Privacy Policy

1. Controller

The controller responsible for data processing is: JustInVentures GmbH, Pfarrer-Brendel-Platz 7, 97274 Leinach, place of business: Theresienstraße 152, 80333 Munich. Email: hello@boosterlounge.com, phone/WhatsApp: +49 177 5201612. A data protection officer is not legally required and has not been appointed.

2. Hosting and Server Log Files

Our website is hosted by Vercel Inc. When the site is accessed, access data (IP address, date/time, page requested, browser/device data) is automatically processed in server log files. The legal basis is our legitimate interest in secure and stable provision (Art. 6(1)(f) GDPR). Vercel acts as a processor; a data processing agreement is in place.

3. Cookies and Consent

Technically necessary cookies are used on the basis of Art. 6(1)(f) GDPR. All non-essential processing (in particular the reach measurement under section 4) takes place only after your explicit consent via our consent banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You may withdraw your consent at any time with effect for the future.

Consent is also required for measurement with Google Analytics, Google Ads and the Meta Pixel (section 4b). We store the consent together with the time and the version of the information provided. After twelve months we ask again; the same applies if what we inform you about changes. A withdrawal takes effect for the future and does not affect the lawfulness of processing carried out until then (Art. 7(3) sentence 3 GDPR). Upon withdrawal we additionally delete every entry on your device that was created only because of the consent; measurement records already collected remain until the periods stated in section 18 expire. Withdrawal does not delete anything already transmitted to Google or Meta (section 4b).

This website loads no content, fonts, maps or videos from third-party servers. Your browser only requests the scripts of Google and Meta if you agree to measurement with them (section 4b); everything else comes from our own address. Names, purposes and durations of the Google and Meta entries are based on the providers’ information and our settings. Not listed are cookies that Google and Meta keep in your browser under their own addresses (such as google.com or facebook.com); they may be read or set when their services are called, and we can neither see nor delete them. The complete overview of what is stored in or read from your device under our address, with name, form, purpose and duration, is set out below:

4. Reach Measurement (our own, without third parties)

With your consent we carry out our own reach measurement. NO third-party service is loaded and nothing is transmitted to third parties; the data stays in our own database (Supabase, see section 16). We process: the page viewed (as a page type, without booking numbers, invoice numbers or access links), the language, a device class (phone, tablet, computer, TV), the window width rounded to 20 pixels, the country (derived from the IP address, which itself is NOT stored), the referring internet domain (the domain only, never the full address), the campaign identifiers from the link (utm_source, utm_medium, utm_campaign, utm_content) and whether the address called up contained an advertising click identifier (such as gclid or fbclid; we do not store the value of that identifier, because it belongs to the respective advertising platform), time on page and scroll depth, steps reached in booking and purchase flows, the opening and reading time of our information windows (effect, procedure and ingredients of the individual Boosts), and technical loading times. To group a visit we store a random identifier generated in your browser in session storage (sessionStorage, key „bl-visit“); it contains no information about you as a person, is discarded when the tab closes and is deleted immediately if you withdraw consent. We build no profiles and no advertising audiences from this measurement of our own. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); you may withdraw it at any time via the consent banner. You decide SEPARATELY about three purposes, and each takes effect on its own: “Reach” (which page, device class, language, country, origin), “Usage” (time on page, scroll depth, steps reached, reading time of the information windows) and “Load time” (technical loading times). Whatever you do not allow never leaves your browser. Individual records are deleted after 90 days (see section 18).

Measurement with Google Analytics, Google Ads and the Meta Pixel is separate: you decide on it separately in the consent banner, and it is described in section 4b.

4a. Voting on future Boosts (ended)

Until 30 Sep 2026 you could indicate on the website which not-yet-offered Boosts you would like (“thumbs up”). This voting has ended: we no longer collect anything for it and no longer store anything for it on your device. The previously set entries “bl-boost-voter” and “bl-boost-votes” are deleted by the website on your next visit.

