Privacy policy

This is a translation for your convenience. Only the German version is legally binding.

This statement informs you about which personal data we process when you use our website and our online shop at sultanhamam.de, communicate with us by email, WhatsApp or Instagram, subscribe to our newsletter or visit us at Sultan Hamam Berlin. Personal data is any information relating to an identified or identifiable person.

1. Controller

The controller responsible for data processing is:

Sultan Hamam GmbH
Bülowstraße 56-57
10783 Berlin
Germany
Phone: 030 / 21 75 33 75
Email: info@sultan-hamam.de

You can reach us at this address for all questions about data protection and for exercising your rights.

2. Principles: legal bases, recipients, third countries

2.1 We only process your data if a legal basis permits this. Depending on the process, this is

  • your consent (Art. 6(1)(a) GDPR), for example for the newsletter, WhatsApp messages with offers, review invitations and for cookies and tracking services; in these cases, storing information on your device and accessing it takes place in accordance with Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG),
  • the performance of a contract with you or the handling of your enquiry prior to entering into a contract (Art. 6(1)(b) GDPR), for example for orders, gift vouchers, booking requests and appointments,
  • a legal obligation (Art. 6(1)(c) GDPR), for example retention obligations under tax and commercial law,
  • our legitimate interest (Art. 6(1)(f) GDPR), for example in the secure operation of the website, in answering enquiries, in protection against misuse and in orderly customer care; we state which interest applies for each individual process,
  • for health data, your explicit consent (Art. 9(2)(a) GDPR) and, where necessary, the defence of legal claims (Art. 9(2)(f) GDPR).

You can withdraw your consent at any time with effect for the future. Processing carried out before the withdrawal remains lawful.

2.2 Recipients of your data are, as described in this statement, service providers who work for us and are bound by our instructions (processors under Art. 28 GDPR), as well as independent providers such as payment services, messaging services and Google, which act under their own responsibility. We only pass on data if this is necessary for the respective purpose.

2.3 Some providers process data outside the European Economic Area. We base transfers to the USA on providers certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023) or on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR). An adequacy decision exists for Canada. We state the basis for each service.

2.4 You only need to provide us with the data that we need for an order, an appointment or to answer your enquiry. All other information is voluntary. For your visit on site, your locker number is sufficient (section 13.1). When you buy a gift voucher on site, we only need your email address if you would like to receive the voucher as a PDF by email (section 13.2). We do not make any decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR); this also applies to our AI assistant (section 7.2).

3. Visiting the website and cookies

3.1 Hosting and shop system (Shopify)

Our website and our shop run on the platform of Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). Shopify provides hosting, content delivery, the shopping cart, checkout, customer accounts, order management and the sending of order emails, and in doing so processes on our behalf all data that you enter on the website as well as technical access data.

Each time a page is accessed, Shopify stores in log files the page accessed, the date and time, the amount of data transferred, the page you came from, your browser and operating system and the IP address of your device. We use this data to deliver the website, to ensure its security and stability and to fend off attacks (Art. 6(1)(f) GDPR). Shopify also provides us with statistics on visits and orders (Shopify statistics). Shopify only sets the analytics cookie required for this if you have consented to the “Analytics” category in the cookie banner (section 3.3).

We have concluded a data processing agreement with Shopify. Shopify also processes data at its parent company Shopify Inc., 151 O'Connor Street, Ottawa, Ontario K2P 2L8, Canada, and at sub-processors in the USA. The adequacy decision of the EU Commission applies to Canada; for the USA, Shopify relies on the standard contractual clauses. Further information: https://www.shopify.com/legal/privacy/consumers

Shop app: With the Shop app and Shop account (including Shop Pay), Shopify offers its own service directly to consumers and processes the data of Shop users under its own responsibility, including information about how they browse our shop. We have switched on reminders via Shop in our shop (Shopify setting “Shop remarketing emails and push notifications”): if Shop recognises you as a user of the Shop app, Shopify may remind you by email or push notification of products you viewed with us or of a cart you did not complete. In the Shop app, you can also be notified when a saved product drops in price or is back in stock. Shopify determines the content and timing of these messages; we cannot see which products you save in the app. Details, including how you can object to such messages, can be found in Shopify's privacy information linked above. The legal basis for switching on this feature is our legitimate interest in reminding prospective customers of a purchase they have started (Art. 6(1)(f) GDPR).

3.2 Encryption

The connection to our website is encrypted using TLS (recognisable by “https://” and the padlock symbol). Your entries, in particular order and payment data, are transmitted in encrypted form.

3.3 Cookies and consent

Cookies are small files that your browser stores on your device. We treat similar technologies (for example the browser’s local storage or pixels) in the same way.

Necessary cookies are set by Shopify so that the shopping cart, checkout, login to the customer account, security functions, language and country selection and the storage of your cookie decision work. No consent is required for this (Section 25(2) no. 2 TDDDG); insofar as personal data is involved, we process it to provide the shop (Art. 6(1)(b) and (f) GDPR).

We only use all other cookies and services, in particular the analytics and marketing services from Google and Meta described in section 11 and the Shopify statistics, if you have consented to the respective category (“Analytics”, “Marketing”, “Preferences”) in the cookie banner on your first visit (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Without your consent, these services are not loaded. The banner is the cookie banner of our shop platform Shopify (section 3.1). Shopify stores your decision in a necessary cookie on your device and in our shop account with an identifier (consent ID) so that we can demonstrate your consent (Art. 7(1) GDPR). After twelve months, we ask again. You can change or withdraw your selection at any time via “Cookie settings” in the footer of the website; the services will then not collect any further data. You can delete cookies already set by the providers in your browser.

For Google services, we use Google Consent Mode v2: our shop system tells Google whether you have consented to analytics cookies (signal analytics_storage) and to advertising cookies and the use of your data for advertising (signals ad_storage, ad_user_data, ad_personalization). Without consent, the Google services are not loaded and no data is sent to Google.

Campaign and click identifiers: If you have consented to “Marketing” in the cookie banner, our shop reads the identifier of an ad click from the link through which you came to us (Google: gclid, gbraid or wbraid; Meta: fbclid) as well as the identifiers that Google and Meta have previously stored in your browser with your consent (cookies _gcl_aw, _gcl_gb, _fbc and _fbp). If you have consented to “Analytics”, it also reads the campaign details from the link (utm parameters), the path of the page on which you entered our shop, the address of the website you came from (without parameters) and the Google Analytics identifier (cookie _ga). So that this information is still available if you buy later, our shop stores it in your browser’s local storage for up to 90 days and places it in your shopping cart. If you place an order, Shopify transmits it together with your consent decision (categories and time) with your order to our customer database (section 5.1). We use it to recognise which ad, campaign or website led to a purchase, and to inform Google and Meta, without your name, that an ad click led to a purchase and, where applicable, later to a redemption (sections 11.4 and 11.5). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); without it, our shop does not read or store this information. If you withdraw your consent via “Cookie settings”, our shop deletes the stored information in your browser and in your shopping cart. In our customer database, we delete the Google identifiers 90 days after the ad click, the Meta identifiers after 180 days and the Analytics identifier after 14 months; we keep the other information with the copy of your order (section 15).

