Privacy Policy

The party responsible for processing personal data on this website (the "controller" under the GDPR) is Bogdan Grama (Energy Flow). Full contact details are given at the end of this policy and in our Impressum.

We only process personal data to the extent necessary to operate this website and to handle your contact and booking requests. The sections below explain what data this involves, for what purpose it is processed, and on what legal basis.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the site, Vercel automatically collects technical access data ("server log files"), such as IP address, date and time of access, the page requested, and the browser and operating system used.

This processing is based on our legitimate interest in providing this website securely and reliably (Art. 6(1)(f) GDPR). Data may be transferred to the US as part of this; Vercel is contractually bound to appropriate safeguards (including EU Standard Contractual Clauses).

The details you enter into our booking form (name, phone number, chosen treatment, optional note) are processed entirely locally in your browser to compose a pre-filled message. This data is never transmitted to or stored on our server.

Only once you click "Send Booking Request via WhatsApp" does WhatsApp open on your own device with that pre-filled message. Whether and how you actually send it is entirely your decision. Only at that point is the data transmitted via the WhatsApp messenger service (see Section 5).

The legal basis for this processing is the initiation or performance of a contract (Art. 6(1)(b) GDPR).

If you contact us via the booking button or a WhatsApp link on this website, your message is sent via the WhatsApp messenger service, provided by WhatsApp Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Meta Platforms, Inc. (USA).

The message is sent directly from your device via your own WhatsApp account; we have no influence over the nature or scope of WhatsApp/Meta's own data processing and cannot accept responsibility for it. WhatsApp's privacy policy applies, available at whatsapp.com/legal/privacy-policy.

The legal basis for using WhatsApp as a contact channel is your voluntary decision to contact us this way (Art. 6(1)(a) or (b) GDPR).

On our Contact page, we offer an embedded map from Google Maps, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map is not loaded automatically — only after you actively click "Load map." Only that click establishes a connection to Google's servers, which may transmit your IP address and other technical data to Google. Your choice is stored locally in your browser so you aren't asked again on your next visit.

The legal basis is your consent (Art. 6(1)(a) GDPR), given by that click. More information is available in Google's privacy policy at policies.google.com/privacy.

This website uses one technically necessary cookie (NEXT_LOCALE) that stores your chosen language (German or English) for the duration of your session, so the site isn't shown in the wrong language on your next request. No consent is required for this, as it is a technically necessary cookie within the meaning of § 25(2) of the German TTDSG.

We also use your browser's local/session storage to remember whether the intro animation has already been shown once, and whether you've agreed to load the Google map (see Section 6). No personal data is transmitted to us or third parties through this.

This website does not use any analytics, marketing, or tracking services.

The fonts used on this website are hosted locally on our own server. No connection is made to Google Fonts or any other external font provider, so no data is transmitted to third parties through this.

If you contact us by phone or email, we store the data you provide (e.g. name, contact details, the content of your inquiry) to process your request. The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR) or our legitimate interest in responding to your inquiry (Art. 6(1)(f) GDPR).

As described in the sections above, we only process your data for as long as necessary for the respective purpose. Data from the booking form itself is never stored by us (see Section 4). Data from direct contact is deleted once it is no longer needed to process your inquiry, and at the latest once statutory retention periods expire.

As a data subject under the GDPR, you generally have the following rights:

• Access to the personal data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent authority is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany.

This website is transmitted exclusively over an encrypted SSL/TLS connection (HTTPS), indicated by the lock icon in your browser.

For a clear overview, here are the external services already named in the sections above that may process personal data as part of operating this website:

• Vercel Inc. (USA) — hosting and server log files, see Section 3
• WhatsApp Ireland Ltd. / Meta Platforms, Inc. — message delivery when you contact us, see Section 5
• Google Ireland Limited / Google LLC — the embedded map on the Contact page, only after your consent, see Section 6