Votes cast earlier are held only as an irreversible check value without reference to you, and the usage figures of the cards without any identifier. We delete them according to the existing periods: votes after 12 months, usage figures after 90 days, free-text wishes (see section 9) after 24 months. The legal basis was your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

4b. Google Analytics, Google Ads and Meta Pixel

With your consent we also use services from Google and Meta to measure how our website is used and whether our ads lead to purchases. You decide on this in the consent banner separately for Google Analytics, Google Ads and the Meta Pixel; without consent your browser loads none of these services. The consent banner shows which of these services we currently use; a service it does not offer is not loaded. We measure only on our product and information pages, on the page after a successful payment and on the page where you confirm your newsletter sign-up. In your customer account, on pages relating to an appointment or an invoice, and on mandatory pages such as the legal notice, this privacy policy, the terms and conditions and the withdrawal policy, we send no page views and no events and never the page address. If Google Analytics is still loaded from a previous page, it may report on its own how long you are active there, without the page address. We never transmit a page address together with identifiers of a payment, a confirmation link or a sign-in to your customer account.

For this measurement we transmit neither names nor email addresses nor telephone numbers to Google or Meta, not even in hashed form. We do not use features that match such details (Google’s enhanced conversions, Meta’s advanced matching), and we send nothing from our server to Meta (Conversions API). For technical reasons, Google and Meta receive your IP address, details of your browser and device, and the identifiers from their cookies when their services are called: those under our address (overview in section 3) and, where your browser sends them, cookies under their own addresses. This allows them to link the measurement to a signed-in account. A purchase is reported when the page after payment is newly opened, not after reloading or going back; if you open the same address again later, it may be reported once more. For this we store nothing on your device.

Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The purpose is statistics on which pages are viewed, where visits come from and how often purchases are made. Google receives page views with address and page title, including on the pages of individual Boosts; the address may contain campaign and click identifiers from the link and, if you start a booking, the Boost you selected. As the source, Google receives only the domain of the page you came from. Google Analytics also records on its own when a visit starts and how long you are active on a page. For a purchase, Google receives the amount, the currency and the order identifier; in addition an event without an amount when you go to checkout, and an event without further details when you confirm your newsletter sign-up. Google derives an approximate location from your IP address. The order identifier is a pseudonymous string from which neither your name nor the purchased service can be read. Google processes this data as our processor under Art. 28 GDPR (Google data processing terms). Linking with signed-in Google accounts (Google Signals) and sharing the data with Google for its own purposes are switched off. Google Analytics is not linked to Google Ads; Google Ads does not receive anything Google Analytics records. Google Analytics keeps the event data for 14 months.

Google Ads. The provider is also Google Ireland Limited. The purpose is to measure whether one of our ads on Google led you to start checkout or make a purchase. For a purchase Google receives the amount, the currency and the order identifier; when you go to checkout, an event without an amount; each with the page address and title (both may name the Boost you are booking), the domain of the page you came from and, if you came via one of our ads, its click identifier. We do not send page views to Google Ads. For this measurement Google is an independent controller (Google Controller-Controller Data Protection Terms). If you are signed in to Google, Google may link the measurement to your Google account. Personalised advertising is switched off for this data; we build no audiences from it and do not use it to show you our ads again (remarketing).

Meta Pixel. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The purpose is to measure whether our ads on Instagram and Facebook lead to visits and purchases. Meta receives page views with address and referring page, but never on the page of an individual Boost and never when the address or the referring page names a specific Boost. For a purchase Meta only receives the notice that a purchase was made and, as with every call, the address of the confirmation page (without payment identifier or type of purchase) and the referring page, but neither the amount nor details of the purchased or booked service nor an order identifier. Meta may link this data to your Instagram or Facebook account. We and Meta are joint controllers for the collection on our website and the transmission to Meta (Art. 26 GDPR). This is governed by Meta’s Controller Addendum (www.facebook.com/legal/controller_addendum). Under this agreement, we inform you about the joint processing and obtain your consent; Meta fulfils your rights under Art. 15 to 20 GDPR for the data stored by Meta. You may contact us or Meta; we forward requests that concern Meta. After the transmission, Meta processes the data under its sole responsibility and may also use it for its own purposes, such as selecting and personalising ads and improving its services; details are in Meta’s privacy policy (www.facebook.com/privacy/policy).

