01Controller
The controller for the processing of your data within the meaning of the General Data Protection Regulation (GDPR) is:
For anything to do with data protection, a plain email to info@sonailpro.at is enough.
02The short version
We collect only the data we need for a specific purpose, and we keep it only as long as that purpose lasts. This site does not sell data, does not track you across other websites and carries no advertising networks.
03Requests sent through the forms
When you request a studio visit, a home delivery or a subscription, we process what you enter in the form in order to handle your request and get back to you.
- Data processed: name, phone number, email address where given, delivery address and postcode, the services or package you selected, and your comment.
- Purpose: handling the request, arranging an appointment, delivering the subscription card.
- Legal basis: Art. 6(1)(b) GDPR - steps taken before and in performance of a contract.
- Mandatory fields are marked in the form. Without them we cannot process the request.
04Calculators, tests and requests on the guide pages
Our guide pages on training, funding, trade licensing and earnings carry interactive elements: a funding check, a self-assessment test, two calculators, a checklist, the collective-agreement wage table and a callback form. You always see the result immediately and without giving us any contact details. We only process personal data once you go on to ask us for documents or a conversation.
- Data processed: your name, phone number and/or email address, together with the answers and figures you entered in the element itself.
- Also stored: the page you submitted the form from, so we can put your request in context.
- Purpose: answering your request, sending the documents you asked for, and calling you back.
- Legal basis: Art. 6(1)(b) GDPR - steps taken at your request before entering into a contract.
- Your name and at least one way to reach you are required. Without them we cannot get back to you.
- Self-assessment test
- The test "Passt Nageldesign zu dir?" evaluates five answers automatically and assigns you one of four suggestions (start employed, own studio, alongside another job, try it first). That is profiling within the meaning of Art. 4(4) GDPR. The logic is deliberately simple: each answer counts towards one of the four suggestions, the most frequent one wins, and a tie returns "try it first".
- What it means for you
- Nothing. The result is explicitly a suggestion and not an assessment of your suitability. It creates neither a disadvantage nor an advantage, and there is no automated individual decision producing legal effects within the meaning of Art. 22 GDPR. If you contact us afterwards, the result only helps us answer you appropriately.
- Calculators
- The earnings calculator and the start-up cost calculator work exclusively with the values you set yourself. The calculation runs in your browser; your inputs are only transmitted to us, together with your contact details, if you ask us for a written breakdown.
- Marketing consent
- The tick box for information about training, course dates and funding is separate and not pre-selected. We handle your request regardless of it. The legal basis for it is your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future, without any particular form.
- Record of consent
- If you do consent, we additionally store the exact wording you were shown and the time. This serves only to demonstrate consent under Art. 7(1) GDPR - without it, what you agreed to could not later be evidenced.
Without your consent you will receive no marketing from us by email, SMS or messenger. If you write to us on WhatsApp of your own accord we will of course reply there; we store nothing beyond the conversation itself.
06Hosting and server logs
When you open a page, your browser sends technically necessary data that our hosting provider logs briefly: IP address, date and time, the address requested, the amount of data transferred, the referrer and your browser identification.
These logs exist to keep the site secure and stable and are not combined with any other data. The legal basis is Art. 6(1)(f) GDPR.
08Who receives your data
Your data stays with us. The only other parties with access are the providers that help us run the website and are bound as processors under Art. 28 GDPR - in particular our hosting and database provider.
To take out a subscription we use Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. We pass on your name, email address and the plan you chose; your payment details are entered on Stripe's own page and are never collected or stored by us. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Stripe's privacy policy is at stripe.com/at/privacy.
We do not transfer data to countries outside the European Economic Area unless the transfer is covered by an adequacy decision or standard contractual clauses.
09How long we keep it
- Requests that did not lead to an appointment: deleted no later than six months after the last contact.
- Requests made through the calculators, tests and checklists on the guide pages: deleted no later than six months after the last contact. If you consented to marketing, we keep your contact details and the record of that consent until you withdraw it.
- Records of concluded contracts and subscriptions: seven years, in line with Austrian tax and commercial retention rules.
- Blog comments: until you withdraw them or the post goes offline.
- Server logs: usually no more than 30 days.
10Your rights
You may exercise all of the following against us at any time, free of charge:
- Access to the data we hold about you (Art. 15 GDPR).
- Rectification of inaccurate data (Art. 16 GDPR).
- Erasure, unless a retention obligation stands in the way (Art. 17 GDPR).
- Restriction of processing (Art. 18 GDPR).
- Portability in a common machine-readable format (Art. 20 GDPR).
- Objection to processing based on legitimate interest (Art. 21 GDPR).
An email to info@sonailpro.at is enough. We reply within one month.
11Right to complain
If you believe we are processing your data unlawfully, you can complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde) at dsb.gv.at.
12Changes to this policy
We update this policy when our services or the law change. The version published on this page applies; the date above shows how current it is.
05Blog comments
Comments on blog posts are stored with the name you give, your email address and a timestamp. The email address is never published; we use it only for follow-up questions and to trace abuse.
The legal basis is our legitimate interest in a moderated, spam-free comment section under Art. 6(1)(f) GDPR. You can ask us to delete your comment at any time.