Privacy policy
Last updated
28 October 2026
1. General information
Protecting your personal data is important to us. We process personal data solely on the basis of applicable law, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Telecommunications Act 2021 (TKG 2021). This notice explains which data is processed when you use the website, contact us, book appointments and receive our cosmetic services, for what purposes and on which legal basis, to whom it is disclosed, how long it is kept and what rights you have.
2. Controller
Kriska-Haris Szófia (Sophia Haris-Kriska), Doll Face by Sophie Legal form: sole proprietorship Sylvester-Wagner-Straße 5, 5020 Salzburg, Austria GISA number: 36735730 · trade licence since 15 January 2024 Trade: cosmetics (beauty care), limited to decorative cosmetics (make-up artistry), lash extensions and permanent make-up. Phone / WhatsApp: +43 660 961 12 52 Website: www.devrodtechdemo.hu The controller within the meaning of Art. 4(7) GDPR is Kriska-Haris Szófia.
3. Data processed and legal bases
We only process personal data where necessary to provide the website, communicate with you, organise appointments, deliver our services or meet legal obligations. This may include: first and last name, phone number, email address, appointment details, requested services, messages you send voluntarily, billing and payment details and technical access data. Legal bases: Art. 6(1)(a) GDPR (consent), (b) (contract and pre-contractual steps), (c) (legal obligations) and (f) (legitimate interests).
4. Hosting and server log files
When you visit the website, the hosting provider automatically records technical information: IP address, date and time of access, pages viewed, browser type and version, operating system, referrer URL and technical error and security information. This ensures secure, stable operation, error detection and abuse prevention (Art. 6(1)(f) GDPR). The website is provided via Lovable (Lovable Labs Incorporated AB, Sweden) and delivered through the global network of Cloudflare, Inc. (USA). Log files are kept only as long as needed for these purposes and then deleted.
5. Contact and appointments
Appointments are arranged by phone or WhatsApp; no online booking system is used. The form on the contact page does not store any data on our website; it simply opens WhatsApp with your message. We process your name, phone number, message, requested service and appointment to handle your request, confirm, change or cancel appointments and send organisational reminders. These messages contain no advertising. Legal basis is Art. 6(1)(b) GDPR, for other enquiries Art. 6(1)(f) GDPR. WhatsApp is operated by WhatsApp Ireland Ltd. (Meta); its privacy policy also applies. Data is deleted once no longer needed and no statutory retention obligations apply.
6. Health data during treatments
For certain treatments, especially permanent make-up and lash extensions, we may need to ask about allergies, skin reactions, health restrictions or contraindications. Such health data is a special category of personal data under Art. 9 GDPR and is only processed where, in addition to a legal basis under Art. 6 GDPR, a condition of Art. 9(2) GDPR applies, usually your explicit consent obtained beforehand. You will be informed of the purpose, scope and duration; it is never disclosed to unauthorised third parties.
7. Client photos and results
Photos may be taken to document treatment results. We always obtain separate consent before publishing recognisable photos on the website, on social media or for advertising. You can withdraw this consent at any time with effect for the future; processing carried out lawfully before then remains unaffected.
8. Cookies and local storage
This website uses no analytics or marketing cookies. Only your choice in the cookie notice is saved in your browser's local storage (technically necessary, § 165(3) TKG 2021). External content requiring consent is loaded only after you agree (Art. 6(1)(a) GDPR). You can change your choice and withdraw consent at any time via the cookie icon at the bottom left.
9. Analytics and marketing
No analytics or marketing services such as Google Analytics or Meta Pixel are used. If this changes, such services will only be activated after your consent and described here.
10. Social media
The website contains simple links to our profiles on Facebook, Instagram and TikTok. No content from these platforms is embedded; data is only transferred when you click a link and leave the website. The respective platform operator is responsible for further processing (Meta Platforms Ireland Ltd., TikTok Technology Ltd.).
11. Google Maps and Google Fonts
On the contact page, a Google Maps map (Google Ireland Ltd.) loads only after your consent. The website's fonts are loaded from Google Fonts servers. In both cases your IP address may be transmitted to Google. Google's privacy policy: https://policies.google.com/privacy
12. Payment and invoicing
For payments and invoices we process your name, billing address where applicable, payment details, amount and the service provided (Art. 6(1)(b) and (c) GDPR). No online payment service is used on the website.
13. Recipients
Data is only disclosed where necessary to perform a contract, run the website, meet legal obligations or on another lawful basis. Recipients may include hosting and IT providers, communication services (WhatsApp), tax advisers and accountants, and authorities where legally required. Agreements under Art. 28 GDPR are in place with processors.
14. Transfers to third countries
Using Cloudflare, Google and Meta may involve transfers to the USA. These take place in compliance with Art. 44 et seq. GDPR, in particular on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework or standard contractual clauses.
15. Retention
Data is kept only as long as required for the relevant purpose. Tax-relevant records are generally subject to a seven-year retention obligation; this does not mean all client data is kept for seven years. Afterwards, data is deleted or anonymised.
16. Your rights
Subject to the legal requirements, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3) GDPR). Please use the contact details in section 2.
17. Right to complain
You may lodge a complaint with the Austrian Data Protection Authority: https://www.dsb.gv.at
18. Data security
We take appropriate technical and organisational measures, in particular encrypted transmission (HTTPS) and access restrictions, and review them regularly.
19. Automated decision-making
No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.
20. Changes
We update this privacy notice when legal, technical or business changes require it. The version published on the website applies.