Privacy Policy

This is a translation of our Datenschutzerklärung. In case of doubt the German version prevails.

This privacy policy informs you about the processing of personal data under Art. 13 GDPR and § 165(3) TKG 2021 (Austrian Telecommunications Act) by MooD Body Space OG — on this website (online booking, package purchases and customer account) and in the “MooD Body Space” app for iOS and Android. How to delete your account and your data is described in section 8.

1. Controller

MooD Body Space OG
Franzensgasse 2/1, 1050 Vienna, Austria
E-mail: info@moodbodyspace.at
Phone: +43 667 3313000

The “MooD Body Space” app is developed on behalf of MooD Body Space OG by E Galactic e.U., Alxingergasse 105/39, 1100 Vienna. E Galactic e.U. also operates the servers of the website and the app and processes your data exclusively on our behalf and according to our instructions (processor, Art. 28 GDPR).

2. Categories of data processed

For bookings, your customer account (website and app) and the “MooD Body Space” app we process the following personal data:

• Master data: first and last name, e-mail address, phone number, preferred language.
• Account data: password (only as a cryptographic hash, never in plain text), confirmation of your e-mail address, time of your last login, optionally your birthday (day and month only, no year).
• Booking data: selected device, date and time, notes, booking status.
• Purchase and payment data: purchased packages and remaining sessions, payments and payment method, invoices, vouchers. We do not receive card data (see section 7).
• Consent data: time you accepted the privacy policy, time of your consent to the processing of body measurements and photos, optional WhatsApp opt-in, optional consent to last-minute offers and news, your notification settings.
• Body measurements, goals and progress photos: health data within the meaning of Art. 9 GDPR, only in the customer account or the app and only with your explicit consent (see section 7).
• App device data: push token and operating system (iOS/Android) of your device, messages in your app inbox.
• Technical data: IP address, browser type and pages visited (server logs); only with your consent, usage statistics of the website (Google Analytics, see section 6).

3. Purposes and legal bases of processing

• Performance of the contract (bookings): Art. 6(1)(b) GDPR.
• Customer account, package purchases and payment processing (website and app): Art. 6(1)(b) GDPR.
• Invoices and accounting: Art. 6(1)(c) GDPR (statutory retention obligation, § 132 BAO, Austrian Federal Fiscal Code).
• Reminder e-mails 24 h and 2 h before the appointment: Art. 6(1)(b) GDPR (ancillary contractual obligation).
• Push notifications about appointments and packages (service messages): Art. 6(1)(b) GDPR.
• Cancelling & rescheduling via magic link: Art. 6(1)(b) GDPR.
• WhatsApp notifications (optional): Art. 6(1)(a) GDPR (consent, revocable at any time).
• Last-minute offers and studio news by push or e-mail (optional): Art. 6(1)(a) GDPR and § 174(3) TKG 2021 (consent, revocable at any time).
• Birthday voucher (only if you enter your birthday): Art. 6(1)(a) GDPR and § 174(3) TKG 2021 (consent by voluntarily entering it, can be removed in your profile at any time).
• Body measurements, goals and progress photos: Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR (explicit consent, revocable at any time).
• Web analytics with Google Analytics (only after clicking “Accept”): Art. 6(1)(a) GDPR and § 165(3) TKG 2021 (consent, revocable at any time).
• App updates and app security: Art. 6(1)(f) GDPR (legitimate interest in an up-to-date, error-free and secure app).
• Language detection based on your browser’s language setting: Art. 6(1)(f) GDPR (legitimate interest in showing you the website in your language).
• Server logs: Art. 6(1)(f) GDPR (security, abuse detection, troubleshooting); for the retention period see section 5.

