Your data. Used with care.

Responsibility and contact

According to the existing legal notice: Benjamin Mendyka, Call me Picasso, Grunewaldstraße 71, 10823 Berlin. Email: info@callmepicasso.de. Responsibilities for hosting and data processing on this new website must be confirmed before publication.

Data processed for bookings

Reservations store a name, email address, phone number, return-visit preference, party size, start and end time, and booking status in a SQLite database on the web hosting space. This information is used to manage appointments. No customer account or marketing consent is required. Gift-card orders store a name, email address, amount, payment status, order identifier, gift code and redemptions.

A signed link with an expiry date provides access to your booking. Anyone with that link can view it and make changes within the booking rules. Only share it with authorised people.

Hosting and access

This version is prepared for PHP web hosting at ALL-INKL.COM. PHP processes requests on the server. Booking and administrative data and settings are stored in a SQLite database in the protected data directory; uploaded images are also stored on the hosting space. The administration area requires an authorised login and checks user roles on the server. The hosting provider may process connection and security data needed to operate the website. The operator must add the specific hosting and data-processing arrangements.

The booking API uses hashed network identifiers with short time windows to limit abuse. No analytics or advertising pixels are included. Fonts and locally stored images are served with the website. Your language choice is stored in the picasso_locale cookie. Team sign-in uses the picasso_team_session cookie, with an eight-hour expiry.

Messages and external services

Confirmations, change notifications and reminders are prepared in a delivery queue; message contents and delivery status remain in the protected administration area for management. Once configured and enabled, emails are sent through the SMTP mailbox hosted by ALL-INKL. The service receives the sender and recipient addresses, subject and message body. Depending on the message, this may contain booking details, a secure management link or a gift code. A configured recurring request processes due messages and reminders.

Once configured, gift-card purchases can use PayPal. The application sends order identifiers, the euro amount and payment-recipient information to PayPal. Payment takes place at PayPal; the website checks payment status using the PayPal API and signature-verified payment notifications. The final privacy information must cover the actual accounts, contractual arrangements and processing by ALL-INKL and PayPal.

Telephone and email links open the selected external service when used. The embedded Google map shows the studio’s business profile. It loads automatically as the map area is reached, without a separate activation button. This connects your browser to Google; your IP address and browser or connection data may be transmitted. Google’s privacy information applies to its processing. Other social-media and messaging links open the relevant service when clicked; no social-media feed or WhatsApp script is loaded in advance.

Retention and your rights

The application offers configurable anonymisation of completed or cancelled bookings. The default is 90 days after the appointment. An administrator deliberately triggers this cleanup; recurring message delivery does not replace it. Cleanup also removes stored message contents relating to those bookings. The operator must define separate retention and deletion rules for gift-card and payment data.

Contact the operator to request access, correction or deletion. The protected administration area provides correction, export and anonymisation functions. The conditions and limits of these rights, applicable legal bases and relevant supervisory authority still require professional clarification in the final version.

To be completed before publication

The final legal basis for each data flow, hosting and data-processing agreements, processing regions and any international transfers, binding retention periods, cookies and access logs, and the specifically enabled Google Maps, PayPal and ALL-INKL services. This technical working draft does not claim fully reviewed legal compliance.