The legal basis in each case is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). It is voluntary; if you decline, you can use the website without restriction. Google and Meta may also transfer the data to Google LLC and Meta Platforms, Inc. in the USA. Both providers are certified under the EU-US Data Privacy Framework (as of September 2026); the transfer is based on the European Commission adequacy decision of 10 July 2023 (section 17). The Google cookies expire at the latest 90 days after your last visit (our setting), the Meta cookies at the latest 90 days after it (set by Meta); details are in the overview in section 3. Google (for Google Ads) and Meta decide for themselves how long they keep the data under their own responsibility.

You can withdraw your consent at any time with effect for the future, separately for each of the three services, via “Cookie settings” in the footer. After that the withdrawn service no longer runs; if its script was already loaded, the page reloads. Google Analytics and Google Ads use the same Google script: it keeps loading as long as you consent to either, but then works only for that one. We delete the cookies and entries that this service stored under our address (overview in section 3); cookies that Google or Meta keep under their own addresses can be deleted in your browser. Anything transmitted before then is not affected.

5. Appointment Booking

For bookings we use the SimplyBook.me booking system. The data required for scheduling (name, contact details, chosen service, appointment) is processed. The legal basis is the initiation and performance of the contract (Art. 6(1)(b) GDPR). SimplyBook.me acts as a processor; a data processing agreement is in place.

If you book an appointment through ClassPass, we receive from ClassPass your name, the booked appointment and a placeholder address assigned by ClassPass through which we cannot reach you; your contact details and the billing remain with ClassPass. We process this information to carry out the appointment (Art. 6(1)(b) GDPR). We send no confirmations or reminders of our own to that address. ClassPass’s own privacy policy applies to processing there.

6. Health Data (Medical History)

Before a treatment, we offer you a medical history form in paper form, which you are free to complete. If you complete it, we process the health data contained therein (e.g. pre-existing conditions, medications, pregnancy) solely for the purpose of safely performing the treatment. The legal basis is your explicit consent (Art. 9(2)(a) GDPR). The forms are stored exclusively in paper form, under lock, on our premises, and are accessible only to the treating staff and our Heilpraktiker (alternative health practitioners). They are retained for a period of ten years, in line with the period customary for treatment documentation. You may withdraw your consent at any time with effect for the future.

7. Well-being Questionnaire

Before an appointment, we may offer you a short, voluntary well-being questionnaire (e.g. by SMS, email, or WhatsApp). This serves solely to provide a non-binding picture of mood and well-being (e.g. questions about tiredness, workload, or concentration) and is expressly not directed at any medical diagnosis or advice. No health data within the meaning of Art. 9 GDPR is collected through it; in particular, we do not ask here about pre-existing conditions, allergies, medications, or pregnancy. The legal basis is your consent (Art. 6(1)(a) GDPR); participation is voluntary and may be refused without disadvantage. When sent via WhatsApp (Meta Platforms Ireland Ltd.), processing of data outside the EU cannot be excluded. You may withdraw your consent at any time with effect for the future.

8. Payment and Online Purchases

Payments are processed via the payment service provider Stripe (Stripe Payments Europe Ltd.). This includes both the registration of a means of payment to secure bookings and the processing of online payments, in particular for advance payment of a treatment as well as for the purchase of vouchers, Booster Packs, or comparable services. For processing, we handle the order and payment data required for this (e.g. chosen service, amount, payment status) and associate it with your booking or customer account. The registered means of payment is charged for cancellation fees only in accordance with our GTC. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in protection against appointment no-shows (Art. 6(1)(f) GDPR). Stripe acts as a processor; a data processing agreement is in place.

If you select a third-party payment method during checkout, the data required for the payment (in particular name, email address, amount, and order reference) is transmitted to that provider. This concerns PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), Klarna (Klarna Bank AB (publ), Sweden), and, for Apple Pay and Google Pay, Apple Inc. and Google Ireland Limited respectively. These providers process the data for handling the payment method you selected as independent controllers under their own privacy policies, and may carry out their own identity and fraud checks. We have no influence over this processing. The legal basis for the transfer is performance of the contract (Art. 6(1)(b) GDPR). The transfer only takes place if you actively select the respective payment method.

