This privacy policy explains which personal data we process when you visit cilsgeneve.ch, book an appointment, buy a gift card or package, or contact us, for what purposes, and what rights you have.
1. Controller
Beauty Art Pro SARL
Rue Neuve-du-Molard 19
1204 Geneva
Switzerland
UID: CHE-440.506.963 · RC: CH-660.1.025.024-9
Rue Neuve-du-Molard 19
1204 Geneva
Switzerland
UID: CHE-440.506.963 · RC: CH-660.1.025.024-9
Email:
Phone:
Phone:
For any data protection question or to exercise your rights, please contact us at the address above. Further legal information is available in our legal notice.
2. Legal framework
We process personal data in accordance with the revised Swiss Federal Act on Data Protection (FADP, in force since 1 September 2023) and its ordinance. Where the EU General Data Protection Regulation (GDPR) applies, in particular for visitors located in the EU/EEA, we also comply with it.
3. Visiting the website and hosting
This website is hosted on the Cloudflare Workers platform of Cloudflare, Inc.; images are stored in the Cloudflare R2 storage service. When you open a page, Cloudflare processes the technical data needed to deliver it and to keep the site secure: IP address, date and time, requested page, browser, operating system and referring site. This data is used to display the website, protect it against abuse and attacks, and keep it running reliably.
We use Cloudflare Web Analytics to obtain aggregated traffic statistics (pages viewed, loading times, countries). This service does not set cookies and does not build visitor profiles.
4. Online booking
When you book an appointment, we process:
- the service, date, time and, where applicable, the chosen team member and options;
- your name, email address and phone number (required);
- the number to which the SMS reminder is sent, unless you tick "I don't want SMS reminders";
- your optional message to the salon and, optionally, how you heard about us;
- your acceptance of the salon's terms and conditions;
- any promo code and, where applicable, the payment of a deposit (see section 5).
We use this data to schedule and carry out your appointment, to send you the confirmation, reminders and messages relating to your appointment (by email and, unless you opt out, by SMS), to handle changes and cancellations, and to keep our customer history. Please only share health information in the message field if it is necessary for the treatment.
Bookings are managed in the Lorenly salon management platform, which we use as a processor; its servers are located in Switzerland. Emails are sent through the Resend delivery service and text messages through Twilio.
When you submit the booking form, your name, email address and chosen service are recorded so that we can identify a booking that was not completed. To improve the booking process, we also record which booking steps were reached (for example choosing a service or a time), together with a random session identifier and without any names.
5. Payments
Depending on the service, a deposit may be requested when you book. Gift cards and packages are paid online. Payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). Card and payment details are entered directly into Stripe's secure form and are not passed to us; we only receive the payment confirmation, the amount and limited information about the payment method.
Stripe's script and its fraud-prevention cookies (
__stripe_mid, __stripe_sid) are loaded only when you reach a payment step (booking deposit, package or gift card). They are strictly necessary for that payment and are not set on any other page. More information: Stripe's privacy policy (stripe.com/privacy).6. Gift cards, packages and waitlist
When you buy a gift card or package, we process your name, email address, phone number (optional) and, for a gift card given as a present, the sender's name, the recipient's name and the personal message you enter. We use this data to fulfil the order, issue the gift card or package and send it to you.
If you join the waitlist for a fully booked time, we process your name, email address and, optionally, your phone number in order to tell you when a slot becomes available.
7. Contact form and contacting us
If you use the contact form, we process your name, email address, phone number (optional) and message. The message is forwarded to us by email and used only to answer your enquiry. The same applies if you contact us by email or phone.
The WhatsApp button opens a conversation in WhatsApp (WhatsApp Ireland Ltd. / Meta Platforms, Inc.). If you write to us that way, WhatsApp's terms and privacy policy apply in addition to this policy.
8. Bot protection
The contact, booking, purchase and waitlist forms are protected against spam and bots by Cloudflare Turnstile (Cloudflare, Inc.). This service analyses technical characteristics of your browser and connection (including your IP address) to tell humans apart from automated bots. It is strictly necessary for the security of these forms.
9. Cookies and local storage
We use cookies and your browser's local storage (localStorage/sessionStorage):
Necessary (always on)
NEXT_LOCALE(1 year): remembers your chosen language;cookie_consent(1 year) andcookie-consent(local storage): remember your cookie choice;__stripe_mid/__stripe_sid: fraud prevention, only once you reach a payment step (see section 5);- session storage: your booking progress and a random session identifier for booking statistics (deleted when you close the tab);
- local storage: where applicable, a referral code contained in the link you followed, and promotional notices you have dismissed.
