Privacy Policy

We take the protection of your personal data very seriously. This Privacy Policy explains what personal information we collect when you visit our website, use our services (including login, appointment booking, analytics, contact forms, and newsletter registration), and how we use it in compliance with the General Data Protection Regulation (GDPR).

1. Controller

Qubin GmbH
Hauptstraße 364
51465 Bergisch Gladbach
Email: info(at)qubin.de
Phone: +49 (0) 160 97686213

2. Collection and Use of Personal Data

You can generally use our website without providing personal data. However, certain features require the collection of personal information:

• Contact Forms: Name, email address, phone number, and message content when you contact us.
• Newsletter Signup: Email address and, if applicable, name. Consent is required.
• Login System: Account data such as username, email address, password (encrypted), profile information.
• Appointment Booking: Name, contact information, selected date/time, and service details.
• Analytics (e.g., Google Analytics): IP address (anonymized), browser type, pages visited, usage behavior.
• Cookies: Technical, functional, and (if consent is given) analytical or marketing cookies.

3. Legal Basis of Processing

We process personal data based on the following legal grounds according to Art. 6 GDPR:

• Performance of a contract or pre-contractual measures (Art. 6(1)(b)).
• Consent (Art. 6(1)(a)) — e.g., newsletter registration, analytics, optional cookies.
• Legitimate interests (Art. 6(1)(f)) — e.g., website security, fraud prevention, basic analytics.
• Legal obligation (Art. 6(1)(c)) — e.g., record-keeping, tax regulations.

4. Cookies

We use cookies to enable essential site functionality (login, appointments, session management) and, with your consent, for analytics and marketing. You can adjust your cookie preferences at any time via the cookie banner or browser settings.

5. Analytics and Tracking

We use analytics tools (e.g., Google Analytics or similar) to analyze website usage. IP addresses are anonymized before processing. Tracking only takes place after you have given explicit consent.

6. Data Sharing

Personal data is not shared with third parties unless required for service provision (e.g., appointment scheduling service providers, newsletter platforms), legal obligations, or with your consent. All third-party processors are GDPR-compliant under Data Processing Agreements (DPAs).

6a. Messages via Instagram and Facebook

When you send a message to one of our accounts on Instagram or Facebook (NailMe, TattooMe, HairMe, CraftMe), Meta Platforms Ireland Ltd. passes it to us through the official Meta interface so that we can answer it. We store your Instagram- or Facebook-scoped user ID, your public name and username, the content and attachments of the conversation and the time of each message. Legal basis is our legitimate interest in answering your request and, where you contact us about our services, pre-contractual measures (Art. 6(1)(f) and (b) GDPR). The data is stored on Google Cloud (Firebase) and kept for as long as the conversation and the resulting business relationship require it. You can ask us at any time to delete your conversation data: info(at)qubin.de. For Meta's own processing, see Meta's privacy policy.

7. Data Security

All personal data is transmitted via SSL/HTTPS and stored securely. Login credentials are encrypted and access is restricted to authorized personnel only. However, no internet-based transmission can be guaranteed to be 100% secure.

8. Data Retention

We retain personal data only for as long as necessary to fulfil contractual obligations, legal requirements, or as long as consent remains valid. Once it is no longer required, it will be deleted or anonymized.

9. Your Rights Under GDPR

You have the right to:

• Access your personal data (Art. 15 GDPR)
• Rectify inaccurate data (Art. 16 GDPR)
• Request deletion (Art. 17 GDPR)
• Restrict processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdraw consent at any time (Art. 7(3) GDPR)
• Object to data processing (Art. 21 GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

10. Objection to Advertising Emails

The use of contact data published due to legal disclosure requirements for sending unsolicited advertising or information materials is hereby prohibited. We reserve the right to take legal action in case of unsolicited promotional messages (e.g., spam).

11. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal or technical changes. The current version is always available on this page.