Data Controller

Levante Spa | A brand of LoLiCo GmbH

Kurgarten 1, 83684 Tegernsee, Germany

Phone: +49 40 987634905 · Email: info@lolico.de

Authorized Representative: Andreas Hasenknopf

‍

‍

Purposes and Legal Bases

We process personal data to provide this website, communicate with you, book treatments, manage (waiting) lists/memberships, and for security and operational purposes.

Legal bases (Art. 6(1) GDPR): consent (a), performance of a contract/pre-contractual steps (b), legal obligation (c), legitimate interests (f; e.g., secure and efficient website operation).

Providing certain data is required (e.g., for bookings); without it, services cannot be provided.

‍

Hosting & Website Provision

The website is provided via Webflow (CMS/hosting). This involves processing server log data and technically necessary cookies. Transfers to third countries (e.g., the U.S.) may occur based on appropriate safeguards (e.g., Standard Contractual Clauses).

‍

Server Log Files

Processed automatically: IP address (possibly truncated), date/time, time zone, requested URL/referrer, status code, data volume, user agent.

Purpose: technical provision, security, error analysis (Art. 6(1)(f) GDPR).

Retention: generally 7–30 days; longer only for security-relevant incidents.

‍

Cookies & Consent

We use essential cookies/storage (e.g., session IDs) required for technical operation (Art. 6(1)(f) GDPR). Non-essential services are activated only after your consent via the consent banner (Art. 6(1)(a) GDPR). You can withdraw or adjust consent at any time in the banner.

‍

Contact Requests

Data: identification data, contact details, message content, metadata.

Purpose: handling your inquiry, communication (Art. 6(1)(b)/(f) GDPR).

Retention: until completion of the request or per statutory retention obligations.

‍

Online Booking of Treatments

Appointments may be booked via an external booking system (e.g., widget/modal). The provider processes booking data (e.g., name, contact details, service selection, appointment), possibly as an independent controller.

Legal basis: contract/pre-contractual steps (Art. 6(1)(b) GDPR) and widget integration based on consent (Art. 6(1)(a) GDPR). Please also review the provider’s privacy notices.

‍

Membership / Waiting List & Payments

For registrations/waiting lists we process contact data; legal basis: pre-contractual steps (Art. 6(1)(b) GDPR). If external membership/payment services are used, processing is based on contract/consent; data may be transferred to payment providers and third countries using appropriate safeguards. Details are provided by the respective providers.

‍

Web Fonts & Script Libraries

Fonts and scripts are preferably hosted locally. If external loading is required (e.g., via a CDN), it occurs only after consent (Art. 6(1)(a) GDPR); technical usage data may be transmitted to the provider.

‍

Recipients & Processors

We use carefully selected service providers (e.g., hosting, email, IT maintenance, booking/membership) under data processing agreements. They process data solely on our instructions and with appropriate security measures.

‍

Retention Period

We store personal data only as long as necessary for the respective purposes. Statutory retention periods (e.g., commercial/tax law) remain unaffected. After purpose fulfillment or expiry, data are deleted or anonymized.

‍

Your Rights

You have the following rights in particular: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority.

‍

Image Sources, Copyright & Trademarks

Original Photos/Graphics (Spa)

We use self-created photos and graphics. Where individuals are depicted, processing is based on consent (Art. 6(1)(a) GDPR); consent can be withdrawn at any time. For non-personal, factual images, use is based on our legitimate interest in an appealing presentation (Art. 6(1)(f) GDPR).

Retention: until the purpose ceases or consent is withdrawn.

Stock Material (Freepik Premium)

We use licensed images/graphics from Freepik under a Premium license.

• Legal basis: legitimate interest in a professional web presence (Art. 6(1)(f) GDPR) and compliance with licensing obligations (Art. 6(1)(c) GDPR).
• Attribution: generally not required for Premium; if specific works require attribution, we will provide it.
• Documentation: used works (title/author/license date/download proof) are documented internally; information available upon request.

AI-Generated Images

We use AI-generated visuals (e.g., illustrations/mockups) without personal reference (Art. 6(1)(f) GDPR). If real persons are exceptionally identifiable, use occurs only with prior consent (Art. 6(1)(a) GDPR). AI images are labeled as such where appropriate.

Copyright

All media on this website are protected by copyright. Any further use (reproduction, modification, distribution) is permitted only within the scope of the applicable license or with consent of the rights holder.

Trademarks

Product and company names and logos mentioned are trademarks or protected identifiers of their respective owners. Use is solely for identification/reference purposes and does not imply any commercial affiliation (e.g., Freepik, Webflow, Treatwell, Instagram).

Notices of Infringement (Takedown)

If you become aware of potential infringements of copyright, trademark, or personal rights, please contact marketing@levantespa.de. We will promptly review substantiated notices and remove or correct affected content without delay.

Withdrawal of Consent

You may withdraw consent at any time with effect for the future (e.g., via the consent banner or by contacting us).

Security

We use TLS/SSL encryption and appropriate technical and organizational measures to protect data against loss, misuse, or unauthorized access.

Changes

This privacy policy may be updated to reflect technical, legal, or organizational changes.

Last updated: November 12, 2025

‍