Privacy policy

Legal

This English version is provided for your convenience. In the event of any discrepancy, the German version shall prevail.

Last updated: 14 October 2026

This page explains which data we process when you visit this website, write to us or come to the practice – what for, for how long, and what rights you have. It is based on the General Data Protection Regulation (GDPR), the Austrian Data Protection Act and the Austrian Telecommunications Act 2021 (TKG).

1. Who is responsible?

ATHENORIS OG
Biodorf-Weg 4/12, 5164 Seeham, Austria
Email: office@atlaspraxis.at

“Atlaspraxis Seeham” is an offering of ATHENORIS OG. For any question about data protection, please write to the address above – we will answer you personally.

We have not appointed a data protection officer, because the law does not require one here: the obligation applies to public authorities and to businesses that process specially protected data on a large scale or monitor people (Art. 37 GDPR). A small practice with few staff and a limited circle of clients does not fall into this category (see Recital 91 GDPR).

2. The essentials in brief

Reading this website requires no cookies and no cookie banner.
We use no advertising or tracking services of other companies and we do not sell data.
For our visitor statistics no program runs in your browser; we only evaluate the logs of our own web server.
We record information about your well-being only with your written consent – on paper, locked away at the practice, not electronically.
You can ask for information, have data corrected or deleted and withdraw consent at any time.

3. Visiting the website

When a page is called up, the server briefly keeps a log: IP address, time, page requested, amount of data transferred, browser and operating system, and the page you came from. We need this so that the website runs securely and reliably and so that we can detect attacks (legitimate interest, Art. 6(1)(f) GDPR). The logs are kept only briefly and are continuously overwritten (the storage for them is limited to 30 MB per service, which corresponds to a few weeks depending on visitor numbers); if a security incident has to be investigated, we keep the relevant extract for as long as the investigation takes.

The website runs on a server we rent from Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany (server location within the EU). Hetzner processes the data only on our behalf; an agreement under Art. 28 GDPR is in place.

4. Cookies and storage in your browser

Nothing is stored in your browser when you read the website. Only in three cases does the website store something – each time because you trigger it yourself and it is technically necessary for that (section 165(3) TKG):

When you submit a form, the website sets a session cookie with a random identifier. It contains no form data, only makes sure your submission arrives safely and that you see the confirmation, and is deleted afterwards.
When you switch on the accessible view, your browser remembers this setting. It stays on your device and is not transmitted to us.
When you object to visitor statistics (section 4a), the website sets the cookie “atlas_statistik”. It contains only the note “aus” (off), is valid for one year and makes sure your requests are not counted.

You can delete cookies and stored settings in your browser at any time; the website remains fully usable.

We deliberately do not show you a cookie banner: we store nothing that would require your permission. Rather than holding you up with prompts on your first visit, we prefer to put our effort into good work – and we value your honest feedback, which tells us more than any statistic.

4a. Visitor statistics

To see which pages are read, we use the software Matomo on our own server to evaluate the logs that our web server keeps anyway (section 3). No statistics program runs in your browser, and nothing is stored on or read from your device for counting. We evaluate the page requested, the date and time, the browser, operating system and device type as your browser sends them with every request, the website you came from (its domain only) and the approximate country. Matomo shortens your IP address by its last two bytes before storing it; the country is determined from the shortened address only. Individual requests are not combined into visits or profiles.

We delete the stored individual records – shortened address, page, time and browser details – after 90 days. After that only totals remain, such as “the fees page was opened 120 times in October”.

The legal basis is our legitimate interest in a website that is easy to understand and to find (Art. 6(1)(f) GDPR). You can object at any time without giving reasons:

Object to visitor statistics – your browser remembers this with a small cookie that serves only this purpose (section 4). From then on we no longer count your requests; after the click you return to this spot. The objection applies to this browser on this device until you delete its cookies. With allow visitor statistics again you withdraw it.

Requests already counted cannot be attributed to any person, so we cannot single them out (Art. 11 GDPR); they disappear with the 90-day period.

