Loading...
Last updated: September 2026
This is a convenience translation. In case of any discrepancy, the German version of this Privacy Policy is the legally binding one.
The controller responsible for data processing on this website and within the Glimpii platform is:
Glimpii your lash studio assistant UG (haftungsbeschränkt)
Altenberger Straße 148
51381 Leverkusen
Germany
E-Mail: go@glimpii.com
We are not legally required to appoint a data protection officer. For any data protection matter, you can reach us using the contact details above.
We process personal data only within the scope of the applicable data protection laws (GDPR, BDSG, TDDDG). Depending on the processing activity, we rely on the following legal bases:
For access to information stored on your device (cookies and similar technologies), Section 25 TDDDG applies in addition: access that is not technically necessary takes place only with your consent.
We process your data in order to
The website and platform are hosted on the infrastructure of Google Firebase / Google Cloud. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (group parent: Google LLC, USA).
When you access the site, access data is automatically processed in server log files (IP address, date/time, page accessed, browser type, operating system, referrer). This is technically necessary for secure operation.
A data processing agreement pursuant to Art. 28 GDPR is in place; a transfer to the USA is possible (see section 15).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure provision of the service).
We use cookies and similar technologies. Technically necessary cookies are required for operation (legal basis Art. 6(1)(f) GDPR and Section 25(2) TDDDG respectively).
Non-necessary cookies (in particular for statistics and marketing) are only set after you have given your consent via our cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
You can withdraw or adjust your consent at any time with effect for the future via the cookie settings.
For the virtual try-on (the "AR function") we process photos or camera images provided by you in order to display lash looks. This processing takes place exclusively on the basis of your consent (Art. 6(1)(a) GDPR). Where biometric data is processed in this context, this takes place on the basis of your explicit consent (Art. 9(2)(a) GDPR). The images are processed only for the duration of the function and are not used for identification purposes. You can withdraw your consent at any time.
To use certain functions you create a user account (sign-in via passkey or email). We process the data provided in this context in order to perform the contract (Art. 6(1)(b) GDPR). In the case of booking or appointment requests, we forward the necessary data to the studio you have selected in order to enable the booking.
For the interactive studio map and for finding studios near you we use Google Maps; the address, detail and photo data of the studios shown is retrieved via Google Places.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (group parent: Google LLC, USA).
Purpose: display of the interactive studio map, geocoding of the postcode you enter (conversion into coordinates), location services, and retrieval of the master data and photos of the studios shown.
Legal basis: your consent (Art. 6(1)(a) GDPR) together with Section 25(1) TDDDG for the storage of, and access to, information on your device. The relevant category in the cookie banner is "Third-Party Services".
When your browser contacts Google: the Google Maps library is only loaded after you have given this consent. Without consent, no request is sent to maps.googleapis.com: the map shows a consent notice instead, and a postcode search is rejected and opens the cookie settings. Once consent has been given, Google may process your IP address, technical information about your browser and device, the map section displayed and the postcode you entered, and may set cookies.
Queries made from our servers: the master data and photos of the studios are retrieved via Google Places by our own servers, not by your browser. In doing so we transmit to Google only the relevant search area or the identifier of the studio — neither your IP address nor any cookies from your browser.
You can withdraw your consent at any time with effect for the future via the cookie settings. A transfer to the USA is possible (see section 15).
We use the following services only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) via a consent manager. Without consent, these services are not loaded. You can withdraw your consent at any time.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (group parent: Google LLC, USA).
Purpose: pseudonymous analysis of website use (e.g. pages visited, time on page). Cookies are set and usage data (including a truncated IP address) is processed.
Measurement ID: G-Z7Q2BSHJYD. A transfer to the USA is possible (see section 15).
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (group parent: Google LLC, USA).
Purpose: measuring the success of our Google advertising (conversion measurement) and building remarketing audiences. Your visit is added to audience lists on the basis of which our ads may later be shown to you on Google services and across Google's advertising network.