If we issue an invoice to a company or cooperation partner, we process the details required for it (company, contact person, address, VAT ID where applicable, and email address) in order to perform the contract (Art. 6(1)(b) GDPR) and because of the statutory obligation to issue invoices (Art. 6(1)(c) GDPR, Section 14 of the German VAT Act); they are subject to the same retention periods as invoices and payment records (section 18).

If you pay on site in cash or at the card terminal, or if we waive an amount as a goodwill gesture, our staff record this against your booking (booking number, payment method, amount, the staff member who took the payment and, for goodwill for example, a short reason). The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in an orderly cash desk (Art. 6(1)(f) GDPR). We keep the record for as long as it is needed to settle the appointment, at most as long as invoices and payment records (section 18).

8a. Gift Vouchers and Credit

When a gift voucher is purchased, we process the buyer's details (email address and the payment data described in section 8) and — depending on the chosen delivery route — the recipient's name and email address, an optional personal message, and the desired delivery day. We use this information solely to create, deliver, and redeem the voucher. The legal basis is performance of the contract (Art. 6(1)(b) GDPR); for the recipient's details, additionally our legitimate interest in delivering the gift (Art. 6(1)(f) GDPR). The voucher code is not stored in plain text in our database but as an irreversible check value.

So that a voucher delivered to you is visible in your customer account, when you sign in or open your customer account we match your confirmed email address once against open voucher deliveries and automatically assign a voucher delivered to that address to your account. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). After delivery, or once the recipient has claimed the voucher, the buyer of a gifted voucher can only see the order and delivery status — not the current remaining value and not how the voucher is used.

We remove the personal details on the voucher (name, email address, personal message) 90 days after the voucher expires. The redemption history is retained without these details as an accounting basis (section 18).

Occasionally we give away vouchers ourselves, for example as a prize in a giveaway or as a goodwill gesture. In that case we process your name, your email address and, where provided, a personal message solely to deliver the voucher to you and to redeem it; no purchase contract arises, and therefore no receipt and no right of withdrawal. The legal basis is our legitimate interest in running the campaign (Art. 6(1)(f) GDPR); for redemption and for the deletion of your details 90 days after expiry, the preceding paragraphs of this section apply accordingly.

8b. Discount Codes (Promotional Codes)

If you redeem a discount code when booking, we store, for each appointment concerned, the fixed discount amount, the booking number and a transaction bracket (it links the appointments of one booking transaction). Instead of your email address we store a pseudonymous identifier: an irreversible check value of the email address given at booking, computed with a secret key. The address cannot be derived from this check value; no link to your customer account is stored in the process.

The fixed discount amount is the basis for the remaining payment, the invoice, any cancellation fee and refunds; the legal basis is performance of the contract (Art. 6(1)(b) GDPR). The pseudonymous identifier enforces the per-person redemption limit and prevents circumvention of campaign conditions; the legal basis is our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR) — it replaces storing your email address in plain text.

In the event of a cancellation, the redemption is voided but not deleted; the code's redemption quota becomes available again. The pseudonymous identifier also remains after an account deletion, because redemption limits could otherwise be circumvented any number of times by creating and deleting accounts. The redemption rows form part of the accounting records and are retained like invoice and payment records (section 18).

9. Contact and Withdrawal Function

Via the contact forms on our website (general enquiries, enquiries regarding collaboration and franchise, and enquiries for Boost at Home) we process the information you provide in order to handle your request. Depending on the form, this comprises your name, your email address, your telephone number, your address, a preferred appointment time, and the content of your message. The notification is sent to us via our transactional service provider (see section 11). The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in responding to enquiries.

If you contact us by telephone, we process the information you provide during the call for the same purposes and on the same legal basis.

