1. Controller
Baan Kanya – Traditional Thai Massage
Owner: Kanyavee Borchers
Peter-Thumb-Straße 5
79761 Waldshut-Tiengen
Germany
Phone: +49 7741 8089535
Email: info@thaimassage-tiengen.de
2. Hosting and email
Our website and email communication are hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Bautzener Str. 56, 02742 Neusalza-Spremberg, Germany. The hosting provider processes technically necessary connection and server log data, in particular IP address, access time, requested file, browser/system information and referrer, in order to deliver the website and ensure secure operation. The legal basis is Art. 6(1)(f) GDPR. Where ALL-INKL.COM processes data on our behalf, this is based on a data processing agreement pursuant to Art. 28 GDPR.
3. Contact form and email
If you contact us via the contact form or by email, we process the information you provide, in particular your name, email address, optional phone number, subject and message, to handle your request. Contact requests may be linked to an existing customer profile and our internal mailbox using your email address. Depending on the request, the legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR. Data is deleted when the purpose of the communication no longer applies and no statutory retention or evidence obligations require further storage. Please do not submit health information via the general contact form; the online booking process provides a separate optional note field with explicit consent for this purpose.
4. Online appointment booking
When you book online, we process in particular your first and last name, email address, phone number, selected massage, appointment, therapist assignment, booking and payment status, and the data required to manage, change or cancel the booking. Processing is necessary for pre-contractual steps and performance of the contract under Art. 6(1)(b) GDPR. Booking confirmations and other booking-related messages are sent by email.
5. Voluntary health information
The optional note field may contain information that qualifies as health data, for example pain, complaints or pregnancy. Such information is not required to make a booking. If you enter an optional note, we store it only after you have expressly consented to the processing and storage of such information. The legal bases are Art. 6(1)(a) GDPR and, where health data is involved, Art. 9(2)(a) GDPR. The information is used solely to provide the massage safely and in a way that takes account of the needs you have told us about. You may withdraw your consent at any time with effect for the future.
Internal customer notes are accessible only to authorised staff in the protected backend. Health-related content should be stored there only where explicit consent has been obtained.
6. First-party visitor statistics
We use a data-minimising visitor statistics system operated exclusively on our own server. No third-party analytics or advertising services are used, and the statistics do not use cookies, LocalStorage or SessionStorage to recognise visitors.
For internal statistics, the server briefly processes the IP address that is already available for the connection in order to create, together with the date, device category and language, a cryptographically protected daily identifier. The full IP address is not stored in the analytics tables; the identifier changes every day and is used solely to group page views, live visits and booking-funnel events within that day. We additionally store the requested page path without URL parameters, device category, language, referring domain and non-personal booking events. Free text, names, email addresses and phone numbers are not stored in visitor statistics. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is privacy-friendly audience measurement and technical improvement of our own website. Analytics sessions are automatically deleted after no more than 395 days.
7. Language preference and technically necessary storage
The public website does not use advertising or analytics cookies. If you actively select German or English using the language switch, we store this requested preference locally in your browser under the key bk-language-choice so that the site can be shown in your chosen language on later visits. This storage takes place only after your active selection and is necessary for the language function you requested (Section 25(2)(2) TDDDG). You can remove it at any time by deleting your browser data or by choosing another language.
The protected staff backend uses a technically necessary session cookie for login. This does not apply to ordinary website visitors.
8. Vouchers and FirstVoucher
Our voucher shop is not automatically embedded in this website. Only when you click “Open voucher shop” do you leave our website and open the external FirstVoucher shop. The technical voucher platform is operated by prointernet GmbH & Co. KG, Marktplatz 8, 56288 Kastellaun, Germany. The voucher shop processes the data required for ordering, voucher administration and your chosen payment method. The payment providers and cookies used there are governed by the FirstVoucher shop and its own privacy information. Our own website does not process or store complete payment-card details.
9. External links: directions, reviews and Facebook
We do not automatically embed Google Maps or Apple Maps. Only after you click “Plan route” are you redirected, depending on your device, to Google Maps or Apple Maps. The link to all Google reviews and the Facebook link are likewise opened only after your click. From that point, the respective external provider processes data under its own responsibility. No connection to these providers is made through these links before you click them.
10. CHF reference prices
The non-binding CHF reference amount is calculated server-side using the EUR/CHF reference exchange rate of the European Central Bank. The visitor's browser does not connect directly to the ECB and no personal visitor data is transferred to the ECB for this purpose.
11. Retention
We retain personal data only for as long as necessary for the relevant purpose or where statutory retention obligations apply. Contractual and accounting records may in particular be subject to commercial and tax retention periods. Once the purpose and applicable statutory periods have ended, data is deleted or, where appropriate, anonymised.
12. Your rights
Subject to the statutory requirements, you have in particular the rights of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing based on legitimate interests (Art. 21 GDPR). You may withdraw consent at any time with effect for the future pursuant to Art. 7(3) GDPR.
13. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. In Baden-Württemberg you may contact the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany, phone +49 711 615541-0, email: poststelle@lfdi.bwl.de.
14. Security and updates
We use HTTPS encryption and restrict access to personal data in the backend through authentication and role-based permissions. We update this privacy policy if functions, service providers or the legal framework change materially.