Legal information

Privacy Policy

This translation is for information purposes only. The German version is the only legally binding version.

The protection of your personal data is important to us. Below, we provide information on the processing of your data in accordance with the General Data Protection Regulation (GDPR).

1. Data controller

Rubedo Spa — Monica Galletti
Marienstraße 58, 32427 Minden, Germany
Telephone: +49 571 78343423
Email: info@rubedo-spa.de

2. Data processing when visiting the website

When this website is accessed, the hosting provider automatically records information in so-called server log files (e.g. IP address, date and time, page accessed, browser used). This is for technical provision and security purposes.

Legal basis: Article 6(1)(f) of the GDPR (legitimate interest in a secure, fully functional website).

Hosting: This website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When the site is accessed, technical data (IP address, user agent, date/time) is stored in the server log.

3. Contact & Appointment Enquiries

If you contact us via the enquiry form, by email or by telephone, we will process the data you provide (e.g. name, email address, telephone number, your message) in order to deal with your enquiry and arrange an appointment. The enquiry form opens your own email programme with a pre-filled message; only the information you yourself send will be transmitted.

Legal basis: Article 6(1)(b) of the GDPR (initiation/performance of a contract) or (f) of the GDPR (processing your enquiry).

Data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected and there are no statutory retention periods that prevent this.

4. Genome-based analyses (special notes)

Genetic data — special category

Genetic data may be processed as part of genome-based analyses. This data falls within the special categories of personal data (Art. 9 GDPR) and is processed solely on the basis of your explicit consent (Art. 9(2)(a) GDPR).

  • The analysis is carried out for cosmetic (lifestyle) purposes — ‘beauty genes’ and skin ageing factors. It is not a medical diagnosis, nor is it an assessment of illness or risk.
  • The saliva sample is pseudonymised with a QR code; your full name is not passed on to the laboratory. Contact details and sample are kept separately in accordance with the laboratory’s procedure.
  • Recipients: a method partner in Switzerland and a genetics laboratory in Austria. We give you their names before the sample is taken. An analysis is only carried out once data processing agreements under Art. 28 GDPR are in place with the recipients.
  • Third-country data transfers to Switzerland: Switzerland has an adequate level of data protection recognised by the European Commission (Adequacy Decision, Art. 45 GDPR).
  • No data is passed on to insurance companies, employers or public authorities.
  • Information is provided in accordance with the German Genetic Diagnostics Act (GenDG). You may withdraw your consent at any time with future effect; existing data will be deleted immediately upon request.

5. Fonts

The fonts on this website are embedded locally and are loaded from our own server. No data is transferred to third parties (e.g. Google Fonts).

6. AI-generated image content

Some of the images used on this website are AI-generated and are for illustrative purposes only. They are not photographs of real people or spaces, unless otherwise indicated.

7. Cookies & Audience Measurement

This website does not use cookies for audience measurement or advertising purposes, nor does it incorporate any analytics or tracking services. A cookie banner is therefore not required.

Links to external services (e.g. the map view of our location) only open the respective provider’s page once you have clicked on them; from that point onwards, that provider’s privacy policy applies.

8. Your rights

You have the right at any time to:

  • Information regarding your processed data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Withdrawal of consent granted, with effect for the future

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia (LDI NRW).

9. Timeliness

Date of this privacy policy: October 2026. We will update the policy as soon as changes to data processing make this necessary.

Book an appointment