Privacy policy

Summary

• This website does not set any cookies.
• We do not use analytics or tracking tools and no advertising networks.
• We do not embed content from third-party servers. Fonts are hosted on our own server; there is no connection to Google Fonts.
• There is no contact form. We only receive personal data if you write to us or call us yourself.

1. Controller

Murcia Holding GmbH
Im Aischbach 14
71665 Vaihingen an der Enz
Germany

Represented by the managing director Antonio Murcia
Email: info@murcia-holding.de
Phone: +49 176 84906674

2. Visiting the website

So that your browser can display this website, our web server must technically process your IP address and information such as the page requested, date and time. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in delivering the website securely and without errors.

We do not keep access logs of visits to this website. Only technical error messages of the server may contain an IP address. They are used solely for troubleshooting and security and are deleted after 14 days at the latest.

3. Hosting

This website runs on a server that we rent from IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The provider processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. The server is located in a data centre in the European Union (Spain).

4. Contact by email or phone

If you contact us, we process your details (for example name, email address, phone number and the content of your message) in order to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to a contract or pre-contractual steps, otherwise Art. 6 (1) (f) GDPR. Our legitimate interest lies in answering your enquiry.

Our mailbox is operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, as a processor. We delete your enquiry once it has been dealt with, unless statutory retention obligations (for example under commercial or tax law) apply.

5. Links to other services

This website links to services of our brands, such as realtalklive.de. You only leave this website when you click a link. The linked services are subject to their own privacy notices.

6. Our apps (GlattPro)

This section applies to the applications of our GlattPro brand: the studio software (app.glattpro.de), online booking (buchen.glattpro.de), the client portal and client app, and our apps in Apple’s App Store and on Google Play.

WHO IS RESPONSIBLE?

We, Murcia Holding GmbH, are responsible for the accounts of studios and their staff.

The respective studio is responsible for the data of its clients (for example appointments, client records, health questionnaire and purchases). We process this data as a processor pursuant to Art. 28 GDPR on behalf of and on the instructions of the studio. Please address questions and requests about this data to your studio. If they reach us, we will forward them to the studio.

WHAT DATA WE PROCESS

• Account and sign-in: name, email address, phone number and sign-in data. We only store passwords in encrypted form (as a hash). If you wish, you can use a passkey or a one-time code for two-factor sign-in.
• Appointments and services: bookings, treatments, packages, vouchers and receipts.
• Digital health questionnaire: information about your health that is needed for a safe treatment, such as skin type, illnesses or medication. These are special categories of personal data under Art. 9 GDPR.
• Messages: messages and files you exchange with your studio.
• Photos: before/after pictures and photos of skin reactions that you or your studio upload in the app. The app only accesses the camera and photos with your permission.
• Signatures: your digital signature on health questionnaires, consent forms and quotes.
• Push notifications: if you allow notifications, we store a technical address of your device. Delivery is encrypted via the push service of your device or browser manufacturer, such as Apple, Google or Mozilla. You can switch off notifications at any time in the settings.

LEGAL BASIS

We process this data to perform the contract with you or with your studio (Art. 6 (1) (b) GDPR). We only process health data from the questionnaire with your explicit consent (Art. 9 (2) (a) GDPR), which you give in the questionnaire. We only send push notifications with your consent (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time with effect for the future. We retain records where required by law (Art. 6 (1) (c) GDPR).

COOKIES AND TRACKING IN THE APPS

For sign-in, the apps set a technically necessary session cookie that expires after 12 hours at the latest. We do not use advertising or analytics cookies and no tracking in the apps.

STORAGE LOCATION AND SECURITY

All data is stored on our own server at IONOS SE in a data centre in the European Union. Transmission is always encrypted (HTTPS). We store backups in encrypted form, additionally at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in the European Union. Both providers act as processors for us pursuant to Art. 28 GDPR.

OTHER RECIPIENTS

• Sending emails: we send booking confirmations, questionnaire links, reminders and invitations to the client app via the email server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, as a processor.
• Payments: if your studio offers online payment and you pay there, the necessary data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. The payment goes to the studio’s PayPal account. PayPal processes the data under its own responsibility.
• Medical approval: if the questionnaire shows that a doctor must approve a treatment beforehand, the doctor appointed by the studio receives access to the necessary information via a protected link and approves or rejects the treatment digitally. The doctor is bound by medical confidentiality.
• App stores: when you download an app, Apple or Google process data under their own responsibility.

RETENTION AND DELETION

We store data for as long as your account or the contract with your studio exists. We then delete it unless statutory retention periods (for example under commercial and tax law) apply.

You can delete your client account yourself at any time directly in the app: Menu (≡) → My account (Mein Konto) → “Delete account” (Konto löschen). Your account, your sign-ins and push notifications are then removed immediately. Data that your studio is legally required to keep is blocked until the end of the retention period and deleted afterwards. This mainly concerns consultation records and consent forms for treatments with laser or IPL devices, which must be kept for ten years under Section 3 (2) of the German Ordinance on Protection against the Harmful Effects of Non-Ionising Radiation (NiSV), as well as cash and invoice records under commercial and tax law. Alternatively, you can request deletion via your studio or by email to info@murcia-holding.de. All options are described on the page Delete account and data.