You can also block or delete cookies in your browser. Individual functions of the website may then be restricted.

4. Orders, customer account and payment

4.1 Order processing

When you order in the shop, we collect the data required for the order: first and last name, email address, billing address and, where applicable, delivery address, the gift vouchers and services ordered, the chosen delivery method, the payment method and the order number. You can voluntarily give your mobile number at checkout or on the page after your order; we use it to reach you if there are questions about your order or your gift voucher (section 5.1). We process this data to perform the contract, to issue and deliver the gift voucher and to answer your questions about the order (Art. 6(1)(b) GDPR), and to fulfil our obligations under tax and commercial law (Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB)).

Recipients are Shopify (section 3.1), the payment service you have chosen (section 4.3), our gift voucher system (section 5) and, if you have chosen a gift card by post, the shipping service provider we commission (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany), which receives your name and delivery address for delivery. We send the card by registered mail (Einschreiben Einwurf): Deutsche Post AG records the delivery to the letterbox (proof of delivery) and shows the shipment history and delivery in its shipment tracking for the tracking number. We use the proof of delivery only to clarify questions about delivery (Art. 6(1)(b) GDPR). We do not pass your email address on to the shipping service provider; we send you the tracking number ourselves by email.

At checkout and on the page you see after placing your order (order confirmation page), you will also find two voluntary boxes that are independent of each other: for our email newsletter and for offers via WhatsApp. They are not a requirement for your order. We only pass your mobile number on to our messaging service if you tick the box for WhatsApp (section 9.3). Section 9 explains what happens to your details if you tick a box.

4.2 Customer account

You can create a customer account with us to view your orders and save your address details. You log in using a code that Shopify sends to your email address. We process the account data for as long as the account exists (Art. 6(1)(b) GDPR). You can have the account deleted at any time by sending us a message; order data that we are required to retain is not affected by this.

4.3 Payment services

Your payment data (for example card number, bank details or PayPal account) is not stored on our systems but is entered directly with the payment service and processed there. The payment service receives from us the amount, the order number, your name and your contact details as well as the information as to whether the payment was successful (Art. 6(1)(b) GDPR). The payment services are themselves responsible for processing your payment data.

  • Shopify Payments is provided by Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, Ireland. Via Shopify Payments, we offer payment by credit and debit card (Visa, Mastercard, American Express, Maestro), Shop Pay, Apple Pay, Google Pay and Klarna. Technical payment processing is carried out by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland. Data is transferred to group companies in Canada and the USA as described in section 3.1. Privacy information: https://www.shopify.com/de/legal/privacy
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. As soon as you open the cart, our shop loads PayPal’s payment buttons (express checkout), even if your cart is empty and regardless of your choice in the cookie banner. In doing so, technical data is transmitted to PayPal, in particular your IP address, information about your browser and device and the page you are viewing; for this, PayPal may store information in your browser that is strictly necessary to provide the payment buttons (Section 25(2) no. 2 TDDDG). The purpose is to offer you PayPal as a payment method directly in the cart. The legal basis is our legitimate interest in a quick and simple payment process (Art. 6(1)(f) GDPR). If you choose a payment method via PayPal in which PayPal pays in advance (for example “Pay Later”), PayPal may obtain credit information to assess the risk of default; the legal basis is the legitimate interest of PayPal and of us in avoiding payment defaults (Art. 6(1)(f) GDPR). Privacy information: https://www.paypal.com/de/legalhub/privacy-full
  • Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland) and Google Pay (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): with these payment methods, the payment is triggered via the card stored on your device. We do not receive any card data, only the confirmation of payment. The privacy information of Apple (https://support.apple.com/de-de/HT203027) and Google (https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de) applies.
  • Shop Pay is a Shopify function that allows you to save your payment and address details in a Shop Pay account for future purchases. This only happens at your request and on the basis of your consent given to Shopify (Art. 6(1)(a) GDPR); Shopify is the controller for the Shop Pay account.
  • Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. If you choose a Klarna payment method, Shopify Payments transmits your order and contact details to Klarna so that Klarna can process the payment (Art. 6(1)(b) GDPR). For purchases on account and instalment purchases, Klarna pays in advance and carries out an identity and credit check for this purpose; in doing so, Klarna may obtain information from credit reference agencies. The legal basis is the decision on concluding the payment contract with you (Art. 6(1)(b) GDPR) and the legitimate interest of Klarna and of us in avoiding payment defaults (Art. 6(1)(f) GDPR). Klarna is itself responsible for this processing. Details can be found in Klarna’s privacy policy: https://www.klarna.com/de/datenschutz/

5. Gift voucher system and customer database on our own server

5.1 Issuing and managing gift vouchers

For issuing, delivering and redeeming our gift vouchers and for managing our customer relationships, we operate our own system (gift voucher register and customer database). It runs on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, in the Falkenstein data centre in Germany. We have concluded a data processing agreement with Hetzner.

After each order, Shopify automatically transmits the order number, the gift vouchers and additional services ordered, your name, your email address, your mobile number and your address if provided and, if you ticked a box for the newsletter or WhatsApp at checkout, this consent (section 9) to this system. There, for each gift voucher, we create a gift voucher code, the date of issue, the expiry date, the services included and the redemption status, and assign the gift voucher to you as the buyer. Your email address and, if provided, your mobile number are stored on your customer record as contact details; we only pass the number on to our messaging service with your consent to WhatsApp messages (section 9.3). If you later give a different mobile number, at checkout or on the order confirmation page, it replaces the previous one. In addition, we keep a copy of the order data as transmitted by Shopify, because we need it for refunds and queries about your order and because it forms part of our accounting records (storage period in section 15). This copy also contains technical information about the order, such as the IP address and the browser you used to place it. We do not receive complete payment data such as card numbers or bank details. On the order confirmation page, a component of our system shows you the link to your gift voucher PDF, a field for your mobile number and the boxes for the newsletter and WhatsApp. For this, your browser transmits the Shopify order ID and the confirmation number of your order directly to our system; if you enter a mobile number there or tick a box, it also transmits this number or your consent and your language. We store a number entered there, like the number from checkout, as contact details on your customer record. The field is pre-filled with the mobile number from your order; for this, our system sends this number back to your browser. We use the confirmation number only to check that the request belongs to your order. The legal basis is Art. 6(1)(b) GDPR, for the consents Art. 6(1)(a) GDPR.

