Privacy policy
Updated: 03.10.2026
1. Controller
The controller for this website and your enquiries is Marina Vaal, Marina Vaal Extensions, Willerstwiete 17, 22415 Hamburg, Germany. Email: marina.vaal@gmx.de; phone: +49 172 1084275.
2. Website delivery and security
Serving this website requires connection data, including IP address, time, requested address and browser/device information. The site is hosted through ChatGPT Sites (OpenAI) and Cloudflare. Processing serves our legitimate interest in delivering and securing the site (Article 6(1)(f) GDPR). Data is retained only as necessary for operation, troubleshooting, abuse prevention or legal duties; information about a specific security incident may be retained until it is resolved. We use no externally loaded fonts, embedded maps or social media feeds.
3. Contact and appointment enquiries
The form prepares a WhatsApp message locally in your browser. This website does not store form contents on its server. Clicking “Open enquiry in WhatsApp” already passes your entries to WhatsApp as part of the link; you then decide whether to send the message to us. You may instead use phone or email. Do not enter health data or other sensitive information in the free-text field. We handle service enquiries to take steps towards or perform the requested contract (Article 6(1)(b) GDPR), and other enquiries under our legitimate interest in answering them (Article 6(1)(f)). Enquiries no longer needed are deleted after they are resolved, unless legal retention duties or evidence of an agreement require longer storage. Providing details is voluntary, but we need a way to contact you to respond. The form does not make a binding booking or purchase.
4. Google Analytics – with consent only
Google Analytics 4 loads only after you choose “Allow analytics”. The EEA provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It measures page views, page/referrer addresses with query parameters removed, device/browser information and expressly configured contact clicks (channel and language). Google uses IP addresses technically for communication and approximate location; according to Google, GA4 does not store individual IP addresses. Names, free text, requested dates and complete WhatsApp links are not passed to Analytics. Automated enhanced measurement is disabled; Google Signals and personalised advertising are not enabled. The legal bases are Article 6(1)(a) GDPR and § 25(1) TDDDG. Analytics cookies are configured to last 60 days. This GA4 property retains event data for 2 months and user data for 14 months. New user activity resets the user-data retention period. These limits do not apply to most aggregated standard reports. Consent is optional and is not required to use the website. Withdraw it at any time in “Cookie settings”; collection then stops and accessible Analytics cookies are removed. Withdrawal does not affect the lawfulness of earlier processing.
5. Remembering your choice
Consent or refusal is stored under mv-consent-v1 in browser local storage for up to 180 days, solely to implement your choice (§ 25(2)(2) TDDDG and Article 6(1)(f) GDPR). See the cookie information for details. You can change your choice or clear browser storage at any time.
6. External services and international processing
WhatsApp (WhatsApp Ireland Limited), Instagram (Meta Platforms Ireland Limited) and Google Maps (Google Ireland Limited) are contacted only when you open their links. Their privacy information then also applies. Hosting, analytics and external services may involve recipients or affiliated companies outside the EEA, especially in the USA. Where applicable, transfers may rely on an adequacy decision such as the EU-US Data Privacy Framework or Article 46 GDPR safeguards, particularly standard contractual clauses. You can request details of the recipients and safeguards applicable to our processing at the contact address above. We do not sell personal data or make solely automated decisions through this website that have legal or similarly significant effects.
7. Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction and data portability (Articles 15–20 GDPR). You may object to processing based on legitimate interests for reasons relating to your particular situation (Article 21 GDPR). You may withdraw consent at any time for the future. Contact marina.vaal@gmx.de. You may complain to a supervisory authority, particularly where you live or work or where an infringement is suspected. Hamburg’s authority is the Hamburg Commissioner for Data Protection and Freedom of Information: datenschutz-hamburg.de.
Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit · Google Privacy