If you contact us via WhatsApp, Meta Platforms Ireland Ltd. processes your message and your telephone number; processing in the USA cannot be excluded. If you use the WhatsApp button on our website following a form enquiry, a message is prepared containing your first and last name so that we can match your message to your enquiry. No further information from the form is transmitted to WhatsApp. You may edit or delete the prepared text before sending it. Using WhatsApp is voluntary; you can also reach us via our contact forms and by telephone.

Please do not send us any health data or other sensitive information via WhatsApp. We discuss health-related matters with you in person on site.

Via the electronic withdrawal function provided on our website, we process the information you submit in order to handle and confirm your withdrawal, and we keep a withdrawal journal as proof of receipt (Art. 6(1)(b) and (c) GDPR). If you book an appointment from a Booster Pack credit, we additionally record, as proof, the time and the version of your express request that the service begin before the withdrawal period expires (Art. 6(1)(b) and (c) GDPR). Both records are deleted after the periods stated in section 18.

In addition to the email, we store one statistics row per enquiry that contains NO information about you as a person: the type of enquiry (general question, collaboration, Boost @ Home, boost wish), the chosen topic, for home visits the lead-time class (today, short notice, with lead time) and the first TWO digits of the postcode, the language, a device class and the processing status. Neither your name, email address, phone number nor address is stored there; those details exist only in the email. The purpose is handling open enquiries and operational planning; the legal basis is our legitimate interest in a functioning enquiry process (Art. 6(1)(f) GDPR). These rows are deleted after 24 months (see section 18). Your message text is not stored there either — with ONE exception: for a Boost wish, the wish text you enter is itself the request. It is therefore stored (max. 500 characters), without any contact details and without a link to any identifier, and deleted after 24 months.

10. Newsletter

If you sign up for our newsletter, we process your email address on the basis of your consent (Art. 6(1)(a) GDPR). You can sign up via the registration form on our website or via the settings in your customer account.

Where you sign up via the form, registration uses the double opt-in procedure. The confirmation email required for this is sent via our transactional service provider (see section 11); it contains no tracking pixel and no click-tracking redirect. Where you activate the newsletter via your customer account, your email address has already been confirmed by signing in to that account.

To demonstrate your consent, we record the time at which it was given. Where you sign up via the form, we additionally record your IP address, your browser type, and the wording of the consent declaration.

The following applies in addition as of 30 July 2026: you may also give your consent when creating a customer account. In that case we add you to the distribution list only once you have confirmed your email address via the confirmation link for your account; you will not receive a separate newsletter confirmation email.

We record the time, the wording of the consent declaration, your IP address and your browser type (user agent) for all of the sign-up routes named above, including activation via your customer account and consent given during registration. Where consent is given during registration, the IP address and browser type relate to the confirmation of your email address. This information is used solely to demonstrate consent pursuant to Art. 7(1) GDPR.

An unconfirmed sign-up is deleted in full after 30 days. After you unsubscribe, we keep the record of your consent for as long as we need to be able to demonstrate it (Art. 7(1) GDPR); we have not yet set a fixed period for this. If you unsubscribe via your customer account, we immediately remove the IP address and browser type from your sign-up; after unsubscribing via the link in the newsletter they remain part of the record. When you delete your customer account, we delete the sign-up for that account’s address and the record held on your customer account.

Dispatch of the newsletter is handled via Brevo (Sendinblue GmbH, Berlin); processing takes place within the EU. Brevo is used exclusively for sending the newsletter and not for sending transactional emails (see section 11). Brevo acts as a processor; a data processing agreement is in place.

Performance measurement. Our newsletters contain a tracking pixel as well as links that are routed via Brevo's servers. This allows us to identify whether and when a newsletter has been opened and which links within it have been clicked. This analysis serves to tailor the content of our newsletter to the interests of its recipients and to improve its design. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and, insofar as information on your terminal equipment is accessed, § 25(1) TDDDG. Consent to performance measurement forms part of your consent to receive the newsletter; it cannot be withdrawn separately. You may object to performance measurement by unsubscribing from the newsletter. Many email programs also suppress the loading of images by default, in which case no open measurement takes place.

