Last updated: 21 October 2026
Xarfi is a product and brand owned and operated by Digital Solution Lab – DSL UG (haftungsbeschränkt). DSL develops, maintains and operates the Xarfi technology and provides the platform services described in this notice.
The controller responsible for the platform processing described below is:
Digital Solution Lab – DSL UG (haftungsbeschränkt)
Rhinstraße 17a
12307 Berlin, Germany
Managing director: Adil Sunil
Register court: Amtsgericht Charlottenburg
Commercial register: HRB 273096 B
Email for Xarfi and privacy enquiries: [email protected]
Alternative company email: [email protected]
Telephone: +49 151 51543183
In this notice, “Xarfi”, “DSL”, “we”, “us” and “our” refer to this legal entity. Xarfi is not a separate legal entity or a separate development customer of DSL.
This notice explains the processing of personal data in connection with xarfi.de, xarfi.com and the Xarfi web application. It covers visitors, registered clients, people named in guest bookings, salon owners and business representatives, masters and other authorised team members, and people contacting support.
Xarfi enables people to discover beauty businesses and professionals, view services and professional profiles, make and manage appointments, submit reviews and, where offered, purchase products. It also provides salon subscriptions, calendars, team administration and payment integrations.
The service supports German, English, French, Turkish, Polish, Ukrainian, Vietnamese and Arabic. Translations are intended to convey the same privacy information. Your statutory rights are not restricted by the language you use.
The client, salon and master sections below explain processing specific to those roles. They supplement this notice and do not change the actual legal responsibilities of any party.
DSL determines the purposes and essential means of processing needed to operate Xarfi as a platform. This includes platform account administration, discovery, facilitating platform bookings and orders, subscriptions, platform billing, public listings and reviews, platform support, fraud prevention and security.
DSL's own development and maintenance work is part of its operations. DSL is not a separate processor acting on behalf of another Xarfi company merely because it also develops the software. Authorised personnel may access personal data where their duties require it, subject to appropriate confidentiality and access restrictions.
A salon or independent professional is generally a separate controller for its own service delivery, customer relationship, legal obligations and business records. Its privacy information explains that processing. Details of the relevant business are available on its listing or can be requested from it.
An employee or team member acting under a salon's authority does not automatically become an independent controller because they receive an appointment assignment. A self-employed professional's role depends on their actual business arrangement and processing activities.
Where a separately agreed salon management function involves DSL processing data exclusively on the salon's documented instructions, DSL acts as that salon's processor for that defined activity. The scope, instructions, security obligations, subprocessors and return or deletion of that data must be governed by an Article 28 GDPR data processing agreement.
This does not convert DSL's own platform-controller activities into processing on behalf of a salon. This notice is not a data processing agreement. Legal roles follow the actual activity and cannot be determined solely by a label in this notice.
We receive data directly from you when you browse, register, book, order, subscribe, review, manage a business profile or contact us. We also receive technical data from your browser or device.
Other sources include:
Where information is obtained indirectly, we provide the information required by Article 14 GDPR within the applicable time limits, unless a lawful exception applies. This includes information about the data source. A booking customer's assurance that a guest is informed does not, by itself, replace applicable information duties.
IP address, request time, requested pages or resources, browser and operating-system information, language settings, referrer information where transmitted, search terms, selected areas and technical error or security records.
If you permit location access, we process the coordinates provided by your browser to find nearby businesses. A manually entered address or place search may also be processed by the configured mapping service.
Name, email address, telephone number, account identifiers, role, preferred language, profile photograph and optional gender information, where those fields are offered. For password accounts, passwords are stored as hashes rather than readable passwords.
For Google sign-in, we process the Google identifier, authentication information and basic profile details returned for the permissions requested. We do not receive your Google password.
Business and representative names, business contact details, address, map coordinates, opening hours, breaks, leave or availability, services, prices, duration, target groups, styles, photographs, professional descriptions, team members and product listings.
Public professional information is distinguished from private account and administration information. Working calendars and leave records are not automatically public merely because a professional profile is public.
Selected business, service, professional, date and time, booking identifiers, status, cancellation information, whether the booking is for the account holder or a guest, guest name, and selected payment method. For product orders, we also process products, quantities, fulfilment details and order status. Delivery details are processed only where delivery is offered.
Billing and transaction details, amounts, currency, payment status, payment and customer references, refunds or disputes, subscription plan, billing interval, renewal information and enabled features.
