Privacy & Cookie Policy
Last updated: 5 October 2026
1. Data controller
The controller of personal data collected through this website is "Μαρία Χούσου (Ατομική Επιχείρηση)", trading as "Aesthesis", with its registered office at Koraka 39, Plateia 1866, Chania 73135, 1st floor, Greece, General Commercial Registry (GEMI) no. 193516658000, VAT no. 170040215. You can reach us at aesthesis@beautycenter.gr or +30 28213 04267.
2. What data we collect
Contact form: your full name, phone and/or email, and your message, only when you submit them so that we can respond to your inquiry.
Technical data: as you browse the website, our hosting provider and the site's security services automatically process your IP address and basic browser details, for technical and security purposes.
Traffic statistics: only with your consent, pages read, referring website, contact and booking intent, selected social/review links and form starts (never form contents), browser/device type, country and page-load timings. No cookies, advertising or visitor profiles.
With your consent, we use privacy-focused traffic-statistics services (see section 5). We do not use advertising trackers, and we do not build user profiles.
Filling in the contact form is optional: you are under no obligation to give us your details. Without some way to reach you, however, we cannot respond to your inquiry.
3. Sensitive health data
Please do not include health details (e.g. skin conditions, medication) in your form message. Any such information needed for a treatment is discussed in person, during your appointment. If such details are submitted inadvertently, they will not be used to answer the inquiry. You will be invited to discuss them in person, and the information will be deleted as soon as reasonably possible.
4. Purposes and legal bases
Responding to your inquiry (contact form): to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
Security and abuse prevention (spam checking, infrastructure protection): based on our legitimate interest (Art. 6(1)(f) GDPR).
Compliance with legal obligations, where required (Art. 6(1)(c) GDPR).
Understanding how the website is used (traffic statistics): only with your consent (Art. 6(1)(a) GDPR and art. 4(5) Law 3471/2006). You can withdraw consent at any time via Privacy settings at the bottom of every page, without affecting processing before withdrawal.
We do not carry out automated decision-making about you, and we do not build user profiles (Art. 22 GDPR).
5. Recipients of data
Your data is shared only with the strictly necessary service providers (processors):
Formspark (Belgium, with data stored on infrastructure in Ireland and Germany, within the EU): receives and forwards contact-form submissions to us.
Infomaniak (Infomaniak Network SA, Switzerland, a country with an EU adequacy decision): hosts our business email mailbox, where contact-form notifications and emails you send us are received and stored.
Cloudflare (Turnstile service): security check protecting the form against automated abuse (spam). It processes technical connection details for this purpose.
Storyblok (content management provider, EU): the website's images are served from its content delivery network, which processes your IP address to deliver them.
Cloudflare (Cloudflare Workers): website hosting via its global delivery network, and technical logs.
Umami (Umami Software Inc., United States; we use its EU data region; any transfers to the US are covered by standard contractual clauses): with your consent, provides the website's traffic statistics. It receives the address of the page you are viewing, the website that referred you, your browser and device type, your screen size and language setting, and, when you use a contact link, which contact method and which part of the page you used. It stores nothing on your device. Your IP address is processed on its servers to derive a temporary code that rotates regularly and to determine your approximate location (country, region and city); the IP address itself is not kept by us, and the vendor does not retain it in a form that identifies you. It never receives your name, phone number, email address, message, or any information about treatments.
Cloudflare Web Analytics (Cloudflare, Inc., USA): with your consent, visit statistics and page-speed measurements (page address, referrer, browser/device type, country and page-load timings). Transfers use the EU-US Data Privacy Framework and standard contractual clauses.
The website also displays public Google reviews. Reviews are fetched when the website is updated (not by your browser) and are shown with first name and last initial only, without photos.
The website may embed an interactive map from Google Maps (e.g. on the contact page). The map does not load automatically: a static image is shown, and Google's interactive map loads only if you click the relevant button. Only then does Google (US) receive your IP address and possibly set cookies, under GDPR safeguards. If you do not click, no data is sent to Google.
Any transfers outside the European Economic Area (e.g. to Cloudflare's US parent company) take place under GDPR safeguards, including the EU-US Data Privacy Framework and standard contractual clauses.
6. Client photos
We publish client photos (both "model" photoshoots and "before/after" result photos) on the website and on social media only where we have obtained your separate, explicit, written consent specifically for that purpose, separate from the service agreement. "Before/after" photos may reveal information concerning health (a special category of data) and are published only with your explicit consent (Art. 9(2)(a) GDPR), without any name, date, or other identifying detail. You can withdraw your consent at any time at aesthesis@beautycenter.gr; on withdrawal we promptly remove the photos from the channels we control and do not republish them (withdrawal does not affect the lawfulness of publication before it).
7. Retention period
Contact-form messages are kept for up to 12 months after our last communication, unless a business relationship or legal obligation requires longer retention. Technical logs are kept for as long as each provider specifies (see their privacy notices). Umami statistics and Cloudflare Web Analytics statistics are each kept for up to 6 months. Your consent choice is kept on your device for 6 months (182 days).
8. Cookies and local storage
Umami and Cloudflare Web Analytics load only after you accept statistics in the consent banner. Neither service sets cookies. We use no advertising cookies or visitor profiles.
Cloudflare Turnstile (contact-form pages only): processes technical connection details strictly necessary for the anti-spam check.
Local storage (localStorage): remembers announcement dismissal. It also remembers your statistics choice (accepted or rejected) for 6 months (182 days). This is technically necessary to remember your choice and is not shared with the analytics services. If you reject or withdraw consent, it also stores a flag (umami.disabled) that keeps statistics switched off.
You can change or withdraw your choice at any time using Privacy settings at the bottom of every page. Withdrawal stops analytics and reloads the page, without affecting earlier processing. If storage is unavailable, the choice is remembered only for the current page session.
The optional interactive Google map (section 5) may set Google cookies only after you choose to load it.
9. Security of your data
We apply reasonable technical and organizational measures to protect your data: an encrypted connection (HTTPS), access control over the messages we receive, and choosing providers that offer adequate security guarantees. No transmission of data over the internet is completely secure, so we cannot guarantee absolute security. In the event of a breach that poses a risk to your rights, we notify the Hellenic Data Protection Authority within 72 hours and, where the risk is high, we also inform you without undue delay.
10. Minors
This website is intended for adults. We do not knowingly collect data from minors under 18 through the contact form, nor do we direct advertising for aesthetic services at minors. Photographs of minors are published only with the consent of the person holding parental responsibility. If we become aware that we have received a minor's data without the required consent, we delete it. If you are a parent or guardian and believe this has happened, please contact us at aesthesis@beautycenter.gr.
11. Your rights
You have rights of access, rectification, erasure, restriction of processing, data portability and objection to the processing of your data. You may also withdraw your consent at any time, without retroactive effect. To exercise these rights, contact us at aesthesis@beautycenter.gr. We respond to every request within one month; if a request is complex, that deadline may be extended by a further two months, and we will tell you if so. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, Greece, www.dpa.gr).
12. Changes to this policy
We may update this policy when the way the website operates changes. The current version is always published on this page with its last-updated date.