4. Recipients / processors

• E Galactic e.U., Alxingergasse 105/39, 1100 Vienna — development of the app, technical operation and maintenance of the website, app and servers (processor).
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — server hosting in the Falkenstein data centre (Germany), as a sub-processor of E Galactic e.U.
• helloly GmbH, Rainerstraße 25, 4020 Linz, Austria — sending our e-mails and our mailbox info@moodbodyspace.at.
• Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland — payment processing for package purchases on the website and in the app. Stripe processes payment data partly as an independent controller (e.g. for fraud prevention and legal obligations).
• 650 Industries, Inc. (Expo), USA — delivery of push notifications and provision of app updates.
• Apple (Apple Push Notification service, iOS) or Google (Firebase Cloud Messaging, Android) — technical delivery of push notifications to your device.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — Google Analytics, only with your consent (see section 6).
• Only if WhatsApp notifications are enabled, once we launch this service: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (WhatsApp Business Platform).

Transfers to the USA: Stripe (to Stripe, LLC), Expo, Apple and Google may transfer data to the USA. These companies are certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR).

5. Retention periods

• Booking and customer data: for as long as the business relationship exists, then 7 years statutory retention (§ 132 BAO).
• Customer account (master and account data): until you delete your account; what is kept afterwards is described in section 8.
• Body measurements, goals and progress photos: until you delete them, withdraw your consent or delete your account.
• Push tokens: until you log out of the app, delete your account or your device can no longer be reached for notifications.
• Messages in the app inbox: until your account is deleted.
• Magic-link tokens: until the respective appointment has passed.
• Server logs: web server logs (IP address, page visited, time, browser) 14 days. Technical logs of the application are deleted with every update of the server software.
• Google Analytics: cookies up to 2 years in your browser, analytics data at Google for at most 14 months.
• Backups: we back up the database daily; every backup, including additional backup copies made before software updates, is deleted automatically after 30 days at most. Deleted data may therefore remain in backups for up to 30 days. The backups are stored only on our server in Germany.
• If you withdraw a consent, the data concerned is deleted without delay.

6. Cookies & local storage

Without your consent this website sets no tracking cookies. Only the following entries in your browser’s storage are technically necessary (§ 165(3) TKG 2021):

• localStorage.mood_locale — stores the selected language.
• sessionStorage.mood_geo_done — prevents repeated language detection within a session.
• localStorage.mood_cookie_consent — stores whether you chose “Accept” or “Decline” in the cookie notice.
• localStorage.mood_customer_token and mood_customer_profile — only when you log in to your customer account: your login token as well as your name and e-mail address for display; they are removed when you log out.

These values serve only to operate the website and can be deleted at any time in your browser settings.

Google Analytics (only with your consent): if you click “Accept” in the cookie notice, we load Google Analytics 4 of Google Ireland Limited. Google Analytics sets the cookies _ga and _ga_EZCKXD380J (retention up to 2 years) and records which pages you visit, from which page you came to us, device type and browser, your approximate location (country, city) and completed bookings (treatment and price, without name or e-mail address). Google Analytics 4 uses your IP address only to determine the location and does not store it. We use this data exclusively for statistics on the use of our website. If you choose “Decline”, Google Analytics is not loaded. You can withdraw your consent at any time via the “Cookie settings” link at the bottom of every page.

The “MooD Body Space” app stores on your device: your login token (in the operating system’s protected storage, iOS Keychain or Android Keystore), the selected language, whether login with Face ID / Touch ID / fingerprint is enabled, the push token and cached studio information. This data serves only to operate the app. The login token is sent with every request to our server so that you stay logged in. When you log out, the app removes the login token, push token and the Face ID setting from your device.

7. The “MooD Body Space” app (iOS / Android)

The app uses the same customer account as this website. All data is transmitted encrypted (HTTPS) between the app and the server. In addition to sections 1–6, the following applies to the app:

Customer account

To register we need your name, your e-mail address, your phone number (for questions about your appointments) and a password; registration is not possible without this information. You confirm your e-mail address with a code that we send you by e-mail. You may voluntarily enter your birthday (day and month only); we use it exclusively for a birthday voucher. You can remove it in your profile at any time.