5. Contact by email or telephone

If you write to us or call us, we process your name, your contact details and your request in order to reply and arrange appointments (Art. 6(1)(b) GDPR, otherwise (f)). If no appointment results, we delete the request no later than six months after it has been dealt with. If an appointment results, section 10 applies.

Please do not send us health information by email – ordinary emails are not encrypted. We discuss such matters in person at the practice.

6. Contact form

You can request an appointment using the contact form. We receive your name, your email address, optionally your telephone number and preferred way of reply, and your message. The message reaches our practice mailbox by email; the website itself does not store it. Without your name and email address we cannot reply; everything else is optional.

The legal basis is taking steps towards an appointment at your request (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries ((f)). Storage period: until the enquiry has been dealt with, six months at most. Please do not describe complaints or diagnoses in the form; if such details reach us nevertheless, we use them only to reply and delete them together with the message.

7. Protecting the forms against misuse

To stop the forms from being misused for spam, our own server checks every submission – without external services such as Google reCAPTCHA and without cookies. Your browser solves a small computing task in the background; without JavaScript a simple arithmetic question appears instead. We also limit how often messages can be sent within a short time from the same connection or with the same email address. For this the server keeps, for one day at most, a disguised check value from which your IP or email address cannot be recovered. The legal basis is our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR).

If you sign up for our newsletter (in German), we use your email address only to send you new blog posts and news from the practice about every six weeks, at most nine times a year. The legal basis is your consent (Art. 6(1)(a) GDPR, § 174 of the Austrian Telecommunications Act 2021). Sign-up is protected against misuse in the same way as our forms (section 7).

Confirmation (double opt-in): After you sign up, we send you an email with a confirmation link that is valid for 24 hours. Only when you click it do we add you – so nobody can sign you up without your knowledge. If you do not confirm, the request is deleted automatically after a few days. As proof of your consent we store the email address, the times of sign-up and confirmation and the text of the confirmation email (Art. 7(1) GDPR).

You can unsubscribe at any time via the link at the end of every issue, at unsubscribe from the newsletter or with an informal message to us. Your address is then removed from the list of recipients immediately. So that it is not added again by mistake, a check value (hash) of the address stays on a block list. We keep the proof of your earlier consent for at most three years after you unsubscribe, so that we can show that sending was lawful (Art. 6(1)(c) and (f) GDPR).

Sending and anonymous click counting: Our website sends the newsletter itself via our email account (section 12); we do not use an external newsletter service. We do not measure opens – the emails contain no tracking pixels. The links in the newsletter lead via our own address (atlaspraxis.at/nl/k/…) and are the same for every recipient. Our server only counts how often a link was called per hour; for this it stores neither your email address nor your IP address or browser data, and a click cannot be traced to a person. So that automatic checks by the security software of email providers do not distort the figures, the server evaluates the browser identifier at the moment of the click and keeps a disguised check value of the connection for at most one hour (as in section 7). If a link leads to our website, it carries an identifier of the newsletter issue; our visitor statistics (section 4a) then show how often pages were opened from the newsletter – also without cookies and without any program in your browser. As with every page request, the short-lived server log described in section 3 is also created. The legal basis is our legitimate interest in making the newsletter useful (Art. 6(1)(f) GDPR).

8. Testimonials (feedback)

On the feedback page you can send us your feedback after an appointment and, if you wish, agree to its publication on this website. We receive your name, email address, month and year of the appointment, your text, optionally a rating that only we see and – if you wish – the form of name and your consent.

Storage: your submission is stored in this website’s database; by email we only receive a short notice without its content. For each testimonial we record when and by whom it was checked, which version is published and what we changed, your approval, and the time and wording of your consent. We use your email address only for questions about your testimonial, above all for your approval.

How we handle it: nothing is published automatically. We compare name and appointment with our appointments and check the text. We may not publish statements about illnesses or healing or names of other people; if we change anything for that reason, you will see the version for approval beforehand. Only the text is published, under the form of name you chose – never your email address, appointment or rating – and on the English pages also in English translation.