For salon payouts, relevant information may include account-holder name, bank name, IBAN, BIC and Stripe connected-account identifiers or onboarding status, depending on the integration. Stripe may request business, representative or identity-verification information directly. Its requirements and privacy notice apply to that collection. DSL receives only the information made available through the configured integration.
Complete payment card numbers and security codes are handled by Stripe and are not stored by Xarfi as complete card credentials.
Ratings, review text, reviewer display information, relevant booking references, reports, moderation records and restrictions on bookings imposed by a business or the platform. We process restriction reasons only where necessary and lawful.
Support correspondence, contact information, message content, notification preferences, delivery or error status where recorded, and a Firebase Cloud Messaging registration token if browser push notifications are enabled.
Xarfi is not intended as a medical-record system. Do not include diagnoses, medical histories, allergies, religious information or other sensitive information in public profiles, reviews or ordinary free-text fields.
A service selection or message may nevertheless reveal health information in some circumstances. A general contractual basis under Article 6 GDPR does not by itself authorise processing of special-category data. Any feature intentionally collecting such information requires a separate assessment, an applicable Article 9 condition and appropriate safeguards before activation. A salon may have its own lawful duties concerning information needed for a treatment; that does not automatically authorise DSL to reuse it.
Profile photographs are used for display, not for biometric identification. An ordinary photograph is not automatically biometric data under Article 9 GDPR.
We use only the legal basis applicable to the specific activity. Contract necessity applies to steps you request before entering a contract and processing objectively necessary to perform our contract with you. For a salon employee who is not personally our contracting party, necessary administration normally relies on legitimate interests rather than the salon's contract as if it were the employee's own contract.
| Activity | Purpose and legal basis |
|---|---|
| Delivering requested web pages and maintaining basic functionality | Article 6(1)(f) GDPR: our interest in providing a functioning, reliable service; Article 6(1)(b) where necessary to deliver a contracted account service. |
| Account registration, verification and authentication | Article 6(1)(b) for the account relationship. Unnecessary optional fields are not treated as contractually required. |
| Platform bookings, changes, cancellations and product orders | Article 6(1)(b) for requested platform services; only the information necessary for those services is shared. |
| Guest-booking information | Article 6(1)(f): facilitating the appointment requested for the guest, limited to necessary information and subject to the guest's interests and rights. |
| Salon subscriptions and billing | Article 6(1)(b) for the subscription; Article 6(1)(c) for applicable accounting and tax duties. |
| Business contact and employee account administration | Article 6(1)(f): managing the business relationship, professional listings and authorised access. Any additional employment-related basis is assessed by the relevant employer. |
| Payment processing and payout setup | Article 6(1)(b) for payment-related contract performance; Article 6(1)(c) for legal duties applying to DSL; Article 6(1)(f) for proportionate payment-fraud prevention and dispute handling. Stripe has its own bases for its controller activities. |
| User-requested precise location | Article 6(1)(a), consent. Refusal leaves manual area search available. |
| Optional browser push service | Article 6(1)(a) for activating and using that optional channel. The appointment record and necessary service communications have their separate contractual basis. |
| Public reviews and moderation | Article 6(1)(f): providing useful service feedback, maintaining trust and preventing abusive or misleading content. Only the intended public review information is displayed. |
| Abuse reports, booking restrictions and security | Article 6(1)(f): protecting users, businesses and the platform and investigating misuse, subject to necessity and proportionality. |
| Support | Article 6(1)(b) for contract-related requests; Article 6(1)(f) for other enquiries and effective assistance. |
| Marketing | Article 6(1)(a) where consent is required; Article 6(1)(f) only for a lawful existing-customer email exception meeting section 9. |
| Legal requests and claims | Article 6(1)(c) for applicable legal obligations; Article 6(1)(f) for establishing, exercising or defending legal claims. |
Legitimate-interest processing is subject to balancing against your interests, rights and freedoms. You can object as described in section 15. This notice does not itself request or record consent.
Fields marked as required are needed for the relevant account, booking, order, payment or business function. If they are not provided, that function may be unavailable. Contractually required data is distinguished from information required by law, such as specified invoice details.
Optional profile information, Google sign-in, precise location and browser push permission are not conditions for using unrelated core features. You may use email-and-password registration and manual location searches where offered.
Providing optional information does not give us an unrestricted right to use it. Information shown beside a field explains its intended use. We do not require blanket consent to all processing as a condition for registration.
