Privacy policy

This page explains which personal data is processed when you use the website or submit an appointment or contact request.

Back to home

1. Controller

The controller responsible for personal data processed through this website is:

Name / business: Weronika Cacko
Street and number: Schiersteiner Straße 32
Postal code: 65187
City: Wiesbaden
Privacy contact: cackobiznes@gmail.com

2. Processing principles

We process personal data only where needed to operate this website, respond to enquiries, or prepare and provide an appointment.

The data involved depends on which functions you use and what you choose to enter in a form.

3. Hosting and server logs

When the website is opened, technically necessary connection data may be processed, including an IP address, time of access, requested page, amount of data transferred, referrer, and browser information. This supports secure and stable delivery of the website.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the technical provision of the service and the detection and prevention of misuse. Any processor must be identified according to the actual hosting setup.

Hosting provider: Hetzner Online GmbH
Hosting provider address: Industriestr. 25, 91710 Gunzenhausen, Deutschland
Server-log retention period: Speicherbegrenzte Log-Rotation: maximal 5 Dateien à 10 MB pro Container; keine feste zeitliche Speicherdauer

4. Contact requests

When you use the contact form or another listed contact method, we process the contact details and message you provide in order to respond.

If your request concerns a possible appointment or treatment, processing is based on Article 6(1)(b) GDPR for steps taken before entering into a contract. General enquiries may be based on Article 6(1)(f) GDPR; the legitimate interest is appropriate business communication.

Contact-request retention period: 6 Monate

5. Appointment requests and booking

The booking form processes, in particular, your selected treatment, current nail product and preferred look, selected available appointment, name, email address, and—if supplied—phone number and additional notes.

This data is used to hold the selected time temporarily, review your request, and accept or decline the appointment. Submitting the form is not yet final confirmation. The legal basis is Article 6(1)(b) GDPR where processing takes place at your request before entering into a contract.

The checkbox confirms only that you have read this privacy policy. It is not consent to marketing. Please do not enter diagnoses or other special-category health data in free-text fields.

Recipient of the appointment request: MANISPACE Studio
Appointment-request retention period: 6 Monate

6. Email delivery through Resend

Once delivery is enabled, Resend is used to transmit appointment or contact requests and any receipt acknowledgement by email. The contact details and request content needed to deliver the message are shared with the service. Processing supports the handling of your request and is based on Article 6(1)(b) GDPR; where contractually applicable, Resend must be engaged as a processor under Article 28 GDPR. The provider address, privacy information, data processing agreement, and any international transfer must be verified against the production Resend account.

Provider: Plus Five Five, Inc. (Resend)
Provider address: 2261 Market Street #5039, San Francisco, CA 94114, USA
Provider privacy information: https://resend.com/legal/privacy-policy
Data processing agreement: DPA gemäß Art. 28 DSGVO Bestandteil des Resend-Vertrags

7. Booking database and iCloud calendar sync

To show available appointments, the server compares opening hours with occupied periods in the private iCloud calendar and active requests in the booking database. Visitors receive available start times only; titles, descriptions, and other content from existing calendar events are never returned.

After submission, the request and processing status are stored in the booking database. A tentative event containing the treatment, time, name, contact details, and necessary notes is also created in the selected private iCloud calendar. Apple therefore receives the information required for the iCloud Calendar sync. The production database provider, data processing agreements, storage locations, and possible international transfers must be reviewed and documented before launch.

8. Cookies and local storage

Progress in the booking form is currently held only temporarily in the memory of the open browser tab. The form uses neither cookies nor localStorage for this purpose, and its entries are lost when the page is reloaded.

This website currently uses no non-essential cookies and no analytics or marketing technologies. If any such service is introduced later, it will be activated only after valid consent and this policy will be updated accordingly.

9. External links and social media

Merely displaying an external link does not transfer data to that platform. Once you open it, the relevant provider’s privacy terms apply. Embedded social content requires a separate description and technical review.

10. Recipients and international transfers

Data is received only by parties that need it for the stated purposes and by carefully selected technical service providers. Where they act as processors, the arrangement must meet the applicable legal requirements.

A transfer outside the European Economic Area takes place only when the requirements of Articles 44 et seq. GDPR are met. Whether a transfer occurs and on what basis depends on the providers actually used.

Basis for an international transfer: Resend DPA mit EU-Standardvertragsklauseln; Resend erklärt die Teilnahme am EU-US Data Privacy Framework. Die Geltung ist für das produktive Konto zu prüfen.

11. Your rights

Subject to the applicable statutory conditions, your rights include:

Access to your personal data
Correction of inaccurate or incomplete data
Erasure or restriction of processing
Data portability where the conditions are met
Objection to processing based on legitimate interests
Withdrawal of consent for the future where processing is based on consent

Use the privacy contact above if you wish to exercise any of these rights.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

Competent or nearby supervisory authority: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wilhelmstraße 7, 65185 Wiesbaden, poststelle@datenschutz.hessen.de

13. Data security

We use appropriate technical and organisational measures to protect personal data against loss, alteration, and unauthorised access. Data transmitted over the internet can nevertheless never be entirely risk-free.

14. Updates to this policy

This privacy policy is updated when functions, providers, or legal requirements change. The version published on this page is the current one.