting, Germany), cyon (email, Switzerland), Weglot (translation, France), aleksa.ai (chat assistant, Hungary; data at Supabase in Germany and Railway in the Netherlands, chat interface via Netlify, USA) with OpenAI (AI models, USA), DigitalOcean (app server, Germany), Google Firebase (app push notifications, Ireland and USA), Google (Tag Manager, Analytics, Ads, Ireland and USA), Meta (advertising, Ireland and USA), TikTok (advertising, Ireland), Nexi (card payments in the studios), Stripe (online payment of gift vouchers, Ireland and USA) and our accounting and fiduciary office.

  • Banks and payment service providers for processing payments.

  • Authorities and courts, where we are legally obliged to do so or to enforce our rights.

  • Insurers and legal representatives in the event of a claim.

Our service providers are based in Switzerland, in the European Union and in some cases in the USA. An adequate level of data protection exists for the EU and the EEA. For the USA, we rely on the recipient’s certification under the Swiss-U.S. Data Privacy Framework or on the standard contractual clauses of the European Commission with the adaptations required for Switzerland.

13. How long we keep data

  • Client record in Phorest: ten years after your last visit or purchase. After that, Phorest deletes the record automatically. On request, we will delete it earlier, unless a retention obligation prevents this.

  • Consent forms for treatments: ten years from the treatment, because they form the basis for any questions of liability.

  • Invoice and payment data, gift voucher orders: ten years in accordance with the bookkeeping obligation (Art. 958f of the Swiss Code of Obligations, OR).

  • Application documents: six months after the end of the process.

  • Server logs: 30 days.

  • Conversations with Ella, including photos: twelve months after the last contact; open requests until they have been resolved.

  • Usage data in Google Analytics: 14 months.

  • Email correspondence: for as long as it is needed for the request and for evidential purposes, for a maximum of ten years.

14. Data security

We protect your data with technical and organisational measures: encrypted transmission (HTTPS) on our website, access to client data only for team members who need it for their work, personal logins with password rules, regular backup copies, training of the team and contractual obligations on our service providers.

15. Your rights

You have the right to:

  • request information about which personal data we process about you;

  • have incorrect data corrected;

  • request the deletion of your data, insofar as there is no retention obligation;

  • have the processing restricted and object to it, in particular to the use of your data for advertising;

  • obtain the data you have provided to us in a common electronic format or have it transferred to another party;

  • withdraw any consent you have given at any time.

To do so, write to info@beautylounge.ch or to our postal address (section 1). To make sure that we are dealing with the right person, we may ask for proof of identity. We usually respond within 30 days. Information is provided free of charge, except where the effort involved is manifestly disproportionate.

You can also lodge a complaint with the competent supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch. If you live in the EU, you can contact the data protection authority of your country of residence.

16. Minors

The age rules in our terms and conditions apply to treatments for minors. Where we need the consent of the parents or legal guardians for a treatment, we collect their contact details and signature.

17. Changes

We will adapt this privacy policy if our data processing or the legal situation changes. The version currently published on beautylounge.ch applies. The date of the current version is shown at the top.

WhatsApp floating icon
WhatsApp floating icon