Salon listings and professional profiles are intended to be publicly accessible. They may be indexed by search engines, copied by visitors and temporarily remain in third-party caches after changes.
Private account credentials, bank details, identity-verification documents and private customer contact information are not intended for public display.
The relevant salon and authorised staff receive the customer and appointment details needed for the service or order. Staff access must be restricted according to their duties. A team member is not entitled to unrestricted customer access simply because they have a master account.
We send service communications needed for account verification, bookings, changes, cancellations, orders, subscriptions, security and legal notices. These communications are distinguished from advertising.
Marketing by email or another electronic channel is sent with the consent required for that channel, unless a specific legal exception applies. Browser notification permission does not automatically constitute consent to promotional messages.
For existing-customer email marketing under section 7(3) UWG, all conditions must be met: we obtained the email address in connection with a sale; the advertising concerns our own similar goods or services; the customer has not objected; and we provided clear information about the right to object when collecting the address and in every marketing message. No charge beyond basic transmission costs applies.
You can unsubscribe using the link in a marketing email or contact us. Objection to direct marketing stops that processing, including associated profiling. A minimal suppression record may remain to prevent further unwanted messages. Essential service communications may continue while needed.
We disclose personal data only where needed for the stated purposes and on an appropriate legal basis.
Recipients may include:
We do not sell personal data. A provider's role depends on its service: some act as processors, while others also process data as independent controllers for their own legal or service purposes. Processors are engaged under Article 28 GDPR where required. Where DSL acts as a salon's processor, its subprocessors are governed by the applicable salon data processing agreement.
| Provider or service | Purpose and information to confirm |
|---|---|
| Stripe Payments Europe Limited and relevant Stripe affiliates | Payments, subscription billing and Connect. Stripe identifies this entity for relevant European processing and may act as controller or processor depending on the activity. Privacy information: https://stripe.com/privacy and https://stripe.com/legal/privacy-center |
| Google Maps and Places | Maps, place searches and coordinates; related request and device data. Privacy information: https://policies.google.com/privacy |
| Google sign-in | Optional authentication and permitted basic profile information. Privacy information: https://policies.google.com/privacy |
| Firebase Cloud Messaging | Optional browser push delivery, registration tokens and related technical processing. Service information: https://firebase.google.com/support/privacy |
| List only services actually deployed and describe their relevant processing. |
Provider privacy notices explain their own processing; they do not replace our obligation to explain disclosures through Xarfi.
Some providers or their authorised support personnel may process personal data outside the European Economic Area. Selecting an EU server region does not by itself exclude international access or transfers.
Where required, we use a valid Chapter V GDPR transfer mechanism. This may be an applicable European Commission adequacy decision, including the EU–US Data Privacy Framework only where the particular US recipient has an active certification covering the transfer, or the European Commission's Standard Contractual Clauses together with the required assessment and supplementary safeguards.
You can contact [email protected] for information about the applicable safeguards and a copy where available, with necessary protection for confidential information and third-party rights.
Xarfi uses cookies and, where implemented, local storage or similar browser technologies for authentication, account roles, setup progress, preferences and optional features.
Under section 25 TDDDG, storing information on or accessing information from your device generally requires consent unless an exception applies. The strictly necessary exception applies only where the operation is necessary to provide a digital service you expressly request. Any associated personal-data processing also requires an appropriate GDPR basis.
Necessary authentication and requested setup operations may qualify for that exception. Other features must be assessed individually. A cookie does not become necessary simply because it is described as functional.
Where consent is required, the relevant technology is activated only after consent. Consent choices must be available before optional activation and withdrawal must be as easy as granting consent. Blocking cookies in your browser may prevent sign-in or other requested features from working.
Google Maps, Places, sign-in and Firebase integrations must be assessed for both device access and personal-data disclosure. Any consent required for a particular integration must cover that integration; browser location permission alone does not authorise all Google processing.
