Data Protection

5Elements GmbH is the data controller responsible for the processing of personal data on this website. You can reach us at our postal address: Hubertusstr. 24, 82031 Grünwald, Germany, or by email at info@5elements-spa.de (referred to as "5Elements", "we", "us", "our").

If you have any questions about this privacy policy or wish to exercise your rights regarding your personal data, please contact our data protection officer at datenschutz@5elements-spa.de, using the subject line "Data Protection". (For general booking inquiries, please contact us at info@5elements-spa.de.)

This privacy policy also covers our online booking tool ("Anny"), which is integrated into our Website for the purpose of appointment scheduling.

This data is processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in ensuring the stable and secure operation of our website. Log files are typically deleted after 7 days, unless longer retention is required for security purposes (e.g., investigating an attack).

Furthermore, certain offers or services may require you to provide personal data such as your name or email address, and possibly other personal information. Required information is always marked as mandatory. Without this information, 5Elements may not be able to provide you with the requested service or respond to any inquiries you may have. Below, we provide an overview of the related data processing activities and legal bases.

Booking an appointment via our online booking platform (Anny)

Our website provides information about our treatments and the option to book an appointment via our online booking platform (Anny). To complete a booking, you will be asked to provide certain personal data in the booking form, such as your name, email address, and phone number. We use this data solely to process your requested booking and to respond to related inquiries. This processing is based on Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures).

If you proceed to book a treatment, we will also process additional personal data, such as your contact details and, where applicable, your payment information, which is necessary to process your payment. Depending on the payment method you choose, we may request further information from you. This processing is based on Art. 6(1)(b) GDPR (performance of a contract). Information required for booking and confirmation is marked accordingly; all other information, such as your mobile phone number, is provided voluntarily.

The processing of the aforementioned data is carried out for the performance of our contract with you or for pre-contractual measures (Art. 6(1)(b) GDPR). We work with service providers to fulfill our services. Further information on this can be found under "Disclosure of Personal Data".

Contacting Us via Contact Form or Email

If you contact us (e.g., via contact form or email), we will store and process the personal data you provide, which typically includes your name and email address. The specific data collected in each case is indicated on the respective form. This data is used solely for responding to your inquiry, contacting you, and for related technical administration. This processing is carried out for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), or is based on our legitimate interest, without your interests overriding this interest, as processing such inquiries is in the mutual interest of both parties (Art. 6(1)(f) GDPR). We delete this data once your inquiry has been conclusively resolved, unless statutory retention obligations require longer storage.

Receive our newsletter

To send our newsletter, we use the email marketing platform Flodesk, provided by Flodesk Inc., based in the United States. When you sign up, you will receive a confirmation email and must actively confirm your subscription before receiving further emails (double opt-in). This processing is based on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time via the unsubscribe link in every email. As Flodesk is based in the US, your data may be transferred outside the EU/EEA; this transfer is safeguarded by the EU Standard Contractual Clauses.

We use Flodesk to analyze the performance of our newsletter campaigns. When you open an email sent via Flodesk, a small file embedded in the email (a so-called web beacon) connects to Flodesk's servers in the USA. This allows us to determine whether a newsletter has been opened and which links, if any, were clicked. Technical information is also collected (e.g., time of access, IP address, browser type, and operating system) and is linked to your email address in order to evaluate individual engagement with our newsletters. The results of this analysis help us tailor future newsletters to the interests of our recipients. This processing is based on your consent (Art. 6(1)(a) GDPR), given when you subscribed to our newsletter.

If you do not want your engagement with our newsletters to be analyzed via Flodesk, you can unsubscribe from the newsletter at any time. As individual tracking cannot currently be disabled separately, unsubscribing is the only way to fully opt out of this analysis. You will find an unsubscribe link in every newsletter email, or you may unsubscribe directly on our website.

Data processing is based on your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by unsubscribing from the newsletter. The lawfulness of data processing operations already carried out remains unaffected by the withdrawal.

The data you provide for the purpose of subscribing to our newsletter will be stored until you unsubscribe. After you unsubscribe, this data will be deleted from both our systems and Flodesk's servers.

For more information, please refer to Flodesk's privacy policy at: https://flodesk.com/privacy https://Infusionsoft.com/legal/terms/.

Data Processing Agreement

We have entered into a Data Processing Agreement with Flodesk, in which Flodesk commits to protecting our customers' data in accordance with applicable data protection law and to processing it solely on our behalf and instructions.

Participation in prize draws

Our website contains links to our Instagram and Facebook profiles. These are simple links; no data is transmitted to Meta Platforms, Inc. (the operator of Instagram and Facebook) merely by visiting our website. Data is only transmitted once you actively click on one of these links and are redirected to the respective platform. Once redirected, the respective privacy policy of Meta applies.

