Privacy Policy

Welcome to our website. Thank you for visiting Korean Skin Heaven Zürich and for your interest in our clinic. Protecting your personal data — such as name, phone number and email — is important to us.

The purpose of this Privacy Policy is to inform you about how we process the personal data we collect when you visit this site. Our practice complies with the Swiss Federal Act on Data Protection (FADP), in particular the information duties in Art. 19 ff. FADP.

1. Controller

The controller of the data within the meaning of Art. 5 lit. j FADP is:

MD Group Swiss GmbH
Graben 5
6300 Zug
Switzerland
Email: info@skinheaven.ch
Tel.: +41 79 589 71 98

2. Provision of the website and log files

Every time our website is accessed, our system automatically records data and information from the requesting device (browser version, OS, host name, IP address, date and time of access, pages accessed, referring website, success/failure of the request, volume of data transferred).

These data are stored in log files. They are not stored together with any personal data of a specific user, so individual visitors cannot be identified from them. Storage period: at most 3 months after the site was accessed.

3. Booking form and form autosave

Our site offers a booking form for the K-Glow Facial Reset. The data you enter (name, phone, email, preferred date and time) are processed to prepare and manage your appointment.

Form autosave — important to know: so you don't lose your details if you close the tab or lose connection, the fields you type into the booking form are saved to our database as you type, before you press the final "Book" button. This lets us contact you if a booking is left incomplete. If you do not want this, please do not type into the form.

Legal basis: Art. 6 para. 1 FADP and good faith (Art. 6 para. 2 FADP / Art. 2 CC), for the pre-contractual exchange of information necessary to prepare a possible appointment contract.

Storage period: incomplete/autosaved leads are deleted automatically once you complete the booking, and otherwise after a reasonable follow-up window. Completed appointments are deleted after 12 months, unless statutory retention obligations require longer storage.

4. Disclosure to third parties

We treat your data confidentially and keep them only as long as necessary. We do not sell your data. Apart from the advertising measurement described in section 6, we do not share your data with third parties for their own marketing.

5. Technical service providers we rely on

• Hosting and database: our cloud infrastructure provider (Supabase / Lovable Cloud) stores form entries, bookings and technical logs securely on our behalf.
• Email: the email tools we use to confirm appointments (Resend).
• Spreadsheets: Google Sheets, used as an operational mirror of bookings and leads for the team.
• Advertising measurement: Meta Platforms Ireland Ltd. (Meta Pixel), used to measure how our advertising performs, Google Ireland Ltd. (Google Ads), used to measure bookings from our Google ads, and Microsoft Ireland Operations Ltd. (Clarity), used for usage analytics. They load only after you agree in the cookie banner.

Some providers may process data outside Switzerland or the EU. When that happens we rely on recognised safeguards (Swiss adequacy decisions, EU Standard Contractual Clauses, or the EU–US Data Privacy Framework where applicable).

6. Cookies, tracking and your consent

We use a small entry in your browser's localStorage to remember a random session identifier that links your autosaved form entries together, and a second entry that stores your cookie choice. Both are essential for the site to work as described and you can clear them any time from your browser settings.

Nothing else loads until you agree. On your first visit we show a cookie banner with two equal options, Accept and Decline. The measurement tools below are loaded only after you press Accept. Legal basis: your consent (Art. 6 para. 6 FADP). You can change or withdraw your choice at any time through the Cookie settings link in the footer of every page; withdrawing takes effect immediately and the page is reloaded so nothing keeps running. We record your choice (a random visitor identifier, the decision, the version of this notice and your browser user agent) so we can show that consent was obtained.

Meta Pixel — Meta Platforms Ireland Ltd., Dublin

Purpose: measuring how our advertising performs and reaching comparable audiences. It sets cookies that Meta can read across websites and reports page views plus two actions: when you submit your contact details and when you complete a booking.

Consent in the booking form: if you did not accept cookies, the booking form offers an optional, unticked checkbox. If you tick it, the Meta Pixel loads for that page visit only, and your name, email and phone are passed to Meta in hashed form as described below. Unticking the box stops it. Booking works without ticking it.

If you have agreed and you submit the booking form, your email address, phone number and first and last name are passed to the pixel for advertising matching. The pixel converts them into an irreversible hash in your browser before transmission; Meta receives only the hashed values, and these details are never placed in web addresses or event parameters.

Google Ads — Google Ireland Ltd., Dublin

Purpose: measuring which Google ads lead to bookings. After you accept, the Google tag loads and, when you complete a booking, reports one conversion with the booked price in CHF and a random booking reference. No name, email or phone is sent to Google. Before you choose, the tag is not loaded at all; it runs in Google Consent Mode, and declining or withdrawing switches it to “denied”.

Ad click details stored with your booking: if you arrive through a Google or other ad link, we keep the click reference (gclid, gbraid or wbraid) and campaign tags (utm values) from the web address in your browser for up to 90 days. If you book, they are saved with your booking and passed to our booking and customer system (UNO Werk) so we know which ad brought the booking. They are not sent to Google by this step. Legal basis: our legitimate interest in knowing where bookings come from. You can clear them any time by clearing your browser storage, or ask us to delete them at info@skinheaven.ch.

Microsoft Clarity — Microsoft Ireland Operations Ltd., Dublin

Purpose: usage analytics. Clarity records how pages are used (clicks, scrolling, page flow) so we can improve the site.

These providers may process data outside Switzerland, including in the USA, on the basis of EU Standard Contractual Clauses and the EU–US Data Privacy Framework. You can also object in your Meta or Google ad settings or write to info@skinheaven.ch. More information is available in Meta's privacy policy, Google's privacy policy and Microsoft's privacy statement.

7. Data security and email

Your personal data are protected by technical and organisational measures. In the case of unencrypted email communication, full data security on the transmission path cannot be guaranteed; for information with a high need for confidentiality, we recommend encrypted communication or postal mail.

8. Your rights (Art. 25 ff. FADP)

You have the right of access, rectification, erasure, restriction and data portability. Where processing is based on consent, you may withdraw it at any time. You can exercise your rights at any time by contacting:
MD Group Swiss GmbH · Graben 5 · 6300 Zug · Switzerland
Email: info@skinheaven.ch · Tel.: +41 79 589 71 98

9. Notifications to the FDPIC

Under Art. 49 FADP, affected persons may file a report with the Swiss Federal Data Protection and Information Commissioner (FDPIC) if there are sufficient indications that data processing may infringe data-protection provisions. See edoeb.admin.ch.