Privacy policy

This is a translation for your convenience. Only the German version is legally binding.

Controller

The controller responsible for processing your personal data is:

Data protection officer

A data protection officer is not required under Art. 37 GDPR. If you have any questions about data protection, you can contact us at any time at the address above.

Provision of the website and log files

The following data is collected automatically each time our website is accessed:

• IP address
• date and time of the request
• time zone difference to GMT
• page requested
• HTTP status code
• amount of data transferred
• referrer URL
• browser type and version
• operating system
• language of the browser software

The processing serves to ensure the trouble-free operation of the website.

Legal basis: Art. 6 (1) (f) GDPR

Storage period: log data is stored for a maximum of 30 days.

Hosting: our website is hosted by Netlify, Inc. (San Francisco, USA), which processes the log data on our behalf (Art. 28 GDPR). Data may be transferred to the USA; the transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, additionally, the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).

Language selection: when you open the home page, our server evaluates your browser’s language setting or a language cookie you set previously in order to direct you to the appropriate language version (German, English, Turkish). Nothing is stored in the process.

Rights of data subjects

You have the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object (Art. 21 GDPR)
• withdraw consent given (Art. 7 (3) GDPR)

Please send requests to: haarweltklinik@gmail.com

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority:
Berlin Commissioner for Data Protection and Freedom of Information
www.datenschutz-berlin.de

Cookies

Our website uses cookies and similar storage technologies. Cookies are small text files that are stored on your device.

Without your consent, we only use what is strictly necessary for the use you have requested (Section 25 (2) no. 2 TDDDG; legal basis for further processing: Art. 6 (1) (f) GDPR):

• hw_consent (local storage, 12 months): your choice in the cookie banner.
• hw_lang (cookie, 12 months): the language you selected – only if you change the language yourself.
• Session storage (deleted when you close the browser): campaign information from the link that brought you to us (utm parameters), whether you closed the language notice, and a one-time hand-over to the thank-you page after submitting the form (without name, phone number or email address).

In the cookie banner you can also consent to “Statistics”, “Marketing” and “Instagram content” (see “Instagram embedding”) (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You can change or withdraw your decision at any time via the “Cookie settings” link at the bottom of every page.

You can also deactivate cookies at any time in your browser settings.

Analysis and tracking tools

We currently do not use any analysis, tracking or advertising services on this website; no data is transmitted to Google Analytics, Google Ads or Meta.

Should we use such services in future, this will only happen with your consent in the cookie banner. We will update this privacy policy accordingly beforehand.

Social media links

Our website contains links to social networks (Instagram, TikTok, YouTube). These are simple links, not embedded plugins. When you click these links, the privacy policies of the respective providers apply.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content – such as your enquiry via the contact form – this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

Contact form and processing of your enquiry

If you send us an enquiry via the “Free online consultation” form, we process the following information: name, phone number, email address (optional), the treatment you are interested in, whether you have already had a hair transplant, preferred call-back time and your message. In addition, we transmit technical information: language, page and section of the form, version of the consent text, your choice in the cookie banner, a random identifier of the enquiry, the browser identifier (user agent) and, where applicable, campaign information (utm parameters). If you have consented to “Marketing” in the cookie banner, we also store the click identifier of the advert that brought you to us (e.g. gclid, fbclid).

The purpose is to handle your enquiry: call-back, free consultation and preparation of a possible treatment. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures at your request). Name, phone number and consent are required; without them we cannot process the enquiry.

Health data: the information about a previous hair transplant is health data (Art. 9 (1) GDPR). We only process it with your explicit consent (Art. 9 (2) (a) GDPR), which you give by ticking the box in the form. Please do not enter any further health data in the message field – we will discuss details in person.

Storage: your enquiry is stored in our enquiry management system. It runs on Google services (Google Sheets and Google Apps Script) in our account; the provider is Google Ireland Limited, Dublin, Ireland. Google processes the data on our behalf (Art. 28 GDPR). A transfer to Google LLC in the USA cannot be ruled out; it is based on the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses. The responsible staff are notified of new enquiries by email.

Storage period: we delete your enquiry data as soon as it is no longer required for processing. If no treatment takes place, we delete it no later than 12 months after the last contact. If a treatment takes place, the statutory retention periods for patient records apply (usually 10 years under Section 630f of the German Civil Code).

Withdrawal: you can withdraw your consent at any time with effect for the future, for example by email to haarweltklinik@gmail.com. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Contact by phone, email and WhatsApp

If you call us, write an email or contact us via WhatsApp, we process the data you provide (e.g. name, phone number, content of your message) to handle your request. The legal basis is Art. 6 (1) (b) GDPR insofar as your request concerns a consultation or treatment, otherwise Art. 6 (1) (f) GDPR. We delete the data according to the same rules as for the contact form.

WhatsApp is operated by WhatsApp Ireland Limited, Dublin, Ireland, a Meta group company. Data may be transferred to Meta Platforms, Inc. in the USA (EU-U.S. Data Privacy Framework). Messages are end-to-end encrypted, but WhatsApp processes metadata. WhatsApp only opens when you click a WhatsApp link; no data is transferred to WhatsApp beforehand. For sensitive information we recommend a phone call or a personal meeting.

Instagram embedding (Meta Platforms Ireland Ltd.)

On our home page and our “About us” page we show a video from our Instagram profile. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The video is only loaded when you click “Watch video on Instagram” or have consented to the “Instagram content” category in the cookie banner (“two-click solution”). Until then we only show our own preview image; no connection to Instagram is established.

Once loaded, data such as your IP address, the page viewed, browser and device information is transferred to Meta; Meta may set cookies. If you are logged in to Instagram, Meta can assign the visit to your account. A transfer to Meta Platforms, Inc. in the USA is possible; it is based on the EU-U.S. Data Privacy Framework.

The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), which you give by clicking or in the cookie banner. You can withdraw your consent for “Instagram content” at any time via “Cookie settings” at the bottom of every page. We are jointly responsible with Meta for collecting and transmitting the data to Meta (Art. 26 GDPR); any further processing is the sole responsibility of Meta. More information: privacycenter.instagram.com/policy.

The “View on Instagram” link below the video is a simple link: data is only transferred when you click it.

Google Maps (only after a click)

The map on our contact pages is only loaded when you click “Show map” (“two-click solution”). No connection to Google is established beforehand. After your click, data such as your IP address, the page viewed and device information is transmitted to Google Ireland Limited, Dublin, Ireland; a transfer to Google LLC in the USA is possible (EU-U.S. Data Privacy Framework). The legal basis is your consent given by clicking (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG).

The links “Open in Google Maps” and “View Google reviews” lead to our Google Business Profile. They are simple links: data is only transferred when you click them; Google’s privacy policy then applies.

Last updated

Last updated: October 2026