Purposes and legal bases: performance of the contract, in particular issuing, checking and cancelling the gift voucher and questions about your order or your gift voucher via the email address or mobile number provided (Art. 6(1)(b) GDPR); fulfilment of record-keeping and retention obligations under tax and commercial law, because issuing and redeeming gift vouchers are transactions relevant for accounting (Art. 6(1)(c) GDPR, Section 147 AO, Section 257 HGB, German principles of proper accounting (GoB)); protection against misuse and multiple redemption as well as orderly customer care with an overview of your purchases, enquiries and visits (Art. 6(1)(f) GDPR).

Evaluation by advertising channel: For each order, we also store the page through which you entered our shop and, if contained in the link, the campaign you came from (information that Shopify transmits with the order). We evaluate purchases, redemptions and visits in aggregated form, for example how many gift vouchers from an advertising channel are redeemed and how long this takes. These evaluations do not contain any names. The legal basis is our legitimate interest in improving our advertising and our offer (Art. 6(1)(f) GDPR); you can object (section 14).

Security: the database cannot be accessed from the internet, only via an internal network from our application server. Our staff log in with their own account or with the account of their workstation; only the management can see complete customer records. Access to customer data is logged (section 5.4). We create encrypted backup copies of the database and of our automation system (section 6.3) every day. We store them with IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, in a data centre in Berlin. Only we have the key to decrypt them; IONOS does not. We have concluded a data processing agreement with IONOS. We keep backup copies for a maximum of twelve months. Until then, data that we have deleted may still be contained in older backup copies; we do not use it there. If we ever have to restore the database from a backup copy, we carry out again all deletions made after the time of that backup.

5.2 Delivery of the gift voucher by email

If you have chosen delivery as a PDF, our system generates the gift voucher PDF after receipt of payment and sends it to you by email. Sending takes place via an email mailbox at ALL-INKL.COM, Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. A copy of each gift voucher email is stored in this mailbox so that, in the event of queries, we can trace what was sent. The email contains a link, valid for 30 days, for downloading the gift voucher; when it is accessed, the usual access data (time, IP address, browser) is logged on our server. We also show you the same link on the order confirmation page. The legal basis is Art. 6(1)(b) GDPR.

5.3 Redemption on site by QR code

When the gift voucher is redeemed at Sultan Hamam Berlin, we scan its QR code with one of our devices or enter the gift voucher code. The system stores the time of redemption, the device used and the new status of the gift voucher; failed checks are also logged. These entries are not changed afterwards because they are records relevant for tax purposes (Art. 6(1)(b) and (c) GDPR). If we check you in for your visit, we link the redemption to that visit (section 13.1). If you tell us your name when redeeming the voucher or enter your details on the iPad at reception, we record the redemption as a visit on your customer record, even without a check-in (Art. 6(1)(f) GDPR); you can object to this (section 14). If you received the gift voucher as a present, the person who bought it does not learn your name; we only note for them when the gift voucher was redeemed.

5.4 Access logs

So that we can trace who accessed customer data and when, our system logs, among other things, every time a visit or a transaction is opened, every search for customers at reception, every process on the iPad at reception and every check of a gift voucher. The account, the device, the time, the type of access and the identifier of the record concerned are stored. Search terms, names, contact details and IP addresses are not included in the log. The entries cannot be changed afterwards. The logs are not visible to our team; we only evaluate them for a specific reason, for example if unauthorised access is suspected or to answer a request for access. The legal basis is our obligation to protect your data appropriately and our legitimate interest in detecting and investigating misuse (Art. 6(1)(c) and (f) GDPR in conjunction with Art. 32 GDPR). We delete the entries three years after they were created, because misuse often only comes to light later and claims arising from it can be asserted within this period (section 15).

5.5 Deletion of your customer record

If you ask us to delete your data, or if the storage period under section 15 has expired, we delete your customer record in our customer database. During the following night, our system removes your name, your email address, your phone and WhatsApp number, your date of birth, the identifiers under which you are listed with Shopify, Klaviyo, Superchat and in our appointment software, and your consents. What remains is an empty customer record without name or contact details, which only shows that and when we deleted it.

Newsletter and WhatsApp: before emptying the record, we unsubscribe you from the newsletter at Klaviyo and delete your profile there. At Superchat, we remove your number from our WhatsApp lists so that you no longer receive any offers. We continue to keep your chat history with us there insofar as it is business correspondence that we are required to keep (section 7.1). If unsubscribing does not succeed immediately, we repeat it during the following nights and only empty your customer record afterwards; if it has still not succeeded after three days, we empty the customer record anyway and complete the unsubscription manually.

Records relevant for tax purposes: information that we are required to keep for tax purposes is retained, but separated from your customer record, i.e. without your name and contact details: transaction numbers, services purchased and ordered, prices, amounts and times of your purchases and visits, as well as gift voucher codes with their content, expiry date and redemption status (Art. 17(3)(b) GDPR, Section 147 AO). Gift vouchers remain valid and can still be redeemed.

Orders in our online shop are accounting records. They remain stored with your name and contact details at Shopify and as a copy in our system (section 5.1) until the end of the retention period; we then only use them to fulfil this obligation.

Proof of your consents: if you had consented to the newsletter or WhatsApp messages, we keep a proof after the deletion: the channel, the time of consent and, where applicable, of withdrawal and deletion, the source and the version of the consent text. It does not contain your email address or number in plain text, only a check value from which it cannot be read back; we can only find the proof if someone gives us the address or number. We use it exclusively to defend ourselves against allegations of unsolicited advertising and delete it at the end of the third year after the year of deletion (Art. 17(3)(e) GDPR, Sections 195 and 199 BGB).

Other systems: at your request, we also delete your customer account at Shopify (section 4.2) and your data in our appointment software (section 8), unless there is a retention obligation. If you subscribed to the newsletter or WhatsApp messages via our booking request form, we delete this subscription at Klaviyo or Superchat in the same way at your request. Deleted data disappears from our backup copies when they expire (section 5.1).

6. Booking requests, contact and forms

6.1 Booking request form

Via the “Request a booking” form on our website, we collect the occasion of your visit, the desired service, the preferred date and time, the number of people, your first and last name, your email address, your phone number and an optional note. The request is delivered to us by email via Shopify. At the same time, the website transmits the request to our own automation system (section 6.3), which forwards it by email to our appointments inbox; we handle this inbox in Superchat (section 7.1). We process this data to answer your request and to arrange the appointment (Art. 6(1)(b) GDPR). We enter the agreed appointment in our appointment management system (section 8).

