Privacy Policy

1. Controller

The controller for data processing on this website is:

2. Data protection officer

No data protection officer has been appointed. According to our current assessment, the requirements of Art. 37 GDPR and § 38 BDSG are not met, as fewer than 20 persons are permanently engaged in the automated processing of personal data.

For all questions regarding data protection, please contact the controller named above directly.

3. Principles

We only collect what is actually necessary for the referral. Health data is processed exclusively server-side. We do not store full IP addresses. Everything we store has a deletion deadline that is monitored automatically.

4. Hosting and server log files

This website is operated by Vercel Inc. Delivery and execution of server functions take place in the Frankfurt am Main region (fra1).

When the website is accessed, the server automatically processes technical access data such as the page requested, time, volume of data transferred, browser type and operating system. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and trouble-free operation of the website.

A data processing agreement is in place with Vercel. Transfers to the USA are covered by the EU Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

5. Hair analysis form — health data

In the hair analysis form we collect: gender, age group, affected areas, stage of hair loss, duration, family predisposition, previous treatments and medication, desired density and time frame, as well as your contact details.

Some of this information constitutes health data within the meaning of Art. 9(1) GDPR. We process it exclusively on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR in conjunction with Art. 6(1)(a) GDPR.

We obtain consent separately for each purpose: for the processing itself, for disclosure to the consulting non-medical practitioner, and for transfer to the partner clinic. Contact via WhatsApp is additional and entirely optional.

You may withdraw any consent at any time without giving reasons, with effect for the future — informally by e-mail to info@mc-este.com. The lawfulness of processing carried out up to that point remains unaffected. Following a withdrawal, we delete the data concerned without delay.

Providing the data is neither legally nor contractually required. Without it, however, we cannot process your enquiry.

6. Photo upload

You may voluntarily upload up to five photographs of your scalp. Photographs are not required for the enquiry — you can skip this step.

An upload is only possible after you have expressly consented. This consent is logged server-side; without the record, the upload is rejected technically. The consent text, the time, the language version and a truncated IP address are stored as evidence pursuant to Art. 7(1) GDPR.

The photographs are held in a private, non-publicly accessible storage location in the EU. Access is possible exclusively server-side. Location data and other metadata (EXIF) are removed in your browser before the file is transmitted.

We delete photographs after three months at the latest — that is, earlier than your contact details. In the event of a withdrawal we delete them immediately.

7. Transfer to the partner clinic in Turkey

The purpose of our activity is referral to a partner clinic in Istanbul. For this we transfer your details — including photographs if you wish — to that clinic so that it can assess your case and make you an offer.

Turkey is a third country within the meaning of the GDPR. There is no adequacy decision by the European Commission pursuant to Art. 45 GDPR for Turkey. This means the level of data protection there may not correspond to that of the European Union, and enforcing your rights may be more difficult than within the EU.

We point this out expressly before you consent. The transfer takes place on the basis of your explicit consent pursuant to Art. 49(1)(a) GDPR.

The partner clinic is Scala Clinic, Dikilitaş, Yenidoğan Sok. No:7, 34349 Beşiktaş/İstanbul (Turkey). We transmit nothing without your consent.

8. Disclosure to the consulting non-medical practitioner

The consultation is conducted by a non-medical practitioner (Heilpraktiker) in Bergkamen. So that he can advise you, we pass on your details to him. This too only happens with your separate consent.

The advising naturopath is Bünyamin Bas, Bergkamen.

9. Sending e-mails

We use the service Resend (Resend, Inc., USA) to send confirmation and notification e-mails. The notification to us contains the details from your form; your confirmation e-mail contains a summary.

Data is thereby transferred to the USA. The legal basis is Art. 6(1)(b) GDPR for processing your enquiry; for the health data contained we additionally rely on your consent pursuant to Art. 9(2)(a) GDPR.

A data processing agreement is in place with Resend, including the EU Commission’s standard contractual clauses for transfers to the USA.