Bookings, packages and payments

Appointments, purchased packages, vouchers, payments and invoices are stored in your customer account and can be viewed in the app and on the website. You pay for packages via Stripe Checkout, the payment page of Stripe Payments Europe, Limited (Ireland), which opens in the app. You enter your card data directly with Stripe; we do not receive it. We transmit your e-mail address, the selected package, your language and an internal customer number to Stripe so that the payment can be assigned to your account. If you use Apple Pay or Google Pay, the privacy policies of Apple or Google also apply.

Body measurements, goals and progress photos (health data)

In the app and in the customer account you can track your progress: body measurements (e.g. height, weight, body fat and muscle percentage as well as the circumference of chest, waist, hips, thighs, calves and upper arms), your goals and private before/after photos. Measurements are recorded by the studio team during your appointment or entered by you. This information may allow conclusions about your health and therefore belongs to the special categories of personal data (Art. 9 GDPR).

• We process this data only with your explicit consent (Art. 9(2)(a) GDPR) and exclusively to show your progress and to support your sessions in the studio. You give your consent in your customer account on this website (My account → Measurements) or in writing in the studio before our team records your measurements. With the next version of the app we will also ask for your consent directly in the app before you use the “Progress” section or the before/after photos for the first time. We store the time of your consent. Without consent you can use all other functions of the app, the website and the studio without restriction.
• Only you and the studio team see your body measurements and goals.
• Only you see your progress photos; the studio team has no access to them in the studio administration. Photos are uploaded only if you do so yourself. We remove metadata such as location and camera data (EXIF) and store the photo in reduced size on our server.
• Withdrawal: you can withdraw your consent at any time with effect for the future — in the customer account on this website (My account → Measurements → “Withdraw consent”), with the next app version also in the app under Profile → Privacy & account, or informally by e-mail to info@moodbodyspace.at. When you withdraw, we delete all body measurements (including those recorded by the studio), your goals and all progress photos. You can delete individual measurements you entered yourself in the app under Progress → History, and photos under Profile → Before / After photos; you can clear your goals under Progress.

Notifications

• Push notifications: if you allow notifications on your device, we store a push token of your device and its operating system. We send the messages (title and text, e.g. treatment and time of your appointment) via the push service of Expo (650 Industries, Inc., USA), which forwards them to the Apple Push Notification service (iOS) or Google Firebase Cloud Messaging (Android).
• Service messages — appointment reminders 24 h and 2 h before, booking confirmations and changes, package status — are sent to perform the contract (Art. 6(1)(b) GDPR).
• Promotional messages — last-minute offers, birthday voucher, studio news — are sent by push only with your consent (Art. 6(1)(a) GDPR). You give it voluntarily when registering (the box is not pre-ticked) or later in your profile.
• Settings and withdrawal: you can switch off the “Last-minute” toggle in your profile at any time. Under Profile → Notifications you can switch off individual push categories as well as e-mail and WhatsApp. You can also disable push notifications in your device’s system settings.
• Inbox: we additionally store every notification in your inbox in the app, even if push is switched off for that category, so that you can read it later.
• E-mail: you receive booking confirmations, appointment reminders and confirmation codes by e-mail to perform the contract. We send promotional e-mails — last-minute offers, studio news and reminders about expiring vouchers — only if you have consented to last-minute offers and news (§ 174(3) TKG 2021), and the birthday voucher only if you have entered your birthday. With the e-mail toggle under Profile → Notifications (app) or My account → Settings (website) you unsubscribe from all promotional e-mails at once; every promotional e-mail explains how to unsubscribe.
• WhatsApp (optional, not active yet): you can enable WhatsApp notifications when registering or in your profile; we then only store your consent. Once we launch the service, we will additionally send booking confirmations, reminders, cancellations and reschedulings via WhatsApp and transmit your phone number, your first name and the treatment, date and time of the appointment to Meta (WhatsApp Business Platform) for this purpose. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw in your profile at any time.

