This English version is provided for your convenience. Only the German version is legally binding.
Protecting your personal data is particularly important to us – especially as a medical practice. In accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), this privacy policy explains which personal data we process when you visit this website or contact us, for what purposes and on what legal basis, and what rights you have.
1. Controller
The controller responsible for data processing on this website is:
FAYCED Aesthetics
Dr. med. Maximilian Bierler
Leopoldstraße 32
80802 Munich, Germany
Phone: +49 157 30303480
Email: info@fayced.de
Our practice is not legally required to appoint a data protection officer. If you have any questions about data protection, please contact us directly using the details above.
2. Summary
This website is deliberately designed to collect as little data as possible:
- We do not use any analytics or tracking tools (e.g. no Google Analytics, no Meta Pixel) and do not display advertising.
- No cookies are set for visitors.
- Fonts are loaded from our own server. There is no connection to Google Fonts or other font providers.
- Google Maps is only loaded with your consent – via “Accept all” in the cookie banner or by clicking “Load map”.
- Links to Instagram and WhatsApp are simple links. Data is only transferred to these services if you click such a link.
3. Legal bases
We only process personal data where one of the following legal bases permits this:
- Art. 6(1)(a) GDPR: your consent (e.g. for loading the Google map)
- Art. 6(1)(b) GDPR: performance of a contract or pre-contractual measures (e.g. answering your enquiry about a treatment, scheduling an appointment)
- Art. 6(1)(c) GDPR: compliance with legal obligations (e.g. statutory retention periods)
- Art. 6(1)(f) GDPR: legitimate interests (e.g. secure and stable operation of the website)
- Art. 9(2)(a) and (h) GDPR: for health data – based on your consent or where necessary for your medical consultation and treatment
Where information is stored on or read from your device, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies. This only happens where it is strictly technically necessary (Section 25(2) TDDDG) or where you have given your consent (Section 25(1) TDDDG).
4. Hosting and server log files
This website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The servers are located in Germany.
Each time the website is accessed, the server automatically records information transmitted by your browser (so-called server log files):
- IP address of the requesting device
- date and time of access
- page or file accessed
- amount of data transferred and status code of the request
- previously visited page (referrer), if transmitted
- browser and operating system used
This data is technically necessary to display the website to you and to ensure its stability and security, for example to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the website. This data is not combined with other data sources. The log files are automatically deleted after a short period unless, exceptionally, their retention is necessary to investigate a specific security incident.
We have concluded a data processing agreement with the hosting provider in accordance with Art. 28 GDPR. It ensures that your data is processed only on our instructions and in compliance with the GDPR.
5. SSL/TLS encryption
For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in the address bar and the padlock symbol in your browser. Data you send to us therefore cannot be read by third parties.
6. Cookies
Cookies are small text files stored on your device when you visit a website. We do not set any cookies for visitors to this website. The language selection (German/English) is determined solely by the page address (e.g. “/en/”) and is not stored in a cookie.
Only when logging in to the website’s administration area, which is open exclusively to authorised staff of the practice, does the content management system WordPress set session cookies. These are strictly necessary for logging in (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).
Cookie banner and your choice: On your first visit, a banner asks whether we may load external content (currently Google Maps). We store your decision (“Necessary only” or “Accept all”) together with the time in your browser’s local storage (localStorage, entry “fayced-consent”) so that the banner does not reappear on every page view. This information remains on your device, is not transmitted to us and contains no personal details. Storing it is necessary to respect your decision (Section 25(2) no. 2 TDDDG, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). You can change your choice at any time via the “Cookie settings” link in the footer of every page or delete the entry in your browser settings.
7. Contacting us
You can reach us by email, phone or WhatsApp. We process the information you provide – for example your name, contact details, the content of your message and, where applicable, the treatment or appointment you are interested in – in order to answer your enquiry and, if applicable, to schedule an appointment.
The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a treatment or an appointment, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). If you share information about your health, we process it on the basis of the consent you give by voluntarily providing it (Art. 9(2)(a) GDPR) and – where your medical consultation or treatment is concerned – in accordance with Art. 9(2)(h) GDPR. All information is subject to medical confidentiality.
