Privacy Policy

1. Controller

Metropolitan Aesthetics UG (limited liability company) represented by the managing directors Dr. med. Volker Rippmann, Christian Roessing, M.D. Charlottenstraße 62, 10117 Berlin, Germany Phone: +49 30 60 93 62 80 E-Mail: berlin@metropolitan-aesthetics.de

2. Storage Duration

We store personal data only for as long as it is necessary for the respective purpose or as required by statutory retention periods. We retain medical documentation for at least ten years after the completion of treatment, in accordance with § 630f BGB and the professional code of conduct, and tax-relevant documents for up to ten years. After this period, the data will be deleted.

3. Recipients and Processors

We only disclose your data if a legal basis permits it. Service providers who process data on our behalf (e.g., hosting or email) have been contractually obligated in accordance with Art. 28 GDPR and carefully selected. As doctors, we are also subject to medical confidentiality according to § 203 StGB.

4. Transfer to Third Countries

Some of the providers mentioned below are based in the USA or transfer data there. For companies certified under the EU-US Data Privacy Framework, the USA is considered a country with an adequate level of data protection (adequacy decision of the EU Commission of July 10, 2023). Where no certification exists, we base the transfer on the standard contractual clauses of the EU Commission in accordance with Art. 46 Para. 2 lit. c GDPR. Despite these guarantees, it cannot be ruled out that US authorities may access the data.

5. Hosting

This website and our content management system are hosted via Strapi Cloud. The provider is Strapi Solutions SAS, 128 rue de la Boétie, 75008 Paris, France. Strapi processes the data generated when accessing the website exclusively on our behalf. A data processing agreement exists with Strapi in accordance with Art. 28 GDPR. For the delivery of images, Strapi Cloud uses Cloudflare's Content Delivery Network. Your IP address may be transmitted to Cloudflare, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6 Para. 1 lit. f GDPR, our legitimate interest in a reliable, fast, and secure provision of the website.

6. Server Log Files

Each time the website is accessed, the server automatically stores the following information transmitted by your browser:

• IP address

• Date and time of access

• Page accessed and amount of data transferred

• Referrer URL (the previously visited page)

• Browser type, browser version, and operating system

We need this data to deliver the website correctly, identify errors, and ward off attacks. We do not combine it with other data and do not draw conclusions about your person. The legal basis is Art. 6 Para. 1 lit. f GDPR. The log files are deleted as soon as they are no longer required for these purposes.

7. Cookies and Consent Management

Cookies are small text files that your browser stores on your device. We treat similar technologies such as local storage or pixels in the same way.

We set technically necessary cookies without consent because the website would otherwise not function, for example, to save your cookie selection. The legal basis is § 25 Para. 2 No. 2 TDDDG and Art. 6 Para. 1 lit. f GDPR.

All other cookies and services (statistics, marketing, and embedded content such as Instagram, Google reviews, or YouTube) are only loaded after you have given your consent in the cookie banner. The legal basis is then § 25 Para. 1 TDDDG in conjunction with Art. 6 Para. 1 lit. a GDPR.

For managing your consents, we use CCM19 from Papoo Software & Media GmbH, Auguststraße 4, 53229 Bonn. When accessing the website, your IP address, browser information, your selection in the banner, a random identifier, as well as date and time are processed. Your selection is stored in your browser so that the banner does not reappear on every visit. This allows us to comply with our accountability obligation under Art. 7 Para. 1 GDPR. The legal basis is Art. 6 Para. 1 lit. c GDPR in conjunction with Art. 7 Para. 1 GDPR and § 25 Para. 2 No. 2 TDDDG.

You can change or revoke your selection at any time via the "Cookie Settings" link in the footer. You can also delete or block cookies in your browser settings. In this case, not all functions of the website may be available.

8. Contact Form

You can send us an inquiry via our contact form. We process the following:

• First name and last name

• Email address

• Phone number (optional)

• Your message

• Date and time of the inquiry and your consent (both are automatically recorded upon submission)

We use this information exclusively to process your inquiry and to contact you. An invisible check field (honeypot) protects the form from spam without collecting additional data from you.

Since inquiries to a medical practice often contain health information, we obtain your explicit consent before submission. The legal basis is Art. 6 Para. 1 lit. a GDPR and, insofar as health data is concerned, Art. 9 Para. 2 lit. a GDPR. If it concerns an appointment request or treatment, Art. 6 Para. 1 lit. b GDPR is additionally applicable.

The inquiry is transmitted encrypted to our practice mailbox (see section 9). We delete the data as soon as your inquiry has been fully processed and no retention obligations exist. If treatment occurs, the information becomes part of your patient file and is subject to the applicable deadlines. You can revoke your consent at any time by email to berlin@metropolitan-aesthetics.de.

9. Contact by Email and Phone

If you contact us by email or phone, we process your information to handle your request. The legal basis is Art. 6 Para. 1 lit. b GDPR if your inquiry is related to a treatment, otherwise Art. 6 Para. 1 lit. f GDPR. We process health data in accordance with Art. 9 Para. 2 lit. h GDPR.

Our email mailboxes, including inquiries from the contact form, are operated by united-domains GmbH, Gautinger Straße 10, 82319 Starnberg. A data processing agreement exists with united-domains in accordance with Art. 28 GDPR. The legal basis is Art. 6 Para. 1 lit. f GDPR, our legitimate interest in secure and reliable email communication.

10. Instagram Feed and Google Reviews via Elfsight

We display posts from our Instagram profile and reviews from our Google Business Profile on our website. For this, we use widgets from Elfsight. The provider is Elfsight, SL, Spain.

