Legal information
Privacy policy
We believe in using as little personal data as possible. This policy explains exactly what we collect, how we use it and why.
1. Data controller
The controller within the meaning of the General Data Protection Regulation (GDPR), national data protection laws and other applicable data protection provisions is:
Varee Thai Massage
Owner: Alisa Bernat
Französische Str. 28
10117 Berlin
Phone: +49 30 23 93 41 39
Email: varee.thaimassage28@gmail.com
2. General information on data processing
We process personal data only where necessary to provide a functional website and our services. Processing takes place only with consent or where permitted by law. The principal legal bases are the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR.
3. Visiting the website (server log files)
When you visit our website, the web server automatically processes technical data transmitted by your browser:
- IP address (shortened where technically possible)
- Date and time of access
- Page requested, HTTP status code and amount of data transferred
- Browser type, browser version and operating system
- Referrer URL (previously visited page)
- Hostname of the accessing device
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the stable and secure operation of the website and protection against attacks. Log data is deleted or anonymised after no more than 14 days unless it is required for longer for security reasons, such as investigating a specific attack.
4. Contact by email, phone or WhatsApp
When you contact us by email, phone or WhatsApp, we process the information you provide (name, contact details, preferred appointment and message) to answer your enquiry and arrange an appointment.
The legal bases are Article 6(1)(b) GDPR (steps prior to entering into or performance of a contract) and Article 6(1)(f) GDPR (our legitimate interest in answering your enquiry). Your data is deleted when it is no longer required for processing, at the latest after statutory retention periods have expired (in particular Section 147 AO and Section 257 HGB).
You are not legally or contractually required to provide your data. Without the information needed to arrange an appointment, however, we cannot process your enquiry.
Note on WhatsApp: Communications through WhatsApp also involve data transfers to the United States. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin, Ireland; Meta Platforms, Inc. is jointly responsible for processing in the United States. Transfers rely on the European Commission adequacy decision for the EU–US Data Privacy Framework (Article 45 GDPR), in which WhatsApp/Meta is certified. Using WhatsApp is voluntary; you can contact us by phone or email instead. Please also see WhatsApp’s privacy policy.
5. Cookies, local storage and analytics
This website uses no tracking cookies, analytics tools (such as Google Analytics or Matomo) and no advertising networks. We use browser local storage solely to remember a language choice so that it persists across page views. This is technically necessary. Consent under Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act) is therefore not required.
6. External services
Fonts (hosted locally)
The fonts used on this website (Lora and Inter) are served locally from our own server at /fonts/. There is no connection to Google Fonts (fonts.googleapis.com, fonts.gstatic.com) or other third-party providers, and your IP address is not transmitted to third parties for this purpose.
Maps (OpenStreetMap)
Our contact and home pages display a static preview image of our location. OpenStreetMap opens in a new tab only when you click that image. No connection to OpenStreetMap or other third parties is made without your explicit click. The provider is the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.
7. Hosting
This website is hosted by Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin. The servers are located in Germany. On our behalf, Strato processes only the technical data required to provide and secure the website (in particular server log files; see section 3). The legal basis is Article 6(1)(f) GDPR, our legitimate interest in secure and reliable website operation. We have a data processing agreement with Strato under Article 28 GDPR. Data is not transferred to a third country outside the EU or EEA for this hosting.
We disclose personal data to third parties in other circumstances only where permitted by law or with your consent.
8. Your rights
You may exercise the following rights concerning your personal data at any time:
- Right of access (Article 15 GDPR)
- Right to rectification of inaccurate or incomplete data (Article 16 GDPR)
- Right to erasure (Article 17 GDPR)
- Right to restriction of processing (Article 18 GDPR)
- Right to data portability (Article 20 GDPR)
- Right to object to processing (Article 21 GDPR)
- Right to withdraw consent at any time with future effect (Article 7(3) GDPR)
To exercise your rights, please use the contact details given in section 1.
9. Right to lodge a complaint
Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. Our competent local authority is:
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Phone: +49 30 13 889-0
Web: www.datenschutz-berlin.de
10. Data deletion and retention
Personal data is deleted or restricted as soon as the purpose for storing it no longer applies. Data may be retained for longer where European or national legislation, regulations or other provisions applicable to the controller require this. Data is also restricted or deleted when a statutory retention period expires, unless continued storage is required to enter into or perform a contract.
11. SSL/TLS encryption
This website uses SSL/TLS encryption for security and to protect confidential content in transit. You can recognise an encrypted connection by the padlock symbol and https:// in your browser’s address bar.
12. Updates to this privacy policy
This privacy policy is currently valid. We may need to update it as our website develops or legal and regulatory requirements change. The current version is always available on this page.
Last updated: July 2026