Conversion ID: AW-18402983610. This account is linked as a destination to the Google Analytics property named in section 10.1 (G-Z7Q2BSHJYD) and is loaded together with its tag; there is no separate tag in the Tag Manager.
Cookies set: in particular _gcl_au and — after a click on a Google ad — _gcl_aw. The details are listed in the cookie table in the cookie settings.
Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG — the relevant category is "Marketing". Without this consent the Google signals ad_storage, ad_user_data and ad_personalization remain set to "denied", and neither conversion nor remarketing data is transmitted. Withdrawing consent deletes the cookies named above from your device. A transfer to the USA is possible (see section 15).
Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (group parent: Meta Platforms, Inc., USA).
Purpose: measurement and optimisation of advertising, reach measurement, audience building (including events such as page view and registration).
Pixel ID: 1111707530461622. Meta is a joint controller with us for certain processing activities (Art. 26 GDPR). A transfer to the USA is possible (see section 15).
Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland (group: ByteDance Ltd.).
Purpose: measurement and optimisation of TikTok advertising, reach measurement.
Pixel ID: D99NDQRC77UARCKB3LI0. A transfer to third countries (including the USA) is possible (see section 15).
Provider: Google Ireland Limited. The Tag Manager manages the services listed above, does not itself set cookies and does not collect personal data for its own purposes; it only serves to deliver the tags after you have given your consent.
For managing enquiries, communication and sending emails we use a customer relationship management system (HighLevel / LeadConnector, a provider based in the USA). The data processed in this context (e.g. name, email, communication history) serves to handle your request (Art. 6(1)(b) and (f) GDPR). A data processing agreement is in place; a transfer to the USA is possible (see section 15).
If you sign up for our newsletter, we use your email address to send you information, news and offers. Sign-up takes place using the double opt-in procedure: after registering you receive a confirmation email; we only send the newsletter once you have clicked the confirmation link.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by sending a message to go@glimpii.com; the withdrawal takes effect for the future. Distribution takes place via our email/CRM system (see section 11).
For processing payments we use the payment service provider Stripe. Provider: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (group parent: Stripe, Inc., USA). When a payment is made, the required payment and invoicing data (e.g. name, email, payment method and transaction data) is transmitted to Stripe and processed there. Stripe acts as controller in its own right for the payment processing. Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligations). A transfer to the USA is possible (see section 15).
For scheduling appointments we use the service Cal.com. Provider: Cal.com, Inc., USA. When an appointment is booked, the data you provide (e.g. name, email address, preferred appointment, and any message) is processed in order to organise and confirm the appointment. Legal basis: Art. 6(1)(b) GDPR (pre-contractual and contractual measures). A data processing agreement is in place; a transfer to the USA is possible (see section 15).
Some of the services used (Google — Firebase/Cloud, Analytics, Ads, Maps/Places —, Meta, TikTok, Stripe, Cal.com, CRM) may transfer data to the USA. Where the providers are certified under the EU-US Data Privacy Framework, the transfer takes place on that basis; in addition, standard contractual clauses (Art. 46 GDPR) are used. The USA does not offer a level of data protection fully equivalent to EU law; in particular, access by government authorities cannot be entirely ruled out. By giving your consent, you also consent to this transfer (Art. 49(1)(a) GDPR).
We only pass on your data where this is necessary: to the studios you select (for booking/appointment scheduling), to technical service providers (hosting, analytics, marketing, CRM, newsletter, payments, appointment booking) on the basis of data processing agreements, and to public authorities where legally required.
We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods (e.g. under commercial and tax law, typically 6–10 years). After that, the data is deleted or anonymised. Account and profile data is stored until your account is deleted.
Under the GDPR you have the following rights:
A message to go@glimpii.com is sufficient to exercise these rights.
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de
We take appropriate technical and organisational measures (e.g. encryption via TLS/HTTPS, access restrictions) to protect your data against loss, misuse and unauthorised access.
We adapt this Privacy Policy whenever the legal situation, the services used or the processing activities change. The version published here at the time applies.