Marketing and analytics (only with your consent)
See sections 10 and 11 (Google Analytics, Microsoft Clarity and the Google Maps map).
On your first visit a banner lets you accept all cookies or only functional ones. You can change your choice at any time through the "Cookie Preferences" link at the bottom of every page. You can also delete or block cookies in your browser settings; some features of the website (for example payment) may then stop working.
10. Analytics with your consent
Only if you click "Accept all" do we load Google Analytics 4 (Google Ireland Ltd. / Google LLC, USA) and Microsoft Clarity (Microsoft Ireland Operations Ltd. / Microsoft Corporation, USA) on the booking pages. These tools collect information about how you use the booking pages (pages viewed, clicks, scrolling, time on page, device, browser, approximate location derived from the IP address) and may set their own cookies or identifiers. We use them to understand and improve the booking process. You can withdraw your consent at any time through "Cookie Preferences".
11. Third-party content and links
Our Contact page can display a Google Maps map (Google Ireland Ltd. / Google LLC) showing the salon's location. It is not loaded by default: it loads only when you click "Show map" or if you have accepted optional cookies in our cookie banner. When it loads, Google receives your IP address and browser data and may set its own cookies under Google's privacy policy (policies.google.com/privacy). You can withdraw your consent at any time through "Cookie Preferences".
The website contains links to our Instagram and TikTok profiles and to other websites. No data is passed to these networks unless you click the link; once you are on their site, their own privacy rules apply.
12. Marketing communications
This website has no newsletter sign-up. We only send you promotional information if you have consented to it or where the law permits it for existing customers; you can object at any time by contacting us.
13. Legal bases (GDPR)
Where the GDPR applies, we rely on the performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR) for bookings, orders and payments; on your consent (Art. 6(1)(a) GDPR) for Google Analytics, Microsoft Clarity and displaying the Google Maps map; on compliance with legal obligations (Art. 6(1)(c) GDPR), in particular accounting retention duties; and on our legitimate interests (Art. 6(1)(f) GDPR) in operating a secure and reliable website, preventing fraud and abuse, answering enquiries and measuring traffic in aggregate form.
14. Recipients and processors
Our staff have access to your data to the extent necessary. We use the following providers, who process data on our behalf or, for certain processing, under their own responsibility:
- Cloudflare, Inc. (USA): hosting, content delivery network, image storage, aggregated statistics, bot protection;
- Lorenly (salon management platform, servers in Switzerland): bookings, customer records, gift cards and packages;
- Stripe (Ireland / USA): payments;
- Resend (USA): email delivery;
- Twilio Inc. (USA): SMS delivery;
- Google (Ireland / USA): with your consent, Google Maps and Google Analytics;
- Microsoft (Ireland / USA): with your consent, Microsoft Clarity.
We do not sell your personal data. We may disclose it to authorities where required by law.
15. Transfers abroad
Some providers process data outside Switzerland, in particular in the EU/EEA and the USA. The EU/EEA states provide an adequate level of protection recognised by Switzerland. For transfers to the USA we rely, depending on the provider, on its certification under the Swiss-U.S. Data Privacy Framework or on standard contractual clauses recognised by the FDPIC and the European Commission.
16. Retention
We keep personal data for as long as necessary for the purposes described:
- booking data and customer history: for the duration of the customer relationship, then deleted or anonymised once no longer needed, subject to legal obligations;
- accounting records (payments, gift cards, packages): 10 years (Art. 958f of the Swiss Code of Obligations);
- logs of emails and text messages sent: 6 to 12 months;
- contact messages: as long as needed to handle your enquiry and any follow-up;
- your cookie choice: in your browser until you change it or clear the site data (
cookie_consentcookie: 1 year).
17. Security
We take appropriate technical and organisational measures to protect your data against loss, unauthorised access and manipulation, including encrypted transmission (HTTPS/TLS), restricted and protected access, and protection of the forms against abuse. As no transmission over the internet is completely secure, we cannot guarantee absolute security.
18. Your rights
Subject to the conditions laid down by law, you have the right:
- to access the data we hold about you;
- to have inaccurate data corrected;
- to request the deletion of your data;
- to object to processing and to withdraw any consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- to request the restriction of processing (GDPR);
- to receive the data you provided to us in a commonly used format or to have it transmitted to another controller (data portability).
To exercise these rights, write to us at or to our postal address. We may ask you to prove your identity. We normally reply within 30 days.
You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, if you live in the EU/EEA, with the supervisory authority of your country.
19. Changes
We may amend this privacy policy at any time, in particular when the website or our processing changes. The version published on this page applies.
Last updated: 28 September 2026