You may unsubscribe from the newsletter at any time, for example via the unsubscribe link in every newsletter email or via the settings in your customer account. Unsubscribing from the newsletter has no effect on your receipt of transactional emails that are necessary for the use of your customer account and our services.

11. Transactional Emails

To send transactional emails, meaning those emails that are necessary in connection with the use of your customer account and our services (in particular sign-in and confirmation links, registration confirmation, password resets, the issuing and confirmation of gift vouchers, confirmation of account deletion, and replies to enquiries submitted via our contact form), we use the Transactional Email service provided by Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France.

The data processed comprises the recipient's email address, their name where applicable, the content of the respective email, and technical metadata relating to delivery (in particular the time of sending, the delivery status, and error messages returned by the receiving server). We use this metadata solely to ensure the deliverability of our emails and to identify delivery failures.

Since 23 August 2026, our delivery journal additionally records a pseudonymous recipient identifier for every email sent. It is derived from your email address using a key stored exclusively on our database server and cannot be reversed into the address without that key; the email address itself is not stored in the journal. Using this identifier, our staff can check in the customer file (section 13a) which emails we have sent you in the last 90 days and whether they were delivered — for example, if you ask us why a confirmation has not arrived. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in reliable delivery and in answering your enquiries (Art. 6(1)(f) GDPR). The journal is deleted after 90 days (section 18). Entries that are less than 90 days old at the time of an account deletion remain until that period expires; the last entry evidences delivery of the deletion confirmation.

The legal basis is Art. 6(1)(b) GDPR, as sending these emails is necessary for the performance of the contract or for taking steps prior to entering into a contract, and Art. 6(1)(f) GDPR based on our legitimate interest in reliable and secure delivery.

Processing takes place exclusively within the European Union; no personal data is transferred to a third country in this context. Scaleway acts as a processor; a data processing agreement pursuant to Art. 28 GDPR is in place.

These emails contain no tracking pixels and no click-tracking redirects. Open rates and click rates are not measured. No unsubscribe option is provided for these emails, as they are necessary for the performance of the contractual relationship; this does not affect your right to delete your customer account at any time.

In addition, we send a security notification to the address stored in your account whenever that account's password has been changed. It states the time and the way the change was made and explains what to do if you did not make the change yourself. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest is the security of processing under Art. 32 GDPR, that is, your ability to notice an unauthorised takeover of your account at all. For the same reason this notification cannot be unsubscribed from while the account exists.

12. Customer Account and Sign-in

To manage your bookings, you can create a customer account. Authentication and account management are handled via Supabase. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Supabase acts as a processor; a data processing agreement is in place.

Optionally, you can also sign in with your Google account (“Continue with Google”). If you choose this option, the data required for sign-in is exchanged between Google (Google Ireland Ltd.) and us; in particular, we receive the email address associated with your Google account in order to set up and assign your customer account. The legal basis is the performance of the sign-in procedure you have chosen and performance of the contract (Art. 6(1)(b) GDPR) or your consent (Art. 6(1)(a) GDPR). A transfer to the USA cannot be excluded; for the legal basis, see section 17. Google’s privacy terms additionally apply.

13. Loyalty Programme

If you participate in our loyalty programme, we process the data required for this, in particular the number of your fully paid treatments and the resulting claim to a free service, and associate it with your customer account. The legal basis is the operation of the loyalty programme within the framework of the existing contractual relationship with you (Art. 6(1)(b) GDPR) and our legitimate interest in correct processing and the prevention of misuse (Art. 6(1)(f) GDPR). We store this data for the duration of your participation or for as long as a claim may exist.

13a. Customer File and Internal Analysis

To run the lounge, we bring the information we hold about you together in one place: your appointments from the booking system (section 5), your orders and receipts (section 8), your vouchers and credit and, where one exists, your customer account (section 12). The link is your email address. The purpose is to be able to answer a question on site or by phone without searching four separate systems, and to run the business (capacity, outstanding receipts, unredeemed credit). The legal basis is the performance of the existing contractual relationship with you (Art. 6(1)(b) GDPR) and our legitimate interest in orderly operations (Art. 6(1)(f) GDPR).