Legal basis: for publication, your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by informal email; we then remove the testimonial from the website immediately. Our legal obligation to demonstrate your consent applies to the evidence of consent (Art. 7(1) in conjunction with Art. 6(1)(c) GDPR); otherwise our legitimate interest in improving our work and in being able to show that published testimonials are genuine ((f)).

Storage period: if you do not wish publication, if we decline it or if you withdraw beforehand, we delete the submission six months after receipt. While we are still checking a testimonial or waiting for your approval, we keep it for as long as that takes. After publication we keep the original text, the published version, the approval and the check notes as evidence for up to three years after the last day online.

9. Withdrawing via the website (“withdraw from contract”)

On the page withdraw from contract you can withdraw from a contract concluded online. We store your name, your email address, your details of the contract and the date and time of receipt, and send you a confirmation of receipt. This is provided for by law (section 13a of the Austrian Act on Distance and Off-Premises Contracts) and serves as evidence (Art. 6(1)(c) and (f) GDPR). Storage period: seven years if a payment is affected (tax retention obligation, section 132 of the Austrian Federal Fiscal Code), otherwise three years. You can also withdraw by email or letter.

10. Clients of the practice

a) Appointments and contact. For your sessions we process your name, contact details, appointments and services booked, for children under 14 the name of the parent or legal guardian, and your signed intake form as evidence. We do not collect a date of birth. The legal basis is the contract (Art. 6(1)(b) GDPR) and, for the evidence of consent, our legal obligation to demonstrate it (Art. 7(1) in conjunction with Art. 6(1)(c) GDPR). We keep this data until three years after your last session, because claims under the contract can be brought for that long (sections 1486 and 1489 of the Austrian Civil Code), and in the event of a dispute until it has ended.

b) Information about your well-being. What you tell us voluntarily about your well-being – for example a pregnancy, a recent operation or injury in the neck area, or ongoing medical treatment – helps us to attune the energetic session to you with care. This is health data (Art. 9 GDPR). We record it only with your explicit, written consent, which you give on paper at the practice before the initial conversation (Art. 9(2)(a) GDPR). The records are kept locked away at the practice, are not recorded electronically and are not passed on to anyone – unless you ask us to or the law obliges us. Only the head of the practice, who carries out your sessions, has access.

Consent is voluntary. A session is possible without it, and refusing or withdrawing consent puts you at no disadvantage. Independently of this, a session may be declined where medical help is needed first (terms, point 7). We destroy the records no later than three years after your last session, and immediately if you withdraw your consent – longer only where they are needed in an individual case to defend against legal claims (Art. 17(3)(e) GDPR). There is no longer statutory retention obligation for energetic services.

Minors: for children under 14, a parent or legal guardian gives consent. From the age of 14, young people give consent themselves.

Records from the former sole practice: the head of the practice previously ran a practice of her own. If you were a client there, we take over your earlier records only with your agreement (in the form). Without your agreement they remain stored separately and are destroyed once the period has expired.

The sessions are energetic services, not medical treatment; no diagnosis is made and no medical record is kept.

11. Invoices, accounting and vouchers

For invoices we process name, address, service, date and amount. We are legally obliged to do so (Art. 6(1)(c) GDPR, section 132 of the Austrian Federal Fiscal Code); the records are kept for seven years. Invoices contain no information about your well-being. We manage vouchers by their code; we note details of the buyer only where necessary, for example for a replacement if a voucher is lost. Recipients of this data may be our tax advisers and the tax authorities.