In the form, you can give two voluntary consents that are independent of each other: for our email newsletter and for offers via WhatsApp. Only if you tick the respective box do we pass your contact details on to our newsletter service (section 9.2) or to our messaging service (section 7.1). Without a tick, no data is passed on for advertising purposes. Details can be found in section 9.

Until they were closed in October 2026, our former booking request forms on the Tally service (Tally B.V., August Van Lokerenstraat 71, 9050 Gentbrugge, Belgium) also accepted requests and subscriptions to the newsletter and WhatsApp messages. Tally stores this data on our behalf. Our automation system (section 6.3) passed subscriptions from these forms on to Klaviyo or Superchat as described in section 9, in each case with a confirmation request.

6.2 Contact by email

If you write us an email, we process your sender address, the content of the message and the data you provide in order to deal with your request (Art. 6(1)(b) GDPR where there is a contractual connection, otherwise Art. 6(1)(f) GDPR based on our interest in answering enquiries). We delete the correspondence once the matter has been dealt with and there is no retention obligation.

6.3 Automation system (n8n, self-hosted)

To connect our systems, we operate the n8n software on our own server (section 5.1). It receives booking requests from the website, checks them for completeness, forwards them via our email mailbox at ALL-INKL.COM (section 5.2) to our appointments inbox and only passes contact details on to the newsletter service or the messaging service if you have given the respective consent. The software runs exclusively on our infrastructure; no data is transmitted to the manufacturer of the software. The legal bases are Art. 6(1)(b) GDPR (handling your request) and Art. 6(1)(a) GDPR (passing on data based on your consent).

6.4 Spam protection (hCaptcha)

To prevent automated entries in our forms, our shop system uses the hCaptcha service of Intuition Machines, Inc., USA, on forms and when logging in to the customer account. The service checks whether an entry comes from a human and, for this purpose, processes the IP address, information about the browser and device and the behaviour on the form page; for this, it may store information in your browser that is strictly necessary for the check (Section 25(2) no. 2 TDDDG). The legal basis is our legitimate interest in protecting the website against misuse and spam (Art. 6(1)(f) GDPR). The data may be transferred to the USA; the transfer takes place on the basis of the EU standard contractual clauses or a certification of the provider under the EU-US Data Privacy Framework. Privacy information: https://www.hcaptcha.com/privacy

7. Messages via WhatsApp and Instagram, AI assistant

7.1 Superchat messaging platform

We receive and answer messages that you send us via WhatsApp or as an Instagram direct message via the Superchat messaging platform of SuperX GmbH, Prenzlauer Allee 242-247, Haus 7, 10405 Berlin. Your phone number or Instagram name, your name if you provide it, the content of your messages and the time and history of the conversation are stored there. Our team also handles emails to our appointments inbox, including your booking requests (section 6.1), in Superchat; your email address and the content of your request are then also stored there. The AI assistant (section 7.2) does not reply to these emails. We process this data to answer your enquiry, to arrange appointments and to clarify questions about gift vouchers (Art. 6(1)(b) GDPR), and otherwise on the basis of our interest in fast and efficient communication (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with SuperX. Chat histories concerning a booking, a purchase, a gift voucher or a complaint are business correspondence; we keep them for six years after the end of the year of the last contact (Section 257 HGB, Section 147 AO, Art. 6(1)(c) GDPR). We delete other chat histories twelve months after the last contact. If you give us your consent to WhatsApp messages on site or in our online shop, we transmit your first name, your mobile number and your language from our customer database (section 5) to Superchat (sections 9.3 and 9.4). We do not store chat histories in our customer database.

7.2 AI assistant

New conversations are initially answered by an AI assistant that runs within Superchat. We inform you of this at the beginning of the conversation. The assistant categorises your request, answers general questions, for example about opening hours, prices and offers, and records appointment requests. For this purpose, it processes the content of your messages. Binding appointment confirmations and all matters that the assistant cannot resolve are handled personally by our team. The assistant does not make any decisions with legal effect for you. For the assistant, Superchat uses AI models from third-party providers with which Superchat has concluded data processing agreements. The legal bases are the same as in section 7.1.

7.3 WhatsApp Business Platform

For WhatsApp, we use the WhatsApp Business Platform of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), which is connected via Superchat. We do not use a mobile phone with an address book for this; your number is only processed if you write to us or have consented to WhatsApp messages. When messages are sent, Meta receives your phone number, the time and technical data of the message and forwards the messages via its servers. In the process, data may be transferred to Meta Platforms Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework. How WhatsApp processes your data as a user of the app is described by WhatsApp at https://www.whatsapp.com/legal/privacy-policy-eea

7.4 Instagram direct messages

Direct messages to our Instagram profile are passed to Superchat via the Instagram interface (Meta Platforms Ireland Limited, address as above). Meta also processes your messages under its own responsibility in accordance with its privacy information: https://privacycenter.instagram.com/policy

8. Appointment management

We manage agreed appointments in the Booker appointment software of Mindbody, Inc., 651 Tank Farm Road, San Luis Obispo, CA 93401, USA. In the appointment software, we store your name, your phone number, your email address and the service, date and duration of your appointments (Art. 6(1)(b) GDPR). We do not record any health information there. There is no automatic connection between our website and the appointment software; appointments are entered by our team. Mindbody processes the data on our behalf. The transfer to the USA takes place on the basis of the EU standard contractual clauses or a certification of the provider under the EU-US Data Privacy Framework.

We reserve the right to transfer your name, contact details and appointment history from the appointment software to our customer database (section 5) so that we can keep track of your visits in one place (Art. 6(1)(f) GDPR, interest in orderly customer care). You will not receive advertising as a result of this; for that, we always need your consent (section 9).

9. Newsletter, offers via WhatsApp and your consents

9.1 Email newsletter

With our newsletter, we inform you about offers, new packages, promotions and news from Sultan Hamam Berlin. You can subscribe in three ways: by ticking the box in the booking request form, by ticking the box at the checkout or on the order confirmation page of our online shop or on site at Sultan Hamam Berlin (section 9.4). Your email address is mandatory; your name is optional and is used to address you personally. After subscribing, you will receive an email with a confirmation link from our newsletter service Klaviyo (section 9.2). Only when you click this link is the subscription complete (double opt-in). Until then, we only use your address for this confirmation email. If you do not confirm, we delete the unconfirmed subscription immediately at your request; otherwise, we review unconfirmed subscriptions regularly and delete them as soon as we no longer need them as proof of the subscription process. We store the time of subscription and confirmation as well as the IP address used, in order to be able to demonstrate your consent.

