PRIVACY POLICY

I take your privacy very seriously and process your personal data in accordance with the applicable statutory data protection requirements. Personal data in the sense of this policy is any information that can be related to you personally, e.g. name, address, email and IP address, user behaviour.
With the following information I explain how I process personal data and give you an overview of your data protection rights.

Controller
1. The controller pursuant to Art. 4(7) of the General Data Protection Regulation (GDPR) is:
Penelope Uttenthaler
Zieglergasse 34A/1A
1070 Vienna
Austria
Phone: +43 650 8176600
Email: office@penelopeuttenthaler.com
2. I am not obliged to appoint a data protection officer. You can send any data protection enquiries to the contact details above.

Source of personal data
I process personal data that I receive from you when you visit my website or contact me by email or via the contact form. The details are explained below.

Categories of personal data processed
1. If you use my website for information purposes only, i.e. you do not otherwise send me any information, I only collect the personal data that your browser transmits to the server. The following data is technically necessary to display my website and to ensure its stability and security (legal basis: Art. 6(1)(f) GDPR):
IP address
Date, time and duration of the visit
Content of the request (specific page)
Access status/HTTP status code
Referring website
Browser
Operating system
2. In addition, cookies are stored on your device when you use my website. Cookies are small text files that are stored on your hard drive and assigned to the browser you use, through which certain information flows to the party that sets the cookie. Cookies cannot run programs or transfer viruses to your computer. They serve to make the website more user-friendly and effective overall.
3. If you have explicitly consented to cookies for analytics or similar services when visiting my website, these cookies are set on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via the cookie banner. Most browsers accept cookies by default. You can deactivate the storage of cookies in your browser or set your browser to notify you as soon as cookies are sent. If you deactivate cookies completely, you may not be able to use all functions of this website.
4. The following technically necessary cookies are set on this website. They do not require consent, as the website cannot function properly without them.
Cookie or token: XSRF-TOKEN
Purpose: used for security reasons
Storage period: session

Cookie or token: SSR-caching
Purpose: used to indicate the system from which the website was rendered
Storage period: session

Cookie or token: svSession
Purpose: used in connection with user login
Storage period: 1 minute

Cookie or token: fedops.logger.X
Purpose: used to measure system performance
Storage period: 12 months

Cookie or token: consent-policy
Purpose: used for the cookie banner parameters
Storage period: 12 months

Cookie or token: bSession
Purpose: used to measure system performance
Storage period: 12 months

Cookie or token: Sentry
Purpose: helps to detect errors on the website, does not store any personal data of visitors
Storage period: 30 minutes

Transfers to third countries
1. Personal data is only transferred to countries outside the European Economic Area (EEA) if the requirements of Art. 44 et seq. GDPR are met.
2. The EU Commission has adopted an adequacy decision for the USA pursuant to Art. 45(1) GDPR (EU-U.S. Data Privacy Framework). It confirms an adequate level of protection for personal data transferred to participating companies.
3. I only transfer your personal data to the USA or other third countries if the recipient provides appropriate safeguards pursuant to Art. 46 GDPR, for example standard contractual clauses (Art. 46(2)(c) GDPR), if one of the exceptions listed in Art. 49 GDPR applies, for example your explicit consent (Art. 49(1)(a) GDPR), or if the transfer is necessary for the performance of a contract between you and me (Art. 49(1)(b) GDPR).

Hosting with Wix
My website is hosted by Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel (“Wix”). Wix is a tool for creating and hosting websites. When you visit my website, Wix analyses user behaviour, traffic sources, the region of visitors and visitor numbers. Wix stores cookies in your browser that are necessary to display the website and to ensure its security (necessary cookies). The data collected via Wix may be stored on various servers worldwide, including in the USA. For details, see the Wix privacy policy: https://www.wix.com/about/privacy. According to Wix, data transfers to the USA and other third countries are based on the EU Commission’s standard contractual clauses or comparable safeguards pursuant to Art. 46 GDPR: https://www.wix.com/about/privacy-dpa-users. Wix is used on the basis of Art. 6(1)(f) GDPR (legitimate interest). Where consent has been requested, processing is based exclusively on Art. 6(1)(a) GDPR (consent). Consent can be withdrawn at any time.