11a. Buying vouchers online

On the page Gutscheine (in German) you can buy gift vouchers online (terms, point 6b). For this we process the following data:

Order data: your email address (required), optionally your name, the amount chosen, the design chosen, the entries “for”, “from” and the personal line, the order number, the voucher code and the times of order, payment and delivery. The entries “for”, “from” and the personal line are printed on the voucher; please do not write anything there about a person’s well-being.
Payment data: payment takes place on the payment page of our payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. Mollie receives from us the amount, the order number and the return address; you enter your payment details (such as card number or bank account) directly with Mollie, and we do not receive them. From Mollie we receive only the payment status, the amount and a payment identifier. Mollie is independently responsible for processing your payment data and may pass it on to the banks and card schemes involved; details are set out in Mollie’s privacy statement.
Postal delivery: if you also want a printed card, we process the address you provide (name, street, postcode, town; Austria only) solely for shipping. Delivery is carried out by the postal service.
Download link: the confirmation email contains a link with a random key through which you can download the PDF again. The link remains valid for as long as the voucher is valid; anyone who knows it can download the PDF – so please forward the email only to the person who is to receive the voucher.

Purposes and legal bases: concluding and performing the purchase contract, issuing and delivering the voucher, handling withdrawal and refunds (Art. 6(1)(b) GDPR); keeping records under tax and company law (Art. 6(1)(c) GDPR, section 132 of the Austrian Federal Fiscal Code); preventing misuse and evidencing the contract (Art. 6(1)(f) GDPR). The order is protected against misuse in the same way as our forms (section 7); no session cookie is set for it. We do not measure whether you open the email or click the link.

Storage period: we keep the order data, amount, payment status and payment identifier as part of our accounting records for seven years from the end of the calendar year (section 132 of the Austrian Federal Fiscal Code). We delete the address for postal delivery one year after shipping. Orders for which no payment is received are deleted with all their details after 30 days.

Recipients: Mollie B.V. (payment, see above), the postal service (printed card), our tax advisers and the tax authorities (records). Otherwise we do not pass the data on; Mollie receives neither your email address nor the entries on the card.

12. Who else sees your data

Your data stays with us. Within ATHENORIS OG the two partners have access as far as running the business requires; the paper records about your well-being are seen only by the head of the practice. Working for us are Hetzner Online GmbH (server, see section 3) and our IT service provider, who looks after the server, website and email accounts. Both act only on our instructions and are contractually bound to confidentiality (Art. 28 GDPR); we will tell you the name of the IT service provider on request. Everyone involved is bound to confidentiality. When you buy vouchers online, Mollie B.V. (Amsterdam) handles the payment as an independent controller (section 11a). Data is not transferred to countries outside the EU.

Körperwerk uses our practice room one day a week as an independent practice and is itself responsible for the data of its clients. We do not pass any data to Körperwerk, and our records are not accessible to Körperwerk.

13. Links to other services

No content from other providers is embedded on this website – no maps, videos or social media elements. We only link to Google Maps and OpenStreetMap (directions) to our Instagram profile and, on the “Partners & friends” page, to the websites of our partners and friends. Only when you click such a link do you go to the provider concerned; from then on its privacy policy applies, and Google or Meta may also transfer data to the USA. For the statistics of our Instagram profile we are jointly responsible with Meta (Art. 26 GDPR); you can also exercise your rights in this respect directly against Meta.

14. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15–18 and 20 GDPR). You can withdraw consent at any time without giving reasons; what happened before remains lawful. An informal message to office@atlaspraxis.at or by post is enough. We reply within one month at the latest and may ask for proof of identity for your protection. We do not use automated decision-making or profiling.

Your right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can object to the visitor statistics without giving reasons (section 4a).

15. Complaints

If you think we are not processing your data lawfully, you can lodge a complaint with the supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna, Austria
Email: dsb@dsb.gv.at
Web: www.dsb.gv.at

16. Security

We protect your data with appropriate technical and organisational measures (Art. 32 GDPR), including encrypted connections (HTTPS), ongoing updates, personal accounts, access only for those who need it and locked paper records. Should a data breach with a high risk to you nevertheless occur, we will inform you and the data protection authority (Art. 33, 34 GDPR).

17. Changes

If anything changes on our website or in the law, we will update this policy. The version published here applies.