From this information we additionally calculate how long ago your last visit was, whether you come regularly, and to what extent guests from a given month return later. These analyses serve planning purposes and allow us to remind you, where appropriate, of existing credit or an expiring voucher. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). NO automated decision within the meaning of Art. 22 GDPR is made: the analysis proposes nothing and triggers nothing, it is read by people. You may object to this processing at any time under Art. 21(1) GDPR; an informal message is sufficient (section 19).

To prepare your appointment, our staff may set an operational note in your customer file from a fixed list: English communication, quiet seat, reachable by phone rather than email, usually comes with a companion, receipt in a company name, pays on site, invoice by post, matter under review. There is no free text, and no note concerns your health. Every note carries an expiry date, usually six and at most 24 months after it was set; it is then deleted automatically, or earlier if you delete your customer account. Guests without a customer account receive no note. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in orderly operations (Art. 6(1)(f) GDPR). On request we tell you which notes are set; you may object to them (section 19).

This view is accessible only to our staff in the protected administration area and requires a separate sign-in. Revenue, balance-sheet and liability figures are additionally reserved for management. Apart from these notes, no new data about you is collected there and no additional data is stored: the view reads what already exists under sections 5, 8, 11, 12 and 13, and the retention periods stated there apply. For technical reasons, the information read from the booking system is cached on our server for up to five minutes. For day-to-day work, our staff can download lists from this view as a file; such files contain the information displayed, then reside on a work device and are deleted once the reason for them has passed.

14. Security and Abuse Prevention

To protect our website and systems against misuse (e.g. automated attacks or spam), we use technical security measures. In doing so, security-relevant events may be logged, such as a shortened (anonymised) IP address, information about the browser used, and the function accessed. The legal basis is our legitimate interest in the security and integrity of our service (Art. 6(1)(f) GDPR). These security logs are deleted regularly, at the latest after 30 days, unless, in an individual case, the investigation of a specific instance of misuse exceptionally requires longer storage.

Separately from this, we log every change our staff make in the protected administration area, for instance cancelling or rescheduling an appointment, creating a booking, or changing an internal appointment note or a setting. Recorded are the time, the acting person with their work email address, the type of change and a summary; that summary may contain your name and the appointment concerned. The sole purpose is to demonstrate who initiated a change. The legal basis is our legitimate interest in the traceability of changes to your bookings and our accountability obligation (Art. 6(1)(f), Art. 5(2) GDPR). After twelve months we remove names and note texts from these entries; what remains is only who made what type of change and when. After ten years we delete the entry entirely. We deliberately do not delete this log upon account deletion, because a record that can remove itself on request would be worthless as a record (Art. 17(3)(e) GDPR).

For every request to reset and every change of the password we record the time, the type of event, the route (customer account or administration area) and your account identifier in order to detect clusters that indicate an unauthorised takeover (Art. 6(1)(f), Art. 32 GDPR). We store no IP address, browser identifier or password. These entries are deleted after twelve months; on account deletion the link to your account is removed immediately.

15. Social Media

Our website contains links to our profiles on Instagram, TikTok, and Facebook. These are simple links; data is transmitted to the respective providers only when you actively click on them and access the relevant platform. The privacy policies of the respective providers apply to processing there. The Meta Pixel is separate from this and loads only with your consent (section 4b).

16. Recipients and Processing

Data processing agreements pursuant to Art. 28 GDPR are in place, where required, with the service providers we use. These are: Vercel (hosting, section 2), Supabase (database and customer account, sections 4 and 12), SimplyBook.me (appointment booking, section 5), Stripe (payment, section 8), Scaleway (transactional email, section 11), Brevo (newsletter dispatch, section 10), Google (Google Analytics, only with your consent, section 4b) and Microsoft (Microsoft Ireland Operations Ltd.; our business mailbox, in which all emails are processed that you send to us or that we receive via our contact forms). Beyond that, we use Google for signing in with a Google account (section 12; for the Google Pay payment method see section 8 and the paragraph below) and, with your consent, for Google Ads; for this Google is an independent controller (section 4b). We use Meta in the context of communication via WhatsApp (sections 7 and 9) and, with your consent, for the Meta Pixel; we and Meta are joint controllers for the collection and transmission (section 4b). Appointments you book through ClassPass reach us from ClassPass (section 5).