7. Our apps (AMG Software)

This section applies to the applications of our AMG Software brand: the “Mein AMG” app for cleaning staff and site managers, the “AMG Service” app for customers of cleaning companies (each in Apple’s App Store, on Google Play and as a web app) and the “AMG Büro” administration.

WHO IS RESPONSIBLE?

The cleaning company that uses AMG Software is responsible for your data: for staff, their employer; for customers, the cleaning company your business works with. We, Murcia Holding GmbH, publish the apps, operate the software and process the data as a processor pursuant to Art. 28 GDPR on behalf of and on the instructions of the cleaning company. Please address questions and requests to your cleaning company. If they reach us, we will forward them.

WHAT DATA WE PROCESS

• Account and sign-in: name, mobile number or email address and your PIN. If you sign in with Face ID or fingerprint (passkey), your biometric data never leaves your device. We only receive a cryptographic key. Accounts are created by the cleaning company; there is no self-registration.
• Work (Mein AMG only): working hours and breaks, schedule, holidays, sick notes, payslips (as encrypted PDF), safety training records and the selected language.
• Location (Mein AMG only): your location is only recorded at the moment you actively tap, for example when clocking in and out, for breaks or when starting and finishing a special job. There is no background location access and no continuous tracking. For regular assignments we only store the distance to the site in metres, for special jobs the coordinates. The app only requests your location if you have allowed this on your phone. Whether permission has been granted is stored.
• Photos, videos and files: photos you upload for reports, extra work, sick notes, special jobs, complaints, in the chat or as a profile picture. Videos and files (such as PDF, Word or Excel) only in the staff chat. Photos you take with the in-app camera are not saved to your gallery. The app only accesses the camera and photos with your permission.
• Signatures: for safety training, acceptance of special jobs, handover and key protocols and declarations of consent.
• Messages: chat between staff, site managers and the office, and text messages between customers and the office.
• Customers (AMG Service): name, company, email address, site address, orders, complaints and ratings. You can view invoices, reports and protocols in the app. For orders we store name, time and IP address as proof.
• Security log: sign-ins, failed attempts and opened files with IP address, in order to detect misuse.
• Push notifications: if you allow notifications, we store a technical address of your device.

No payments take place in the apps. Invoices are paid by bank transfer.

LEGAL BASIS

For staff, the data is used to carry out the employment relationship (Art. 6 (1) (b) GDPR) and to fulfil the cleaning company’s legal obligations, for example for time recording, payroll and occupational safety training (Art. 6 (1) (c) GDPR). Sick notes are health data and are only processed as far as required by employment and social security law (Art. 9 (2) (b) GDPR in conjunction with Section 26 (3) BDSG). Recording the location when clocking in is based on the cleaning company’s legitimate interest in verifiable time recording at the place of work (Art. 6 (1) (f) GDPR). For customers, the data is used to perform the cleaning contract (Art. 6 (1) (b) GDPR). The security log is based on the legitimate interest in secure operation (Art. 6 (1) (f) GDPR). We only send push notifications with your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time in the settings.

COOKIES AND TRACKING IN THE APPS

The apps only set technically necessary session cookies for sign-in. We do not use analytics or tracking tools and no advertising.

STORAGE LOCATION AND SECURITY

The data is stored on our server at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, in a data centre in Germany. Transmission is always encrypted (HTTPS). We additionally store encrypted backups at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany. Both providers act as processors for us pursuant to Art. 28 GDPR.

OTHER RECIPIENTS

• Sending emails: we send sign-in links and notifications via the email server of IONOS SE as a processor.
• Push notifications: delivery is encrypted via the Apple Push Notification service or your browser’s push service (on Android and Chrome: Google).
• Translation: if you use the app in another language, app texts and free texts you enter are sent for machine translation to the MyMemory service of Translated S.r.l., Rome, Italy.
• Addresses: we convert the addresses of cleaning sites into coordinates using the Nominatim service of the OpenStreetMap Foundation (United Kingdom, EU adequacy decision). Only the site address is transmitted, never a person’s location.
• App stores: when you download an app, Apple or Google process data under their own responsibility.

RETENTION AND DELETION

Coordinates of special jobs are deleted automatically after six months, longer only for a specific reason. The security log is deleted after twelve months, backups after 30 days. Safety training records are stored unalterably as proof. All other data is stored for as long as your account exists or the cleaning company needs it. Statutory retention periods, for example for working time records, payroll records and invoices, remain unaffected.

You can delete your account yourself at any time directly in the app: in “Mein AMG” under More (Mehr) → Privacy (Datenschutz) → “Delete account” (Konto löschen), in “AMG Service” under Menu (Menü) → “Delete account” (Konto löschen). For security, you confirm the deletion with your PIN. Your account, your sign-in data and push notifications are then removed immediately. Data that must be kept by law, in particular working hours, payroll records, invoices and safety training records, is not deleted immediately but blocked until the end of the retention period and deleted afterwards.

Alternatively, you can request deletion by email to info@murcia-holding.de or via your cleaning company. More on the page Delete account and data.

8. Your rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of Art. 6 (1) (f) GDPR, you can object on grounds relating to your particular situation (Art. 21). An informal message to info@murcia-holding.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

9. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.