We retain personal data only as long as necessary for its purpose, applicable legal duties or the establishment, exercise or defence of claims. Where only particular records must be retained, we do not retain the entire account unnecessarily.
| Category | Retention rule |
|---|---|
| Account information | While needed to provide the account. After closure, delete or anonymise information no longer needed; isolate records subject to a separate lawful retention requirement. |
| Bookings, orders and related support | For fulfilment and a justified claims period. Where the ordinary German three-year limitation period applies, it generally begins at the end of the year in which the claim arose and the relevant knowledge requirements are met. Pending disputes, different statutory periods and legal holds may change this. Retain only necessary evidence. |
| Invoices and accounting vouchers | Generally eight years where the applicable German accounting and tax rules require it. |
| Books and annual financial statements | Generally ten years where applicable. |
| Commercial correspondence | Generally six years where applicable. Statutory periods usually start at the end of the relevant calendar year; particular legal rules may differ or extend retention. |
| Public profiles and reviews | While needed for the relevant listing or feedback purpose, subject to correction, deletion, objection and lawful moderation or evidence needs. |
| Booking restrictions | Only while necessary and proportionate for the documented restriction purpose, with periodic review. |
| Server and security logs | A limited period appropriate to security and fault diagnosis. Incident-related records may be retained separately while needed to investigate or defend claims. |
| Push tokens | While valid and needed for an enabled push service; remove or deactivate tokens when no longer required. |
| Precise location | Only for the location-related function unless a specific, disclosed further purpose requires retention. |
| Consent and objection records | As needed to demonstrate compliance and respect your choices, limited to necessary evidence. |
| Backups | Restricted recovery copies expire under the backup rotation schedule. |
Where DSL holds data solely as a salon's processor, the salon's documented instructions and the applicable agreement govern return or deletion, subject to legal obligations applying to DSL.
We use technical and organisational measures appropriate to the nature of the processing and the risks to individuals. Relevant measures include access management, confidentiality, secure authentication, protection of data in transit, maintenance and incident handling, to the extent implemented and verified for the live service.
No online service can guarantee absolute security. If a personal-data breach occurs, we assess and meet applicable notification duties, including informing affected individuals where legally required.
Subject to the conditions and exceptions in the GDPR, you have the right to:
Contact [email protected] or write to DSL at the address in section 1. We may request proportionate information to verify identity where there are reasonable doubts. We do not routinely require an identity-document copy for every request.
We respond without undue delay and normally within one month of receiving a request. Where permitted because of complexity or the number of requests, we may extend by up to two further months and explain the extension within the initial month. Requests are generally free; statutory exceptions apply to manifestly unfounded or excessive requests.
For processing controlled by a salon, contact that salon. If you contact us, we explain the relevant responsibilities and assist as required. Where we act solely as a processor, we support the responsible salon in handling rights requests.
You may complain to the authority in the EU Member State of your habitual residence, place of work or the alleged infringement. The Berlin authority is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin, Germany
Email: [email protected]
Website: https://www.datenschutz-berlin.de
If no such decisions are used, publish: “We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within Article 22 GDPR.”
If such processing is used, replace that sentence with a specific explanation of the processing, applicable legal conditions, meaningful information about its logic, its significance and likely consequences, and the applicable safeguards and challenge rights. Ordinary ranking by location or availability should also be described accurately where it involves profiling, even if Article 22 does not apply.
Xarfi accounts are intended for people aged 18 or over. An adult may book an appointment for a younger guest where authorised to do so and subject to the relevant provider's service requirements.
Only the minimum guest information needed for the booking should be provided. An adult's booking does not authorise unrelated use of a child's information. If an underage account or unnecessary child information is identified, we assess the appropriate restriction, correction or deletion.
We update this notice when the service, processing arrangements or legal requirements change. The current version and its date are published on the platform. We provide additional notice of material changes where appropriate or legally required.
An updated notice does not itself create a new legal basis. If new processing requires consent, we obtain that consent before starting the processing. Continued use of the platform is not treated as consent to every change.
DSL processes your account information to provide access to Xarfi and your booking or order information to provide the requested platform service. We send necessary confirmations, changes and relevant service notices. Optional promotional messages are governed separately by section 9.
The relevant salon or seller receives information needed for the appointment or order. Assigned personnel receive access appropriate to their duties. Your bank or card details are not part of an ordinary professional's customer appointment view.
Precise location, browser push and Google sign-in are optional. You can search by area and use email-and-password registration where available. Withdrawing permission for one optional feature does not automatically delete your account or cancel an existing booking.
If booking for someone else, provide accurate information you are entitled to share and make this notice available to them. Do not add their sensitive information to ordinary notes. Where feasible, guests receive the privacy information directly through the booking process; otherwise an appropriate information arrangement must be implemented.
The guest may contact DSL concerning their own data without needing access to the booking person's account. Identity verification will protect both people's information.