Data processing agreement
A data processing agreement (DPA) is in place with Wix. It ensures that Wix processes the personal data of my website visitors only in accordance with my instructions and in compliance with the GDPR.

Contact form and email
If you contact me by email or via the contact form, the data you provide (e.g. name, email address, phone number if applicable, reason for contacting me) will be stored in order to answer your enquiry. The legal basis is Art. 6(1)(a) GDPR (consent) or, if your enquiry concerns a booking, Art. 6(1)(b) GDPR (pre-contractual measures). I delete your data once your enquiry has been dealt with, unless statutory retention obligations apply.

Instagram
On my website I link to my Instagram profile: https://www.instagram.com/penelope_makeupandhair/. This is a simple link. No data is transferred to Instagram until you click it.
Instagram belongs to Meta Platforms Inc., based in the USA; its European branch is Meta Platforms Ireland Ltd. When you visit my Instagram profile, Instagram collects personal data from you. Instagram’s privacy policy lists the data collected, the purposes of processing and the recipients: https://help.instagram.com/519522125107875
If you visit my Instagram profile and your browser allows cookies, Meta stores information in the form of cookies and can use them to track user behaviour beyond Instagram (across devices for logged-in users). This also applies to people who are not registered with Instagram. I have no influence on this data processing by Meta. You can also visit my Instagram profile with your browser set to block Instagram cookies.
If you send me a direct message on Instagram, I process the personal data you provide (name, content of the message) in order to reply to you.

Categories of recipients of personal data
1. I have some of the processes described above carried out by carefully selected service providers commissioned in compliance with data protection law. They are bound by my instructions and do not pass your data on to third parties.
2. Beyond this, I only pass on information about you if required by law, if you have given your consent or if I am otherwise authorised to do so. Recipients may then include public bodies and institutions (e.g. tax authorities, law enforcement authorities) where there is a legal or official obligation.

Purposes of processing and legal bases
In addition to the purposes described above, processing is lawful:
on the basis of your consent (Art. 6(1)(a) GDPR),
on the basis of legitimate interests (Art. 6(1)(f) GDPR) to ensure IT security and IT operations and to improve the use of my website,
on the basis of legal requirements (Art. 6(1)(c) GDPR), e.g. retention obligations under commercial and tax law,
on the basis of contractual obligations (Art. 6(1)(b) GDPR), e.g. to prepare quotes and carry out bookings.

Your data protection rights
1. You have the following rights with regard to your personal data:
Right of access, Art. 15 GDPR,
Right to rectification and erasure, Art. 16, 17 GDPR,
Right to restriction of processing, Art. 18 GDPR,
Right to object to processing, Art. 21 GDPR,
Right to data portability, Art. 20 GDPR.
2. You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR (legitimate interests). If you object, I will no longer process your personal data unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
The objection can be made informally and should preferably be sent to the contact details above.
3. You can withdraw any consent you have given at any time with effect for the future.
4. You also have the right to lodge a complaint with a competent supervisory authority (Art. 77 GDPR). In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Data security
1. I protect information with modern security systems and comply with the data protection and security provisions of the GDPR.
2. Online forms on my website are transmitted with SSL encryption to protect the data entered. Nevertheless, I cannot guarantee that the information sent cannot be viewed by third parties during transmission. Please therefore do not send passwords, credit card numbers or other information you wish to keep secret.

Obligation to provide data
You are generally not required to provide any personal data when using my website. Without this data, however, I will usually not be able to answer your enquiry.

Automated decision-making and profiling
I do not use fully automated decision-making or profiling pursuant to Art. 22 GDPR.

Changes to this privacy policy
If I add new features to my website that affect how your personal data is processed, I will update this privacy policy in good time. This privacy policy was last updated in November 2026.