Subscribing in the online shop: if you tick the box for news and offers by email at checkout, Shopify stores your consent with your customer data and transmits it with your order to our customer database (section 5.1). If you tick the box on the order confirmation page, your consent goes directly to our customer database; it applies to the email address of your order. From there, we pass your subscription on to Klaviyo, which sends you the confirmation email. If you cancel the order, we do not pass anything on. Shopify itself does not send newsletters for us.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by sending us a message. After you unsubscribe, we will no longer send you newsletters.

9.2 Mailing service provider

To send the newsletters and manage subscriptions, we use Klaviyo, a service of Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. Klaviyo processes your email address, your name if you have provided it, the subscription data and your reactions to our emails on our behalf; we have concluded a data processing agreement with Klaviyo. Klaviyo is certified under the EU-US Data Privacy Framework. If you subscribe on site or in the online shop (sections 9.1 and 9.4), we only transmit your email address, your language, the source and time of your subscription and the version of the consent text to Klaviyo, but no name and no phone number.

Performance tracking: for our newsletters, Klaviyo measures whether an email was opened and which links in it were clicked. For this purpose, each email contains a small, invisible image that is loaded from Klaviyo's servers when the email is opened, and the links first lead via a Klaviyo address. In the process, Klaviyo processes your IP address and information about your email program and device and stores the time and type of the reaction in your profile. We use this analysis to improve our newsletters. The legal basis is our legitimate interest in an effective newsletter (Art. 6(1)(f) GDPR). You can object to the tracking at any time (section 14). You can prevent open tracking yourself by not loading images automatically in your email program; click tracking does not take place if you do not click the links. If you do not want any tracking at all, you can unsubscribe from the newsletter at any time.

9.3 Offers via WhatsApp

If you consent to messages with offers via WhatsApp (tick in the booking request form, tick at the checkout or on the order confirmation page of our online shop or consent on site), we transmit your mobile number to Superchat (section 7.1), record it there as a not yet confirmed subscription and first send you a confirmation question via WhatsApp. In the online shop, we use the mobile number you gave at checkout or on the order confirmation page for this; we only pass it on to Superchat once you tick this box. If your mobile number changes later, the subscription stays with the number you consented for. Only when you reply “Ja, anmelden” (“Yes, subscribe”) do we add your number to our distribution list and occasionally send you messages about offers, last-minute appointments and news. If you do not reply or reply “Nein, danke” (“No, thanks”), you will not receive any offers; if you reply “Nein, danke”, we also remove the unconfirmed subscription. If no reply comes, we remind you at most once. We remove the unconfirmed subscription immediately at your request; otherwise, we review unconfirmed subscriptions regularly and remove them as soon as we no longer need them as proof of the subscription process. Your reply remains stored in our chat history and serves as proof of your consent. You can also subscribe directly by sending us the word “Anmelden” (German for “subscribe”) via WhatsApp; you will then be added to the distribution list immediately. Superchat receives your mobile number and your name if you have provided it; if you subscribe on site or in the online shop, only your first name and your language. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time by sending us the word “Abmelden” (German for “unsubscribe”) via WhatsApp or by sending us a message; you will then no longer receive any offers. The information on the WhatsApp Business Platform in section 7.3 applies to the sending of messages.

9.4 Consent on site, proof of consent and withdrawal

You can also subscribe to the newsletter and WhatsApp messages at Sultan Hamam Berlin: on the iPad at reception (section 13), for example when you check in or make a purchase. On the iPad, you tick the boxes yourself; none is preselected. Both consents are voluntary, independent of each other and not a requirement for your visit or your purchase. Our staff do not give consent on your behalf. After you tick a box, we transmit your subscription to Klaviyo (section 9.2) or Superchat (section 9.3); you will then first receive the confirmation email or the confirmation question via WhatsApp and are only subscribed once you confirm.

Paper forms: in the past, you could also subscribe on site using a paper form. We no longer hand out these forms. We have scanned completed forms. The scans are stored securely in our customer database (section 5) and serve as proof of your consent (Art. 7(1) GDPR). To read the handwriting, we have the scans evaluated on our behalf with the AI service Claude of Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland; our team compares each entry with the scan and confirms it. We have concluded a data processing agreement with Anthropic (Data Processing Addendum as part of the Commercial Terms). Data may be transferred to the USA in the process; this is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR). The legal basis is our legitimate interest in being able to demonstrate your consent and to transfer your subscription without transcription errors (Art. 6(1)(f) GDPR). We transfer the subscriptions from these forms to Klaviyo or Superchat; in this case, too, you will first receive a confirmation request and are only subscribed after you confirm. We keep the forms under lock and key (storage period in section 15).

Date of birth: If you entered your date of birth on a paper form, we transfer it to your customer record in our customer database (section 5) if it is clearly legible. Providing it was voluntary. We only use your date of birth to congratulate you on your birthday via the channels you have consented to, where applicable with an offer. We do not pass it on to Klaviyo or Superchat. The legal basis is the consent you gave on the form (Art. 6(1)(a) GDPR). We store your date of birth for as long as your customer record exists and remove it when the record is deleted (sections 5.5 and 15); at your request, we delete it at any time.

Proof: for each consent that you give on site or in our online shop, we store in our customer database (section 5) the time, the channel (email or WhatsApp), the source (iPad at reception with the name of the device, or checkout or order confirmation page with order number) and the version of the consent text you saw (Art. 7(1) GDPR).

Withdrawal: if you unsubscribe via the link in an email or by sending “Abmelden” via WhatsApp, this takes effect immediately at Klaviyo or Superchat. If you withdraw your consent towards us, for example by email or on site, we record the withdrawal in our customer database and unsubscribe you at Klaviyo or Superchat; at Superchat, we remove your number from both the distribution list and the list of unconfirmed subscriptions. If your email address or the number your WhatsApp consent applies to changes, we unsubscribe the old one; the new one first receives a new confirmation request.

10. Reviews (Trustpilot)

We collect customer reviews via the Trustpilot platform of Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark.

Review invitation: if you have given your consent after an order, we transmit your name, your email address and the order number to Trustpilot so that Trustpilot can send you an email on our behalf asking for a review. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time vis-à-vis us or Trustpilot. Without consent, you will not receive an invitation.