App updates

At startup and regularly during use, the app checks whether a new version is available (Expo Updates / EAS Update by 650 Industries, Inc., USA). A random installation ID, the platform, the app and runtime version, the update channel and your IP address are transmitted to Expo, but not your name, your e-mail address or other account data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an up-to-date, error-free and secure app).

Permissions on your device

• Face ID / Touch ID / fingerprint (optional): the biometric check is performed exclusively by your device’s operating system. The app only receives the result (successful or not); biometric data never reaches us.
• Camera and photos: only when you take or select a progress photo. When selecting from the gallery, the app receives only the image you chose via the system photo picker, with no access to your other photos.
• Calendar: when you add an appointment to your calendar, the app opens your system’s “New event” window, pre-filled with your appointment; you confirm the entry yourself. The app does not read your calendar and transmits no calendar data. On iOS 16 the system requires calendar access for this.
• Notifications: only after you allow them, see “Notifications”.

You can revoke all permissions at any time in your device’s system settings.

No advertising, no tracking: the app contains no advertising and no tracking or analytics software.

8. Deleting your account and data (“MooD Body Space” app)

These instructions apply to the “MooD Body Space” app (iOS and Android) by the developer E Galactic e.U., which is operated on behalf of MooD Body Space OG, and equally to your customer account on this website; both use the same account.

Delete in the app

1. Open the app and log in.
2. Tap Profile and then Privacy & account.
3. In the “Delete account” area, tap Delete account permanently.
4. Enter your password to confirm and tap Delete.

The deletion is carried out immediately; you are then logged out automatically.

Delete without the app

You can also request deletion without the app: send an e-mail with the subject “Delete account” to info@moodbodyspace.at, preferably from the e-mail address you registered with. If we cannot identify you unambiguously, we will ask you to confirm. We process your request without undue delay, at the latest within one month of receipt (Art. 12(3) GDPR), and inform you as soon as the deletion has been completed.

What is deleted

• Your name, your e-mail address, phone number, your password and your birthday. Your customer record is anonymised (name “Gelöschter Kunde” [deleted customer], e-mail address replaced by a placeholder); logging in is no longer possible afterwards.
• all body measurements (including those recorded by the studio), your goals and all progress photos including the image files,
• the studio’s notes on your customer account and your appointments as well as your own notes on appointments,
• your e-mail address and phone number in the delivery log of our messages and in internal change logs,
• the push tokens of your devices, the messages in your app inbox and your notification settings,
• your consents for WhatsApp, e-mail, last-minute offers and health data (they are reset).

Future appointments are cancelled automatically. Active packages expire; there is no refund. If you still have sessions left, please contact us before deleting your account.

What we keep and why

• Accounting records: past and cancelled appointments, purchased packages, vouchers, payments and invoice data remain stored, linked only to the anonymised customer record, for 7 years because of the statutory retention obligation (§ 132 BAO); we delete them after this period.
• Record of the deletion: date of the deletion and number of deleted measurements and photos (without content), as proof that your request was fulfilled. Afterwards the delivery log only contains the type and time of the messages, without the recipient address.
• Payments at Stripe: Stripe keeps payment transactions because of its own legal obligations; details can be found in Stripe’s privacy policy.
• Backups: your data may remain in backups for up to 30 days; after that it is deleted automatically.

Deleting individual data without deleting the account

You can delete measurements you entered yourself and progress photos directly in the app at any time (Progress → History or Profile → Before / After photos); you remove your birthday in your profile. You delete all body measurements, including those recorded by the studio, by withdrawing your consent (see section 7). For all other data an informal e-mail to us is sufficient.

9. Your rights

You have the right at any time to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR)
• withdraw consents given, with effect for the future (Art. 7(3) GDPR)

Please send requests informally to info@moodbodyspace.at. In the app you will find the items “Request my data” and “Correct my data” under Profile → Privacy & account.

10. Right to lodge a complaint

You have the right to lodge a complaint with the Austrian supervisory authority:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority) · Barichgasse 40–42, 1030 Vienna · dsb@dsb.gv.at · www.dsb.gv.at

Last updated: 14 October 2026