10. Database and file storage

We store your details and photographs with Supabase Inc. in the eu-central-1 region (Frankfurt am Main). Access is possible exclusively server-side via a privileged key; all rights are revoked for public access roles.

Processing takes place as commissioned processing under Art. 28 GDPR on the basis of Supabase’s data processing addendum.

11. Contact form and contact by telephone

If you write to us via the contact form, we process your name, e-mail address, telephone number, subject and message in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR.

Please do not send health data via the contact form. The hair analysis form, which contains the necessary consent architecture, is intended exclusively for that purpose.

12. Storage in your browser

So that you can interrupt the hair analysis form and continue later, we store your answers locally in your browser (localStorage, key “mceste-hair-analysis-draft”). This data does not leave your device before you submit the form.

The draft is deleted immediately after submission and, if it is older than seven days, discarded the next time you open the form at the latest. You can remove it yourself at any time by clearing the site data in your browser. If you use a shared device, we recommend filling in the form in a private window.

13. Cookies and consent

We use technically necessary storage operations on the basis of § 25(2) TDDDG without consent. Everything beyond that — in particular analytics — is only deployed after your explicit consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

You can change or withdraw your decision at any time via the “Cookie settings” link in the footer. As evidence we store the time, the categories selected, the banner version and a truncated IP address for twelve months.

• Necessary: storage of your cookie decision and of the form draft. The site does not work without these.
• Analytics: Google Analytics 4 — only after your consent. It is not loaded beforehand.

14. Google Analytics 4

Only with your consent do we use Google Analytics 4 (Google Ireland Limited). The service is not loaded before consent; we additionally use Consent Mode v2 with consent denied by default. Upon withdrawal we remove the scripts and delete the associated cookies.

The legal basis is Art. 6(1)(a) GDPR. A transfer to the USA cannot be excluded.

15. Google Maps

On the contact page you can load a Google Maps map by clicking. No connection to Google is established beforehand. By clicking you consent to the transfer of your IP address to Google (Art. 6(1)(a) GDPR).

16. WhatsApp

We offer WhatsApp as an additional means of contact. It is a plain link — no data is transmitted to WhatsApp merely by visiting our site.

If you write to us via WhatsApp, the privacy terms of WhatsApp Ireland Limited apply. As a matter of principle we do not request health data or photographs via WhatsApp and ask you not to send any there. Please use the hair analysis form exclusively for that purpose.

17. Recipients of your data

Beyond the purposes stated, we do not pass on your data. The recipients are:

• Vercel Inc. — hosting and delivery of the website (Frankfurt region).
• Supabase Inc. — database and file storage (Frankfurt region).
• Resend, Inc. (USA) — sending notification and confirmation e-mails.
• Google Ireland Limited — analytics and map service, in each case only after your consent.
• The consulting non-medical practitioner — only with your separate consent.
• The partner clinic in Istanbul, Turkey — only with your separate consent.

18. Retention and deletion

We delete automatically. A daily job removes expired data.

• Photographs: three months after upload at the latest.
• Hair analysis details including contact data: six months.
• Records of cookie consent: twelve months.
• Records of photo consent: twelve months — these must outlast the deletion of the photographs so that it remains provable that consent existed.
• In the event of withdrawal or a deletion request: without delay, irrespective of the periods above.

19. Your rights

You have the following rights vis-à-vis us. An informal e-mail to info@mc-este.com is sufficient; we reply within the statutory period of one month.

• Access to the data stored about you (Art. 15 GDPR).
• Rectification of inaccurate data (Art. 16 GDPR).
• Erasure (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR).
• Objection to processing based on legitimate interests (Art. 21 GDPR).
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR).

20. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for us is:

21. Data security

Transmission takes place exclusively encrypted via HTTPS. The file storage is private; uploads run via short-lived access links generated server-side. Database access is completely blocked for public roles. Forms are protected against automated bulk requests.