Reviews are intended for the public audience identified in section 8. Avoid including contact details, medical information or other people's private information. We may investigate reported content and process necessary moderation records.
A salon restriction is not automatically a platform-wide ban. You may contact us to correct inaccurate restriction information and exercise applicable objection rights.
You may request account deletion at [email protected] and through any available account-deletion function. Closing the account does not itself determine whether an existing appointment is cancelled, whether payment is due or whether a refund applies; those matters are governed by the relevant contracts and applicable law.
We remove information that is no longer needed and retain only records justified by a separate legal purpose. A salon may independently retain information it lawfully needs; its own notice explains that retention.
DSL processes business profile information, business contact details and representative information to establish the salon account, review applications, publish the intended listing, administer access and provide the subscribed functions. Approval records may include application details and necessary verification correspondence.
Subscription records include the selected plan, price, currency, interval, renewal information and enabled shop features. Bank and payment-onboarding details are used for the relevant payment and billing functions and are not public listing information.
The salon acts as controller for its own customer-service and treatment activities. It must identify its own purposes and legal bases, provide appropriate privacy information, limit access, handle rights requests, apply appropriate retention and security measures, and comply with any special-category-data requirements.
Receiving booking information does not provide unrestricted permission for unrelated marketing. The salon must establish its own lawful basis and comply with the rules applicable to the marketing channel. Platform data must not be disclosed or exported for an unrelated private purpose without a lawful basis and any required contractual authorisation.
These statements describe privacy responsibilities; detailed commercial restrictions belong in the salon terms or applicable agreements.
The salon may provide professional profile and availability information for its team. The salon must have a lawful basis for sharing and publishing that information and inform team members appropriately. It should ensure that photographs and portfolio materials can lawfully be used.
Access permissions should correspond to actual duties and be reviewed when responsibilities change. Access must be removed when no longer authorised. Shared credentials and unrestricted exports increase privacy risks and should be prevented through appropriate controls.
If DSL supplies a function solely on the salon's documented instructions, the relevant Article 28 agreement governs that processing. It must address the scope, authorised instructions, confidentiality, security, subprocessors, assistance with rights and incidents, and return or deletion.
For DSL's separate platform-controller activities, this notice applies. If an activity involves genuine joint determination of purposes and means, the parties must assess whether an Article 26 arrangement is required and provide the necessary information. This notice does not assume joint controllership merely because both parties use appointment data.
Ending the subscription may affect listing visibility and access according to the applicable contract. It does not authorise indefinite retention of all customer or team information. Controller records follow their lawful retention purpose; processor-held data follows the applicable agreement and legal requirements.
Your salon may create or manage your professional profile and access. Relevant information includes name, photograph, professional description, contact information, services, target groups, working times, breaks, availability and assigned appointments. We obtain this from you, the salon and activity within the platform.
The intended public profile fields are specified in section 8. Private contact information, internal schedules and leave reasons must not be assumed to be public. Only availability information necessary for booking should be disclosed to clients.
Employees generally act under the salon's authority. Independent professionals may have their own controller responsibilities depending on their actual business arrangement. A “master” account label does not settle that question.
Customer information is made available according to authorised duties. It is not a personal customer list that may automatically be retained for private use. Any independent use or disclosure requires its own lawful basis and must respect applicable confidentiality and contractual duties.
You can request correction of your information from the salon or DSL, as appropriate to the processing. Other GDPR rights remain available after your account becomes inactive; they are not limited to the period of employment.
When you leave, the salon should remove access and update its current listing. A limited historical reference to the professional who performed an appointment may remain where necessary for a lawful record or claim. A public active profile should not remain merely because a historical booking exists.
Optional browser push, session technologies and service communications follow the main notice. Personal-device permission does not authorise unrestricted sharing of customer information through notifications. Notification content and lock-screen visibility should be limited appropriately.
Xarfi is owned, developed, maintained and operated by Digital Solution Lab – DSL UG (haftungsbeschränkt). DSL is the company behind the Xarfi product, brand and platform technology.
Any software, trademark, licensing and intellectual-property rights are subject to applicable law, the relevant agreements, third-party rights and open-source licences. This privacy notice does not transfer intellectual-property rights or establish a software licence.
Product ownership does not mean ownership of individuals' personal data and does not restrict their GDPR rights. Rights in user or salon content are governed separately by the applicable terms and law.