What happens during loading? The widgets are only loaded after you have given your consent in the cookie banner. Then your browser loads scripts from Elfsight's servers (elfsightcdn.com). Elfsight receives your IP address, browser type, and operating system. According to Elfsight, this data is stored for seven days and used only for error analysis and abuse prevention. Elfsight operates its servers on the Google Cloud Platform. Additionally, Elfsight may set a cookie named "elfsight_viewed_recently" which prevents multiple counting of views.

Instagram Feed: Images and videos from the feed can be loaded directly from servers of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Meta may receive your IP address and technical browser data. If you are simultaneously logged into Instagram, Meta may be able to associate the visit with your account.

Google Reviews: The widget displays public reviews from our Google Business Profile with the names and profile pictures of the authors. Profile pictures and other content can be loaded from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may receive your IP address.

The legal basis is your consent according to Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TDDDG. You can revoke it at any time via the cookie settings. Meta and Google may also transfer data to the USA. Both companies are certified under the EU-US Data Privacy Framework (see section 4).

Further information: Elfsight Privacy Policy, Instagram Privacy Policy, Google Privacy Policy.

11. Meta Pixel (Facebook and Instagram)

With your consent, we use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. This allows us to measure the effectiveness of our ads on Facebook and Instagram and to show relevant ads to visitors of our website there (remarketing, custom audiences).

The Pixel transmits, among other things, your IP address, browser and device information, the page accessed, and certain actions, for example, submitting the contact form, to Meta. We do not transmit the content of your inquiry. If you are logged into Facebook or Instagram, Meta can associate the data with your account and use it for its own purposes. We ourselves only see anonymous, aggregated evaluations.

For the collection and transmission of data to Meta, we are jointly responsible with Meta (Art. 26 GDPR). The details are regulated by Meta's Controller Addendum. Meta is solely responsible for further processing. The legal basis is your consent according to Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TDDDG. Meta may transfer data to Meta Platforms, Inc. in the USA, which is certified under the EU-US Data Privacy Framework.

You can revoke your consent at any time via the cookie settings. You can manage your ad settings on Meta at facebook.com/adpreferences. More information can be found in Meta's Privacy Policy.

12. Our Pages on Facebook and Instagram

We operate our own pages on Facebook and Instagram. If you visit them, interact with us, or send us messages, Meta processes your data according to its own terms. For the statistics on our pages (Insights), we are jointly responsible with Meta. The basis for this is the Page Insights Addendum. Meta assumes primary responsibility, including for the fulfillment of your data subject rights. We only receive aggregated statistics, no data on individual persons. The legal basis for our presence is Art. 6 Para. 1 lit. f GDPR, our interest in communicating with patients and interested parties.

13. YouTube Videos

We embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the enhanced privacy mode (youtube-nocookie.com). The video is only loaded after your consent. Then YouTube receives, among other things, your IP address and information about which page you visited. If you are logged into YouTube, YouTube can associate this with your account. The legal basis is Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TDDDG. Google is certified under the EU-US Data Privacy Framework.

14. Google Ads and Google Tag Manager

With your consent, we use services from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland:

• Google Ads Conversion Tracking and Remarketing, to measure the success of our ads and show relevant ads to visitors of our website.

• Google Tag Manager, to control these and other services on the website. The Tag Manager itself does not set cookies and does not evaluate data, but it processes your IP address.

We use Google Consent Mode. Without your consent, no advertising cookies are set. The legal basis is Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TDDDG. Google may transfer data to the USA and is certified under the EU-US Data Privacy Framework. You can deactivate personalized advertising on Google at adssettings.google.com. More information can be found in Google's Privacy Policy.

15. Microsoft Clarity

With your consent, we use Microsoft Clarity. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Clarity shows us in heatmaps and recorded sessions how visitors use our website, such as clicks, mouse movements, and scrolling behavior. This allows us to identify where the website can be improved.

Among other things, your IP address, device and browser information, the pages visited, and your interactions are processed. Clarity sets cookies for this purpose (e.g., _clck and _clsk). Entries in form fields are masked and not transmitted to Microsoft. According to Microsoft, the data is stored for a maximum of 13 months.

The legal basis is your consent according to Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TDDDG. You can revoke it at any time via the cookie settings. Microsoft may transfer data to the USA. Microsoft Corporation is certified under the EU-US Data Privacy Framework. More information can be found in Microsoft's Privacy Policy.

16. Your Rights

You have the following rights against us at any time:

• Information about your data stored by us (Art. 15 GDPR)

• Rectification of inaccurate data (Art. 16 GDPR)

• Erasure of your data, unless there is a retention obligation (Art. 17 GDPR)

• Restriction of processing (Art. 18 GDPR)

• Data portability in a common, machine-readable format (Art. 20 GDPR)

• Withdrawal of a given consent with effect for the future (Art. 7 Para. 3 GDPR)

For all concerns, an informal message to berlin@metropolitan-aesthetics.de is sufficient.

17. Right to Object

If we process your data on the basis of our legitimate interest (Art. 6 Para. 1 lit. f GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 Para. 1 GDPR). We will then no longer process the data, unless we can demonstrate compelling legitimate grounds or the processing serves the assertion of legal claims. You can object to processing for direct marketing purposes at any time without giving reasons (Art. 21 Para. 2 GDPR).

18. Right to Lodge a Complaint with a Supervisory Authority

You can lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR. The authority responsible for us is:

Berlin Commissioner for Data Protection and Freedom of Information Alt-Moabit 59-61, 10555 Berlin www.datenschutz-berlin.de

19. Obligation to Provide Data and Automated Decisions

You are not obliged to provide us with personal data via this website. However, without your information, we cannot answer an inquiry via the contact form. Automated decision-making or profiling according to Art. 22 GDPR does not take place by us.