By contrast, the providers of the payment method you select (PayPal, Klarna, Apple, Google) act as independent controllers rather than processors; their own privacy policies apply (see section 8).

17. Transfer to Third Countries

Where services transfer personal data to countries outside the EU/EEA (in particular the USA), this is done only on the basis of an adequacy decision (for certified US recipients, the EU-US Data Privacy Framework) and/or appropriate safeguards within the meaning of Art. 46 GDPR, in particular the EU Standard Contractual Clauses. If one of these bases ceases to apply, we base the transfer on the remaining appropriate basis.

18. Retention Period

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods. Invoices and payment records are kept for 10 years due to commercial and tax law obligations (§ 147 AO, § 14b UStG, § 257 HGB); after an account deletion they are retained separately in pseudonymised form (name and email removed) and deleted once that period ends. After that, a retained record can only be linked to a person via a pseudonym; we do not keep name, email and phone number separately for this purpose. This does not apply to the contact address you gave for a purchase without a customer account: it stays on the record until the retention period expires, also after the deletion of a customer account with the same address. Medical history data is kept for 10 years. Security logs are deleted at the latest after 30 days (see section 14). Individual records of the reach measurement (section 4) are deleted after 90 days, the enquiry statistics rows without contact details and free-text wishes (section 9) after 24 months; the delivery journal of our emails (section 11) is deleted after 90 days. For voting on future Boosts (section 4a): the votes are deleted after 12 months, the anonymous usage figures after 90 days. All these periods run automatically every day; the decisive point is the time of collection in each case.

The following periods additionally apply: entries in the administration log (section 14) lose names and note texts after twelve months and are deleted after ten years. The log of access changes (section 14) is deleted after twelve months. Details of a registered payment guarantee (section 8) lose the address and card characteristics no later than 400 days after the matter is settled; a means of payment you registered is removed 540 days after its last use. The withdrawal journal and the record of an express request (section 9) are retained for three years from the end of the year in which they arose and are then deleted automatically. Both remain in place after an account deletion until that period expires, where applicable with the identifier of your former account; the journal also contains the name and contact address you provided. We need both to prove receipt of your withdrawal and your request (Art. 17(3)(e) GDPR). We remove the personal details on gift vouchers 90 days after the voucher expires (section 8a); fixed discount redemptions (section 8b) are retained as part of the accounting records like invoice and payment records. An unconfirmed newsletter sign-up is deleted after 30 days; what remains as a record after unsubscribing is described in section 10. Operational notes on the customer file (section 13a) are deleted on their expiry date, at the latest 24 months after they were set. For Google Analytics, Google Ads and the Meta Pixel, the periods in section 4b apply. We deliberately keep only one single list permanently: the suppression list for email delivery. It contains addresses to which we must permanently stop sending, for instance after permanent non-delivery or a complaint. Deleting that list would mean resuming delivery to precisely those addresses; it exists solely in order NOT to send. For the appointment data held in the booking system (section 5) we deliberately state no automatic period, because we cannot delete it there automatically; on your request we delete it there manually.

19. Your Rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21 GDPR). You may withdraw consent given at any time with effect for the future (Art. 7(3) GDPR).

To exercise these rights, an informal message to hello@boosterlounge.com or to the postal address given in section 1 is sufficient.

20. Right to Complain

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.

21. Currency

We update this Privacy Policy as soon as our data processing changes.

Consent to the Processing of Health Data (Medical History Form)

Consent to the processing of health data: I expressly consent to the health data provided in this form being collected for the purpose of safely performing the treatment, stored in paper form for a period of ten years, and made accessible only to the treating staff and our Heilpraktiker (alternative health practitioners) (Art. 9(2)(a) GDPR). This consent is voluntary and may be withdrawn at any time with effect for the future; further information is contained in our Privacy Policy.