Please note that unencrypted emails can be viewed by third parties in transit. We therefore prefer to discuss sensitive health information in person or by phone.
If you contact us via WhatsApp, your message is transmitted via the service of WhatsApp Ireland Limited (Ireland). Data may also be transferred to the USA; the parent company Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. We have no influence on the data processing by WhatsApp; WhatsApp’s privacy policy applies: whatsapp.com/legal/privacy-policy-eea. If you do not wish this, you are welcome to contact us by phone or email instead.
We delete your enquiry once it has been fully dealt with, unless statutory retention obligations apply. If a treatment takes place, the statutory medical documentation and retention obligations apply (generally ten years after completion of treatment, Section 630f(3) of the German Civil Code, BGB).
8. Google Maps
On the “Practice” page you can display a map from the Google Maps service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
The map is only loaded with your consent: permanently if you choose “Accept all” in the cookie banner, or once if you click “Load map” on the “Practice” page. Only then is a connection to Google’s servers established, transmitting in particular your IP address, information about your browser and the page you are visiting to Google. Google may use cookies or similar technologies on your device. If you are logged in to a Google account, Google may associate the visit with your account.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Consent given by clicking “Load map” applies only to the respective page view. Consent given via the cookie banner applies until you change it. You can withdraw your consent at any time with effect for the future by choosing “Necessary only” via “Cookie settings” in the footer. Alternatively, you can use the “Open in Google Maps” link, in which case Google’s privacy terms apply on its website.
Google also processes data in the USA. Google LLC is certified under the EU-US Data Privacy Framework, so an adequacy decision of the European Commission applies to this transfer (Art. 45 GDPR). For more information, please see Google’s privacy policy: policies.google.com/privacy.
9. Links to Instagram and WhatsApp
Our website links to our Instagram profile and to WhatsApp. These are simple links, not embedded content or so-called social plugins. Merely visiting our website therefore does not transmit any data to Instagram or WhatsApp. Only when you click a link are you taken to the website or app of the respective provider (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, or WhatsApp Ireland Limited), where their privacy policies apply: privacycenter.instagram.com/policy and whatsapp.com/legal/privacy-policy-eea.
10. Our Instagram profile
We maintain a profile on Instagram. When you visit or interact with our profile, Meta Platforms Ireland Limited processes your data. We are jointly responsible with Meta for compiling statistics on the use of our profile (so-called Insights) (Art. 26 GDPR). In an agreement, Meta has undertaken to assume primary responsibility for this processing and to fulfil the rights of data subjects: facebook.com/legal/terms/page_controller_addendum. We only receive aggregated, anonymous statistics. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing information about our practice and communicating with interested parties. You can exercise your rights against both us and Meta.
11. Appointment booking and gift cards
The “Book appointment” and “Gift cards” sections are currently a preview. Information entered in these forms is neither transmitted to us nor to third parties and is not stored. As soon as online booking or gift card purchases via an external provider become available, we will update this privacy policy.
12. Recipients and transfers to third countries
We only share your data where necessary for the purposes described: with our hosting provider as a processor and – as described above and only at your instigation – with Google, Meta or WhatsApp. Beyond that, we only transmit data where we are legally obliged to do so. We do not sell data. Transfers to countries outside the EU/EEA only take place in the cases described in sections 7 to 10.
13. Retention period
Unless a more specific retention period is stated in this policy, we store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods – such as the medical documentation obligation or commercial and tax law obligations of up to ten years. The data is then deleted.
14. Your rights
You have the following rights with respect to us:
- Access to the data we process about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data, unless retention obligations apply (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
An informal message to the contact details above is sufficient to exercise your rights.
Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach
www.lda.bayern.de
15. Automated decision-making and obligation to provide data
No automated decision-making, including profiling (Art. 22 GDPR), takes place. You can use this website without providing any personal data. To answer an enquiry or schedule an appointment, we only need the information required for that purpose.
16. Validity of this privacy policy
Last updated: October 2026. We will update this privacy policy if our website, our data processing or the legal requirements change.