Privacy policy

Last updated: October 2026

This is a translation. The German version is authoritative.

In short

This policy covers the website club.lytchie.com, where we present Lytchie Club Card, the digital loyalty card for nail and beauty salons.

The website sets no cookies.
There is no sign-in and no contact form.
The website loads no third-party fonts, no YouTube videos, no social media plugins and no advertising.
It is hosted by Cloudflare. Cloudflare counts visits for statistics — without cookies and only in aggregate.
The app at clubcard.lytchie.com has its own privacy policy.

Controller and contact

The controller for this website under the General Data Protection Regulation (GDPR) is:

Provider: Nguyen Thi Thai Chinh
Address: To 4B Tran Nguyen Han, TP Bac Giang 26110, Vietnam
E-mail: [email protected]

Please send data protection enquiries to [email protected]. We answer in German, English or Vietnamese.

A data protection officer within the meaning of Art. 37 GDPR does not have to be appointed and none is appointed.

Representative in the European Union (Article 27 GDPR)

The provider is established outside the European Union. The representative designated in the Union under Article 27 GDPR is:

theQ GmbH, Kurt-Schumacher-Str. 22, 30159 Hannover, Germany · Managing director: Van Cuong Vu · Email: [email protected]

Data subjects and supervisory authorities may address the representative on all questions concerning the processing of personal data, instead of or in addition to the provider. Addressing the representative does not limit anything that may be raised against the provider itself (Article 27(5) GDPR).

Hosting and access data

The website is a static site. It is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

When you open a page, Cloudflare processes the access data this technically requires:

your IP address
the date and time of the request
the address requested
information about your browser, such as browser type and operating system
where applicable, the page you came from

Cloudflare needs this data to deliver the page to you and to protect the website against attacks. Without it, the page cannot be displayed. We do not keep any server logs ourselves.

The legal basis is our legitimate interest in delivering the website securely and reliably (Art. 6(1)(f) GDPR).

Visitor statistics with Cloudflare Web Analytics

To see how the website is used, we use Cloudflare Web Analytics. For this, Cloudflare adds a small script to the pages. Your browser loads it from Cloudflare (static.cloudflareinsights.com) and uses it to send measurements to Cloudflare, mainly about loading times.

From these, Cloudflare compiles statistics in aggregate form only: how often each page is viewed, which websites visitors come from, from which countries, with which device types, browsers and operating systems, and how fast the pages load. We see only these totals, nothing about individual people.

According to Cloudflare, the statistics use no cookies and no local storage in your browser (localStorage). They do not recognise anyone by IP address, the browser’s user agent or any other data (no fingerprinting), and they do not track anyone across different websites. For technical reasons your IP address still reaches Cloudflare, as with any request on the internet.

The legal basis is our legitimate interest in improving the website on the basis of aggregated figures (Art. 6(1)(f) GDPR). If you do not want to be counted, you can block the script with an ad or content blocker in your browser; the website works without it.

No cookies, no third-party content

This website sets no cookies and stores nothing in your browser’s local storage (localStorage).

It loads no content from other providers: no fonts from Google Fonts or other services, no YouTube videos, no social media plugins and no advertising. Images and videos are hosted on the website itself. The one exception is Cloudflare’s statistics script (see above).

Contact by e-mail

There is no contact form and no sign-in. You can reach us by e-mail at [email protected].

Our mailbox is hosted by Zoho Mail, a service of Zoho Corporation Pvt. Ltd., Estancia IT Park, Plot no. 140, 151, GST Road, Vallancheri, Chengalpattu District 603202, India, in Zoho’s Indian data centre.

If you write to us, we process your e-mail address, your name if it appears in the e-mail, and the content of your message in order to reply.

The legal basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Where your enquiry concerns a contract with us, such as a subscription, the processing is also based on taking steps before entering into that contract (Art. 6(1)(b) GDPR).

We delete your message as soon as it is no longer needed for the reply. Statutory retention obligations remain unaffected.

Recipients and transfers to third countries

Cloudflare processes the access data and the statistics data on our behalf (Art. 28 GDPR). The data processing agreement is part of Cloudflare’s terms of service. Where Cloudflare processes data as a controller in its own right, Cloudflare’s privacy policy applies.

Cloudflare, Inc. is based in the USA and, according to its own information, stores data mainly in the United States and the European Economic Area. Cloudflare is certified under the EU-US Data Privacy Framework. Transfers to the USA are therefore based on the European Commission’s adequacy decision for that framework (Art. 45 GDPR). Should the certification lapse, Cloudflare states that it bases transfers on the European Commission’s standard contractual clauses.

Zoho processes e-mails sent to us on our behalf (Art. 28 GDPR). India is a third country for which no adequacy decision of the European Commission exists. The transfer is based on the European Commission’s standard contractual clauses, which form part of the data processing agreement with Zoho (Art. 46(2)(c) GDPR).

The provider itself is based in Vietnam. Vietnam is a third country for which no adequacy decision of the European Commission exists. If you write to us, your message reaches the provider there. The GDPR applies to the provider directly because it offers its service to salons in the European Union (Article 3(2) GDPR). Vietnamese law also applies to the provider, in particular the Law on Personal Data Protection (Law No. 91/2025/QH15) — in addition to the GDPR, not instead of it.

Storage periods

Access data: we store none ourselves. According to its own information, Cloudflare keeps data for as long as the respective purposes or legal obligations require.
Visitor statistics: according to Cloudflare, the individual measurements are kept in full for 7 days and then condensed to around 10%. We see only aggregated figures.
E-mails: until they are no longer needed for the reply. Statutory retention obligations remain unaffected.

Your rights

You have the following rights:

Access to your data (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing based on legitimate interests (Art. 21 GDPR)

To exercise them, write to [email protected] or to our representative in the Union.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work or where the alleged infringement took place. If you live in Germany, that is the data protection authority of your federal state.

There is no automated decision-making, including profiling (Art. 22 GDPR).

App and legal notice

Some links on this website lead to the app at clubcard.lytchie.com. The app, the salon accounts and the club cards are covered by the app’s own privacy policy.

You will find all provider details in the legal notice.

Changes to this policy

If the website or the legal situation changes, we will update this policy. The version published here applies.