We use cookies for various purposes. These are small text files that are stored on your device. These text files can be read by websites and help identify you when you revisit a website. Some cookies are used to store your preferences and are automatically deleted once you close your browser (so-called session cookies). Other cookies help us tailor the website to user needs and remain on your device for a longer period (so-called persistent cookies). Below, we explain which cookies we use and how you can object to their use.

We use the consent management platform Cookiebot to manage cookie consent on our website. Based on your consent settings, we use Google Tag Manager (Google Ireland Limited) to manage tracking tags, including Meta Pixel (Meta Platforms Ireland Limited). These tools are only activated after you have given your explicit consent via our Cookiebot banner; until you consent, no such cookies are set and no data is transmitted to these providers. Meta Pixel allows us to measure the effectiveness of our advertising campaigns and to display tailored advertising to you on Facebook and Instagram. In this context, data may be transferred to Meta Platforms, Inc. in the USA. Together with Meta, we are joint controllers for certain aspects of this processing in accordance with Art. 26 GDPR. This processing is based on your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). You may withdraw your consent at any time with effect for the future via the Cookiebot settings on our website.

Google Tag Manager & Meta Pixel

Google Analytics & Meta Pixel We use the consent management platform Cookiebot to manage cookie consent on our website. Based on your consent settings, we use Google Tag Manager (Google Ireland Limited) to manage the following tracking tools: Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"), allows us to analyze how our website is used and to improve it based on these insights. Google is certified under the EU-U.S. Data Privacy Framework, providing an appropriate level of protection for data transferred to the USA. Meta Pixel, provided by Meta Platforms Ireland Limited, allows us to measure the effectiveness of our advertising campaigns and to display tailored advertising to you on Facebook and Instagram. In this context, data may be transferred to Meta Platforms, Inc. in the USA. Together with Meta, we are joint controllers for certain aspects of this processing in accordance with Art. 26 GDPR. Both tools are only activated after you have given your explicit consent via our Cookiebot banner; until you consent, no such cookies are set and no data is transmitted to these providers. This processing is based on your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). You may withdraw your consent at any time with effect for the future via the Cookiebot settings on our website.

Except as described in this Privacy Policy, 5Elements does not share your personal data with third parties. Personal data may be disclosed to processors acting on our behalf to further process the data for its original purpose, such as fulfilling and processing a booked service, evaluating the usability of our website, or providing technical support. These processors are contractually bound to 5Elements through data processing agreements in accordance with Art. 28 GDPR, obligating them to use personal data only for the agreed purpose and not to disclose it to other parties without authorization, unless legally required to do so. The specific processors we work with are listed below. Should additional categories of recipients arise in the future, we will update this section accordingly.

If we transfer your personal data to countries outside the European Economic Area (EEA), which may have different data protection standards than your country of residence (so-called "third countries"), we take appropriate measures to ensure an adequate level of protection, as set out below. Please note that data processed in such countries may nonetheless be subject to local laws and could be accessible to government authorities, courts, or regulators in that country. Depending on the recipient, transfers are safeguarded either through an adequacy decision by the European Commission or through the EU Standard Contractual Clauses. For further information on these safeguards, please contact us at datenschutz@5elements-spa.de.

We limit the processing of your data to the minimum necessary. If you send us an inquiry, we will generally delete your data once it has been processed. Unless specific retention periods are stated elsewhere in this privacy policy, we only store your data until the purpose for which it was collected has been fulfilled. We retain your data beyond this point only where statutory, regulatory, or contractual retention periods require it, or where further storage is necessary for the establishment, exercise, or defense of legal claims. For example, we are legally required to retain transaction-related data (including address, payment, and booking information) for six to ten years due to German commercial and tax law requirements. This storage is based on the fulfillment of a legal obligation (Art. 6(1)(c) GDPR).

Depending on the circumstances of the specific case, you have the following rights:

• You have the right to request access to your personal data and/or copies of this data. This includes information about the purpose of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, and, where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period.
• To request the rectification, erasure or restriction of the processing of your personal data insofar as its use is unlawful under data protection law, in particular because (i) the data is incomplete or inaccurate, (ii) it is no longer necessary for the purposes for which it was collected, (iii) the consent on which the processing was based has been withdrawn, or (iv) you have successfully exercised a right to object to data processing; in cases where the data is processed by third parties, we will forward your requests for rectification, erasure or restriction of processing to these third parties, unless this proves impossible or involves disproportionate effort.
• You have the right to withdraw your consent to the processing of your personal data at any time, without affecting the lawfulness of the processing carried out on the basis of that consent before its withdrawal.
• You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. 5Elements does not use automated decision-making of this kind; our booking system merely displays available appointment slots based on current capacity.
• You have the right to request the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit this data to another controller without hindrance from us; where technically feasible, you also have the right to request that we transmit the personal data directly to another controller.
• You have the right to lodge a complaint with the supervisory authority responsible for the controller or the supervisory authority in the Member State where you live or work if you believe that the processing of your personal data infringes the General Data Protection Regulation. The supervisory authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 27, 91522 Ansbach, Germany