Trustpilot processes submitted reviews under its own responsibility in accordance with its privacy information: https://de.legal.trustpilot.com/for-reviewers/end-user-privacy-terms

11. Analytics and advertising with Google services

11.1 General information

The services described in this section are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We only use them if you have consented to the respective category in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent, the services are not loaded; Google then does not receive any data from our website. You can withdraw your consent at any time via “Cookie settings” in the footer.

Google may transfer data to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework; the standard contractual clauses also apply. For Google Analytics and Google Ads, we have concluded the data processing terms provided by Google. How Google uses data from partner websites is described by Google at https://policies.google.com/technologies/partner-sites and in its privacy policy https://policies.google.com/privacy?hl=de

11.2 Integration via Shopify

Google Analytics and Google Ads are connected to our shop via the Shopify app “Google & YouTube”. The app only loads the Google services after your consent and passes your choice from the cookie banner on to Google as consent signals (section 3.3). We do not use Google Tag Manager.

11.3 Google Analytics 4

Google Analytics 4 helps us understand how visitors use our website: which pages are accessed, for how long, from which device and from which region, and how often a visit leads to an order. For this purpose, Google sets cookies, generates a random user identifier and collects information about the device, browser, approximate location (from the IP address, which Google shortens before storage) and your actions on the website. Google processes this data on our behalf and uses it to create reports for us. We do not receive any reports relating to individuals. User data in Google Analytics is automatically deleted after 14 months. The Google Signals function (cross-device analysis via your Google account) is not activated. You give your consent in the cookie banner in the “Analytics” category.

11.4 Google Ads: conversion tracking and remarketing

We place ads via Google Ads. To measure whether an ad has led to a visit or an order (conversion tracking), Google sets a cookie after you click on an ad, which is read when an order is placed. This only tells us the total number of users who clicked on an ad and then placed an order, as well as the order value, not your identity. With remarketing, we can later show our ads to visitors of our website on other websites and in Google services. For this purpose, Google uses a cookie to assign your browser to an audience that Google creates for us. If you are logged in to your Google account and have allowed personalised advertising, Google may link the data across devices; you can switch this off in your Google account under “My Ad Center” (https://myadcenter.google.com). Both functions only run after your consent to the “Marketing” category.

Gift voucher redeemed: If you consented to “Marketing” in the cookie banner when you bought a gift voucher and came to us via a Google ad, we inform Google Ads when this gift voucher is redeemed with us that the ad click was followed by a visit. The report contains only the click identifier from section 3.3, the time of the first redemption, the value of the gift voucher and your consent choice, no name and no contact details, neither of the buyer nor of the person who redeems the gift voucher. Google Ads retrieves this information from a protected address on our server, and only within 90 days of the ad click; after that we delete the entries. Once a gift voucher has been fully or partly redeemed, the report remains, even if we later refund the remainder or make a goodwill refund, because the visit took place. If we reverse a redemption because it was booked by mistake, we withdraw the report in Google Ads. The legal basis is your consent (Art. 6(1)(a) GDPR). Withdrawing it via “Cookie settings” applies to your purchases after that. We remove the identifiers from section 3.3 from your order at Shopify as soon as they are stored in our customer database. Shopify, however, stores the address of the page on which you entered our shop as part of the order records, even if it contains a click identifier; we cannot change this information at Shopify. In our customer database we store it without identifiers.

11.5 Meta Pixel and Conversions API

We place ads on Facebook and Instagram. To measure their success and to create audiences, we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). We integrate both via the Shopify app “Facebook & Instagram” by Meta and only if you have consented to the “Marketing” category in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent, the pixel is not loaded and no data is sent to Meta.

With your consent, the pixel sets a cookie in your browser and transmits to Meta which pages you have visited and which actions you have taken (for example product view, cart, purchase with order value), together with your IP address, browser data and the pixel ID. Via the Conversions API, our shop system also transmits the same events directly from server to server; contact details such as email address, phone number or name may be sent in hashed form so that Meta can assign the event to a Meta account (“advanced matching”). We use this data to measure whether our ads lead to visits and orders (conversion measurement) and to create audiences for our ads, for example visitors to our website or people with similar characteristics (Custom Audiences, Lookalike Audiences). For us, the data is anonymous; however, Meta can assign it to your Facebook or Instagram account and use it for its own purposes.

We and Meta are joint controllers for the collection and transmission of the data to Meta (Art. 26 GDPR). The agreement on this is Meta’s “Controller Addendum”: https://www.facebook.com/legal/controller_addendum. Under this agreement, Meta is responsible for providing you with the information under Art. 13 GDPR for the joint processing and for fulfilling your data subject rights in relation to the data stored by Meta; further processing after the transmission is the sole responsibility of Meta. Meta may transfer data to Meta Platforms Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time via “Cookie settings”. You can manage your advertising settings at Meta at https://www.facebook.com/adpreferences/ad_settings; you can find Meta’s privacy information at https://www.facebook.com/privacy/policy/

12. Google Maps (two-click solution)

On our contact page, you can display a map from Google Maps (Google Ireland Limited, address see section 11.1) to see our location and directions. The map is not loaded automatically. At first, you only see a placeholder with the notice that data will be transmitted to Google when it is loaded. Only when you click on “Load map” does your browser load the map from Google’s servers; in doing so, your IP address and information about your browser are transmitted to Google and, if you are logged in to a Google account, also the link to your account. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); it applies to the respective page view. Alternatively, next to the map you will find a link that opens our location directly in Google Maps. Google may transfer data to the USA and is certified under the EU-US Data Privacy Framework. Privacy information: https://policies.google.com/privacy?hl=de

13. Your visit and your purchases at Sultan Hamam Berlin

At reception, our team works on computers with our customer database (section 5). We check gift vouchers with one of our devices, for example a scanner or a smartphone belonging to Sultan Hamam Berlin, or enter the code by hand (section 5.3).

The iPad at reception is intended only for you as a guest. If you would like to give us your details, our team starts a process on the computer, or you tap “I have arrived” on the iPad yourself. You then enter your name, your contact details and, if you wish, your ticks for the newsletter and WhatsApp messages yourself on the iPad; when you check in and after “I have arrived”, you can also enter your date of birth (section 13.1). You can also tell us your details instead. On the form, you see a short note on why we store your details and a QR code that opens this privacy policy on your phone. On the iPad, you only see this one form and no details of other guests. If our team has selected your existing customer record, the iPad shows you the name and contact details stored there so that you can check them; if they are not yours, tap “These are not my details” and they disappear from the iPad. Our team sees your entries on the computer for checking, so that typing errors are noticed, for example in your email address; our team can only change your details if you confirm the change on the iPad. Only you tick the boxes. Your entries are kept encrypted on our server while the process is open. If our team accepts them, they are then stored on your customer record insofar as you have given them to us for this purpose, and are otherwise deleted. If the process is cancelled, if you stop typing for a while or if our team does not accept your details within 30 minutes, we delete them. Nothing is stored on the iPad itself. The legal bases of the respective process apply (sections 9.4, 13.1 and 13.2).

