Service provider under § 5 DDG

Xinyi Shao
Sole trader (Einzelunternehmerin)
XY Bloom Makeup Studio

Contact

hello@xybloommakeup.com
+49 155 6346 0927

1. Controller

Xinyi Shao · XY Bloom Makeup Studio

hello@xybloommakeup.com
+49 155 6346 0927

2. Hosting and technical request data

The online website is delivered through Netlify, Inc., USA, and its content delivery network. Requests involve technical data such as IP address, date and time, requested URL, browser/device information, response status, data volume and, where supplied, the referring page. Netlify processes this data to deliver and secure the website and diagnose errors. We use the provider’s server-side request and traffic overviews for these purposes. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a reliable, secure website and understanding its technical use.

Netlify · Privacy ↗

3. Cookies and display preferences

Our website code does not set advertising or analytics cookies or embed tracking pixels. When you actively select a language or colour theme, it stores only that choice in your browser’s localStorage under xy-bloom-language and xy-bloom-theme. These values do not identify you and are not sent to us. They remain until replaced or deleted through your browser’s website-data settings. They provide the display settings you selected (§ 25(2)(2) TDDDG; Article 6(1)(f) GDPR where personal data is involved). Fonts and images are supplied with the website, without automatic requests to Google Fonts, Instagram feeds or embedded maps.

4. Enquiries and email drafts

The enquiry form initially processes your name, email address, project type, optional date/location and message only in your browser. It does not submit the form to a website database or Netlify Forms. The email-app button passes a draft to your configured mail app. Opening Gmail passes the recipient, subject and message to Google in the draft URL before you send the email; you may use the email app or copy option instead. You review and send the email yourself. Once we receive an enquiry, we use the information to reply and, where relevant, prepare or perform a booking (Article 6(1)(b) GDPR), or to handle other correspondence in our legitimate interests (Article 6(1)(f) GDPR).

Our business email uses Google Workspace, provided in this region by Google Cloud EMEA Limited, Ireland. Email content and associated communication data are processed to operate the mailbox and handle correspondence.

Google Workspace · Data Processing Addendum ↗Google · Privacy ↗

5. External links

Instagram, WhatsApp and Google Maps are external links, not automatically loaded embeds. Opening one connects your browser to the chosen provider, which processes data under its own privacy information. If you contact us there, we use the information you provide to handle the enquiry on the legal bases described above. Our website does not load their feeds, maps or advertising pixels merely because you visit this page.

6. Service providers and international transfers

Netlify and Google Workspace process data as service providers under their data-processing terms. Their infrastructure and subprocessors may process data outside the EU/EEA, including in the USA. Their published data-processing terms provide safeguards including EU Standard Contractual Clauses under Article 46 GDPR for relevant transfers. The terms and subprocessor information are linked below; you can also ask us for information or a copy of the applicable safeguards.

Netlify · Data Processing Agreement ↗Netlify · Subprocessors ↗Google Workspace · Subprocessors ↗

7. Retention and provision of information

We keep enquiry and correspondence data only while needed to handle the matter, perform a booking or meet statutory retention duties; it is then deleted unless a continuing legal reason requires retention. Technical hosting data is processed according to the operational, security and troubleshooting purposes of the relevant Netlify service and its service-specific retention rules. The history visible in a dashboard is not the retention period for every provider log. Browser preferences remain as described above; the form does not store your enquiry in localStorage. Providing enquiry details is voluntary, but we need contact details and a description to reply. No automated decision-making or profiling within Article 22 GDPR is carried out by this website.

8. Your rights

Subject to the applicable conditions, you have rights of access, rectification, erasure, restriction of processing and data portability (Articles 15–20 GDPR). If processing relies on consent, you may withdraw it for the future without affecting earlier lawful processing. Contact us at hello@xybloommakeup.com to exercise your rights.

Right to object: where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation under Article 21 GDPR.

You may complain to a data protection supervisory authority, particularly in the country where you live or work or where you believe an infringement occurred. Our local authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Berlin data protection authority · Contact ↗