Privacy Policy

Last updated: 4 September 2026

Protecting your personal data is important to us. This Privacy Policy explains which data is processed when you visit our website and use our services. Processing is carried out in accordance with the General Data Protection Regulation, the Austrian Data Protection Act and the Austrian Telecommunications Act 2021.

​

1. Controller

Companion GmbH
Miss Mai Nails
Döblinger Hauptstraße 34/1
1190 Vienna, Austria
Email: book@miss-mai.at
Telephone: +43 660 266 75 57
Company registration number: FN 466969 w
VAT number: ATU72095957

​

2. Legal Bases

We process personal data only where a legal basis exists. Depending on the individual process, processing is based on your consent pursuant to Article 6(1)(a) GDPR, the performance of pre-contractual measures or a contract pursuant to Article 6(1)(b) GDPR, compliance with legal obligations pursuant to Article 6(1)(c) GDPR, or our legitimate interests pursuant to Article 6(1)(f) GDPR.

​

3. Provision of the Website and Hosting by Wix

This website is operated using the Wix platform. The provider is Wix.com Ltd., 5 Yunitsman Street, Tel Aviv, Israel. When you access the website, Wix processes data including your IP address, the date and time of access, the page accessed, referrer URL, browser type, operating system, language, device information, and technical log and security data.

This processing is necessary to provide the website securely and reliably, detect errors and prevent attacks. The legal basis is our legitimate interest in a secure and functional online presence pursuant to Article 6(1)(f) GDPR.

Wix processes data on our behalf as a processor. Israel benefits from an adequacy decision by the European Commission. Wix may also process data in the European Union, the United States and other countries. Where no adequacy decision applies, Wix states that it uses appropriate safeguards such as Standard Contractual Clauses or an applicable data privacy framework. Further information is available at https://www.wix.com/about/privacy.

Technical log data is deleted once it is no longer required for the purposes stated above. It is retained for longer only where this is necessary for security reasons or to comply with legal obligations.

​

4. Cookies and Consent Management

Our website uses cookies and comparable technologies. Technically necessary cookies are required for the website, booking functions, login, shopping cart and your selected privacy settings to function. They are used on the basis of Section 165(3) of the Austrian Telecommunications Act 2021 and our legitimate interest in a secure and functional website pursuant to Article 6(1)(f) GDPR.

Where optional cookies and external content are controlled through Wix consent management, they are activated only after you have given your consent. The legal basis is Article 6(1)(a) GDPR in conjunction with Section 165(3) of the Austrian Telecommunications Act 2021. Your selection is stored in the cookie banner. You can change your selection or withdraw your consent for the future at any time using the cookie settings icon displayed on the website. This does not affect the lawfulness of processing carried out before consent was withdrawn.

Information about the categories, purposes and storage periods of the cookies used is available directly in the cookie settings. If you disable cookies entirely, certain website functions may be limited.

​

5. Contacting Us

If you contact us by email or telephone, we process the information you provide, in particular your name, contact details and the content of your enquiry. This processing is necessary to handle and respond to your enquiry. The legal basis is Article 6(1)(b) GDPR where the enquiry concerns a treatment, booking or contract. General enquiries are processed on the basis of our legitimate interest in communicating with customers pursuant to Article 6(1)(f) GDPR.

We retain enquiries only for as long as is necessary to process them and answer any follow-up questions. Where statutory retention obligations apply or data is required to establish, exercise or defend legal claims, the data may be retained for longer.

​

6. Online Bookings and Customer Accounts

We use Wix Bookings for online appointment bookings. Data processed includes your name, email address, telephone number, requested service, appointment, selected team member where applicable, any voluntary message, and booking and payment status. Required fields are necessary to create and perform the appointment. An online booking cannot be made without this information.

The data is processed for appointment management, customer communication, performance of the treatment and appointment-related notifications by email, telephone or SMS. The legal basis is Article 6(1)(b) GDPR. Voluntary information is processed only for the purpose you request.

If you create an optional customer account, Wix also processes your login and profile data as well as bookings and transactions linked to the account. The account makes it easier to manage your appointments. The legal basis is Article 6(1)(b) GDPR. You may request deletion of your account at any time, unless statutory retention obligations prevent deletion.

Booking data is retained for contract administration and for as long as it may be required to establish, exercise or defend legal claims. Tax-relevant invoices and payment records are generally retained for seven years from the end of the relevant calendar year. A longer statutory retention period may apply in justified cases.

​

7. Online Payments via Wix Payments

If you choose to pay online when making a booking, payment is processed through Wix Payments. Depending on the selected payment method, Wix, the payment processors used such as Adyen, Stripe or PayPal, participating banks and card networks, and providers of the selected payment method such as Apple Pay or Google Pay may receive data.