13.1 Check-in, locker, rental items and orders during your visit

When you visit us, we record your visit in our customer database (section 5). This includes your locker number, the date and time of check-in and check-out, the type of entry and the planned end time resulting from it, where applicable the gift voucher you redeem or present, the towels and other rental items you receive and return, and everything you order during your visit, for example food, drinks, upgrades and treatments, each with its price. Rental items already included in your gift voucher are recorded without an amount. If you come with companions, we may group the visits together. You pay when you leave, exclusively at our cash register. We only enter the items ordered and a transaction number into the cash register, not your name. We do not transfer payment data to the customer database.

Your details: we only record your name and contact details if you enter them yourself on the iPad at reception, tell us, or are already stored as a customer. If you do not wish to provide any details, we check you in with your locker number only; this does not put you at any disadvantage. If you enter your details yourself, only your first name is required; last name, email address and phone number are voluntary. For the visit, we note that you entered your details yourself and the language you chose. The boxes for the newsletter and WhatsApp messages on the same form are independent of this (section 9.4).

Date of birth: When you check in, you can voluntarily give us your date of birth, on the iPad at reception (also after “I have arrived”) or by telling our team. We store it on your customer record and only use it to congratulate you on your birthday via the channels you have consented to (section 9), where applicable with an offer. We do not pass it on to Klaviyo or Superchat. The legal basis is the consent you give by providing it (Art. 6(1)(a) GDPR). Not providing it does not put you at any disadvantage. We store your date of birth for as long as your customer record exists and remove it when the record is deleted (sections 5.5 and 15). You can withdraw your consent at any time; we will then delete your date of birth.

Gift vouchers: if you redeem or present a gift voucher during your visit, we link your visit to that gift voucher and, where applicable, to its redemption (section 5.3). We only assign the visit to the person who actually visits us, and only if that person gives us their details: for a gift voucher received as a present, that is you as the recipient, not the person who bought the voucher. If the buyer is stored with us, our team sees their first name, the initial of their last name and shortened contact details when scanning, in order to recognise whether the buyer is visiting in person. Conversely, the buyer does not learn from us who redeemed the gift voucher: we do not notify them, and we only note for them when the gift voucher was redeemed. If a visit has been assigned to the wrong person by mistake, our management corrects this and the visit is then shown on the correct customer record.

Purposes and legal bases: we process this data to carry out your visit, to redeem your gift voucher, to provide you with a locker and rental items and to settle your orders in full at the cash register when you leave (Art. 6(1)(b) GDPR). The items ordered and their prices are also records that we are required to keep for tax purposes (Art. 6(1)(c) GDPR in conjunction with Sections 146 and 147 AO). In addition, we have a legitimate interest in exercising our house rules, managing lockers, keys and lost property, following up on rental items not returned and services not paid for, recognising when a gift voucher is redeemed whether the buyer is visiting in person, keeping a complete overview of your visits and planning our capacity; for planning purposes, we only evaluate visit times in aggregated form (Art. 6(1)(f) GDPR).

Access: only our staff, on the devices in our premises, and the management access this data, each with their own account or the account of their workstation. Access is logged (section 5.4). On lists and screens that other guests could see, we show at most your first name and the initial of your last name. The data is stored on our own server at Hetzner in Germany (section 5.1). We do not pass it on to third parties. The exceptions are our tax advisors and the tax authorities, to the extent that they inspect the tax records as part of their statutory duties (Art. 6(1)(c) GDPR); your name and your locker number are not part of these records.

No health data: we do not store any information about your health or any free-text notes about your visit. Reasons, for example for a cancellation, a missing rental item or an interrupted visit, are selected by our staff from a fixed list. Section 13.3 applies to the safety question.

Internet outage: if our system cannot be reached, we note your visit and your orders on a paper form with your locker number and, if you wish, your first name and the initial of your last name. As soon as the system can be reached again, we enter the visit. We then keep the paper form as an original tax record for as long as the items ordered (section 15).

Storage period and your rights: the periods are set out in section 15. Your rights under section 14 also apply here. In particular, you can object at any time to processing based on our legitimate interest, for example the overview of your visits (Art. 21 GDPR). Information that we are required to keep for tax purposes cannot be deleted before the end of the retention period; in this case, we separate it from your customer record (section 5.5, Art. 17(3)(b) GDPR).

13.2 Buying a gift voucher on site

If you buy a gift voucher from us on site, our team creates it on the computer in our voucher register in the same way as a voucher from our online shop: with code, content, booked extras, language, date of issue and expiry date. We record the purchase itself with a transaction number, the content, the prices from our catalogue, the time and the account with which our team records the purchase.

Your details: we only record your name and contact details if you tell us; our team enters them or selects your existing customer record. If you would like to receive the voucher as a PDF by email, we need your email address for this and store it on your customer record in our customer database (section 5); we send the email in the same way as for an order in our online shop (section 5.2), with a short delay so that we can still correct a mistake beforehand. At your request, we send the PDF to a different address, for example directly to the person receiving the gift; we do not store this address on your customer record, only for sending and in the copy of the gift voucher email. For the two other options, we do not need any details from you, and this does not put you at any disadvantage. For the PDF on your phone, we show you a QR code on the screen, which you use to download the PDF with your own phone; the link behind it is valid for 30 days, and section 5.2 applies when it is accessed. For the handwritten card, we stick in a label with the QR code and the voucher code or write the code into the card by hand; it contains no information about you. If you give us your details, we also store the purchase on your customer record. We do not record consents to the newsletter or WhatsApp messages when you buy a gift voucher; you can give them independently on the iPad at reception (section 9.4).

Payment: you pay exclusively at our cash register. Our voucher system does not accept payments and does not store any payment data.

Internet outage: if our system cannot be reached, we note the purchase on a paper form and enter it later. We destroy the part of the form with your contact details once it has been entered.

Purposes and legal bases: we process this data to perform the purchase contract, to deliver the voucher to you and to redeem it later, and to answer questions about the voucher (Art. 6(1)(b) GDPR). The content, prices and time of the purchase are also records that we are required to keep for tax purposes (Art. 6(1)(c) GDPR in conjunction with Sections 146 and 147 AO). In addition, we have a legitimate interest in keeping a complete overview of your purchases with us, online and on site (Art. 6(1)(f) GDPR).