Data processed includes your name, contact details, billing and booking information, amount, currency, time, payment method, transaction identifiers, payment status, and fraud-prevention and security-check data. Complete card or wallet access details are entered and processed within the secure payment environment of the participating payment services. We receive the transaction data required to allocate and process the payment, but not your complete card or wallet access details.

Processing is carried out to perform the payment and therefore the contract pursuant to Article 6(1)(b) GDPR, to comply with statutory retention and documentation obligations pursuant to Article 6(1)(c) GDPR, and for fraud prevention and payment security pursuant to Article 6(1)(f) GDPR. Further information is available at https://www.wix.com/about/terms-of-payments and in the information displayed by the selected payment method during payment.

​

8. Newsletter

You can subscribe to our newsletter through our website. We process your email address as well as the time and technical record of registration and confirmation. Subscription is voluntary and is based on your consent pursuant to Article 6(1)(a) GDPR. After subscribing, you will generally receive a message asking you to confirm your email address.

We use Wix functions for registration, contact management and distribution. Your data is stored until you unsubscribe. After you unsubscribe, we may retain proof of consent for the duration of statutory documentation periods and limitation periods.

You can unsubscribe at any time using the unsubscribe link in a newsletter or by emailing book@miss-mai.at. Withdrawal applies to the future and does not affect the lawfulness of processing carried out before consent was withdrawn.

​

9. Google Maps

Google Maps is embedded on our website. The provider for users in the European Economic Area is Google Ireland Limited. Google Maps is loaded only after you have given your consent. Data transmitted to Google may include your IP address, browser and device information, the page accessed and, where applicable, location data. If you are signed in to Google, Google may associate your use with your account.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 165(3) of the Austrian Telecommunications Act 2021. Data may be processed in the United States. Google states that it uses recognised transfer mechanisms for this purpose. Further information is available at https://policies.google.com/privacy?hl=en.

​

10. Facebook Like Plugin and Social Media Links

A Facebook Like plugin provided by Meta Platforms Ireland Limited is embedded on the website. The plugin is loaded only after you have given your consent. Data transmitted to Meta may include your IP address, browser and device information, the page visited, cookie or device identifiers, and your interaction with the plugin. This may also occur if you are not signed in to Facebook. If you are signed in, Meta may associate the data with your account.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 165(3) of the Austrian Telecommunications Act 2021. Data may be processed outside the European Union, in particular in the United States. Further information is available at https://www.facebook.com/privacy/policy/.

Our website also contains links to Facebook and Instagram. Only when you select one of these links do you leave our website, at which point the privacy policies of the respective provider apply.

​

11. Google Reviews via MyReviews

We use the Wix app MyReviews by SocialGestSolutionsLtd or Bizmate to display publicly available Google reviews. When the widget loads, data including your IP address, browser and device information, the page accessed, referrer data and interactions with the widget may be processed. The widget retrieves review content from Google.

Because MyReviews is a third-party app, its technical integration cannot be controlled entirely through the Wix cookie banner. Where MyReviews stores or accesses information on your device, or processes personal data for purposes that are not strictly necessary, your consent is required pursuant to Article 6(1)(a) GDPR in conjunction with Section 165(3) of the Austrian Telecommunications Act 2021. Further information is available at https://blog.myreviews.link/privacy-policy/ and in Google's Privacy Policy.

​

12. Recipients and International Data Transfers

Within our company, personal data is accessible only to those persons who require it to perform their duties. We also disclose data only to carefully selected service providers, payment providers, IT and hosting providers, and to authorities or courts where this is necessary for the purposes stated above or required by law. We do not sell personal data.

Some services may process data outside the European Union or European Economic Area. In such cases, the transfer is based on an adequacy decision, an applicable data privacy framework, or appropriate safeguards such as the European Commission's Standard Contractual Clauses.

​

13. Data Security

Our website uses an encrypted HTTPS connection. We and our service providers use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access.

​

14. Your Rights

Subject to the applicable legal requirements, you have the right to access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with effect for the future. To exercise your rights, please contact book@miss-mai.at. To prevent unauthorised access, we may request appropriate proof of your identity.

If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with us or with the Austrian Data Protection Authority:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna, Austria
Email: dsb@dsb.gv.at
Website: https://dsb.gv.at

​

15. Automated Decision-Making

We do not use solely automated decision-making with legal or similarly significant effects, or corresponding profiling, in connection with this website.

 

16. Updates to this Privacy Policy

We update this Privacy Policy when our website, the services used or legal requirements change. The version published on this website at the relevant time applies.