Access and recipients: only our staff on our premises access this data, with a personal account or the reception account, each with a password; accounts with administrator rights additionally with two-step login. Lists at the counter do not show any names. Access is logged (section 5.4). The data is stored on our own server at Hetzner in Germany (section 5.1). It is only passed on to the email service provider for sending under section 5.2 and to our tax advisors and the tax authorities, to the extent that they inspect the tax records as part of their statutory duties (Art. 6(1)(c) GDPR); your name is not part of these records.

Storage period and your rights: the periods are set out in section 15. Your rights under section 14 also apply here. In particular, you can object at any time to processing based on our legitimate interest, for example the overview of your purchases (Art. 21 GDPR). Information that we are required to keep for tax purposes cannot be deleted before the end of the retention period; in this case, we separate it from your customer record (section 5.5, Art. 17(3)(b) GDPR).

13.3 Safety question

Before you use the heat areas, we ask you verbally whether there are any health reasons against your visit, for example a pregnancy. We do not record your answer, neither digitally nor on paper. The only exception is the written declaration for visits during pregnancy.

If you would like to use the heat areas during pregnancy, we ask you to sign a short declaration on paper beforehand. In it, you confirm that we have informed you about the particular risks and that you have consciously decided to visit. The declaration only contains your name, the date, your signature and the initials of our staff member. Because it shows that you are pregnant, it is health data. The legal basis is your explicit consent, which you give with your signature (Art. 9(2)(a) GDPR).

The declaration is kept on paper only. We do not scan or photograph it and do not transfer any information from it into digital systems, including our customer database and appointment software. We keep it in a locked cabinet and destroy it three years after the end of the year of your visit. We may need it until then to defend ourselves against possible claims (Art. 9(2)(f) GDPR). You can withdraw your consent at any time with effect for the future, for example by email to info@sultan-hamam.de. We will then keep the declaration separately until the end of the period and use it only to defend against claims.

14. Your rights

You have the right vis-à-vis us to information about the data stored about you (Art. 15 GDPR), to rectification of inaccurate data (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to receive the data you have provided to us in a commonly used, machine-readable format (Art. 20 GDPR). You can withdraw any consent you have given at any time (Art. 7(3) GDPR).

Right to object: If we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can object to direct advertising at any time without giving reasons (Art. 21(2) GDPR); we will then stop the advertising.

To exercise your rights, a message to the address given in section 1 is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59-61, 10555 Berlin, phone 030 13889-0, email mailbox@datenschutz-berlin.de. You can also contact the supervisory authority at your place of residence.

15. Storage period

We only store personal data for as long as is necessary for the respective purpose or as long as there is a statutory retention obligation. In detail:

  • Order, invoice and gift voucher data including redemption logs and the copy of the order data in our system (section 5.1): until the end of the retention periods under tax and commercial law of up to ten years after the end of the year in which the transaction was completed (Section 147 AO, Section 257 HGB).
  • Gift vouchers not redeemed: until the end of their validity and the subsequent retention period.
  • Customer account: until the account is deleted, order data as above.
  • Your customer record in our customer database (section 5) with name, contact details, date of birth if provided and the overview of your purchases, appointments and visits: until you request deletion, at the latest until three years after the end of the year of your last visit, purchase or appointment with us; the redemption of a gift voucher you bought also counts as a purchase. Section 5.5 describes what happens on deletion and what we are required to keep.
  • Your visit on site (section 13.1): the locker number 90 days after check-out; date and time of your visits, gift vouchers, rental items and orders linked to your customer record for as long as the record exists; the items ordered and amounts up to ten years after the end of the year of the visit (Section 147 AO), separated from your customer record once it has been deleted; the paper form used during an internet outage for as long as the items ordered.
  • Buying a gift voucher on site (section 13.2): transaction number, content, prices and time of the purchase up to ten years after the end of the year of purchase (Section 147 AO), separated from your customer record once it has been deleted; your name and contact details for as long as your customer record exists; the part of a paper form with your contact details until it has been entered into our system.
  • Your entries on the iPad at reception (section 13): until the process has been completed, at most 30 minutes after they were submitted.
  • Booking requests and email correspondence: twelve months after the matter has been dealt with, unless there is a retention obligation.
  • Chat histories in Superchat: twelve months after the last contact; business correspondence, for example about bookings, purchases, gift vouchers and complaints, six years after the end of the year of the last contact (Section 257 HGB, Section 147 AO).
  • Newsletter and WhatsApp consents: until withdrawn. Unconfirmed subscriptions: until we delete them during our regular review because we no longer need them as proof of the subscription process; immediately at your request. We keep the proof of a consent given on site or in the online shop (time, channel, source, text version, withdrawal where applicable) for as long as your customer record exists and, after its deletion, in the form described in section 5.5 until the end of the third year after the year of deletion (Art. 17(3)(e) GDPR, Sections 195 and 199 BGB). For subscriptions via the booking request form, the proof is held by Klaviyo or in the chat history at Superchat. We keep paper forms from earlier subscriptions on site until three years after the end of the year in which you withdrew your consent or in which your unconfirmed subscription was removed. We keep scans of paper forms for as long as your customer record exists and, after its deletion, until the end of the third year after the year of deletion.
  • Consent to review invitations: until withdrawn; Trustpilot sends the invitation itself only once.
  • Google Analytics: user data 14 months; Google Ads conversion cookies up to 90 days, remarketing cookies up to 540 days after your last action.
  • Meta Pixel: the pixel cookie (“_fbp”) up to 90 days; Meta stores the event data transmitted to it according to its own rules, usually up to 180 days for audiences.
  • Campaign and click identifiers (section 3.3): in your browser’s local storage 90 days, immediately if you withdraw your consent; with your order in our customer database, Google identifiers 90 days after the ad click, Meta identifiers 180 days, Analytics identifier 14 months.
  • Reports of redeemed gift vouchers to Google Ads (section 11.4): entries 90 days after the ad click. Log of retrievals by Google Ads (time, result, number of entries, shortened IP address, without names and without identifiers): successful retrievals three years, rejected retrievals 30 days.
  • Cookie decision: twelve months; after that, we ask again in the cookie banner.
  • Access logs of our customer database (section 5.4): three years after they were created. Server logs of the gift voucher download: twelve months.
  • Backup copies of our database and of our automation system (section 5.1): a maximum of twelve months.
  • Data in the appointment software: up to three years after your last visit.
  • Written declarations for visits during pregnancy (section 13.3): on paper only, destroyed three years after the end of the year of your visit.

16. Changes to this privacy policy

We adapt this statement when our services, the providers we use or the legal situation change. The version published on our website at the time applies.

Last updated: October 2026