This is a courtesy translation; the German version is legally binding. German version
Protecting your personal data is important to us. This privacy policy explains which data we process when you visit this website, register, book a course or contact us, for what purposes and on what legal basis we do so, and what rights you have. It is based on the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (Datenschutzgesetz, DSG).
Scalp-Concept International - Akademie für manuelle Kopfschmerzbehandlung und Selbsthilfe
Non-profit association, ZVR number 1936979788
Stegendorf 34, 9063 Maria Saal, Austria
Phone: +43 699 12786750
Email: office@scalp-concept.com
You can reach us at these contact details with any questions about data protection and to exercise your rights. Our association is not legally required to appoint a data protection officer and has therefore not appointed one.
Whenever a page is accessed, your browser technically has to transmit data to the server delivering the website. In particular, the following are processed:
The purpose is to deliver the website and to ensure its stability and security (e.g. error analysis and defence against attacks). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and proper operation of the website. The logs are stored by our hosting provider Vercel (see section 8) and deleted automatically according to its retention periods. We only evaluate them in the event of technical faults or security incidents and do not combine them with other data.
You need a user account to book a course. For this we process:
The purpose is to set up and manage your account and to give you access to the member area with your bookings and course materials. The legal basis is Art. 6(1)(b) GDPR (contract or pre-contractual measures).
New self-registrations are reviewed and approved by the association before you can sign in. We are notified of a new registration by email to our association mailbox (name and email address). After approval, or when the association creates an account for you, you receive a notification by email. The legal basis for these steps is Art. 6(1)(b) and (f) GDPR.
We store these data until your account is deleted. You can request deletion at any time by email to office@scalp-concept.com. Data that we have to retain for legal reasons (see section 4) are blocked for any other use until the end of the retention period and deleted afterwards.
When you book a course, we process:
The purposes are the performance of the course contract (registration, organisation and running of the course, certificate of attendance), payment processing, accounting and proof of the conclusion of the contract. The legal bases are Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (statutory retention and record-keeping obligations) and Art. 6(1)(f) GDPR (our legitimate interest in proving the conclusion of the contract and in asserting and defending claims).
We retain booking and payment data for seven years from the end of the calendar year concerned in accordance with § 132 Bundesabgabenordnung (BAO, Austrian Federal Fiscal Code); beyond that only as long as they are needed for pending proceedings or to settle open claims.
You pay for courses subject to a fee via the payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands. We redirect you to Mollie's payment page and transmit to Mollie the amount, the course name and internal reference numbers (order, course and customer number). You enter your payment details (e.g. card details or bank account) directly with Mollie; we do not receive them. Mollie processes these data as an independent controller, including to comply with its obligations as a regulated payment service provider. The legal basis for the transfer is Art. 6(1)(b) GDPR. Further information can be found in Mollie's privacy statement.
After your booking we send a booking confirmation to the email address of your user account; a copy goes to our mailbox. We are legally obliged to provide this confirmation on a durable medium (§ 7(3) Fern- und Auswärtsgeschäfte-Gesetz, FAGG). The legal bases are Art. 6(1)(b) and (c) GDPR. The emails are sent via the mail server of our email provider hosttech (see section 8).
If you withdraw from a contract using the “Withdraw from contract” function, we process your name, your email address, the booking number or the selected booking, any reason you give, and the date and time of receipt. We send you an acknowledgement of receipt by email and notify our mailbox. The purposes are processing the withdrawal, the refund and proof. The legal bases are Art. 6(1)(c) GDPR (§ 13a FAGG) and Art. 6(1)(f) GDPR (proof and defence of claims). We store these details in the same way as the other booking data (see above).
If you contact us by email or phone, we process your details (e.g. name, email address, phone number and the content of your enquiry) in order to deal with your request, for example to arrange an appointment or to answer questions about our courses. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract or its preparation, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). We only store your enquiry for as long as necessary to deal with it and any follow-up questions, unless statutory retention obligations apply.
Please do not send us health data such as medical reports by unencrypted email. If you voluntarily share information about your health with us, we use it exclusively to deal with your enquiry.
On the page “Find a Scalp-Master near you” we publish contact details of Scalp-Concept® training graduates so that people seeking treatment can find therapists near them.
The following may be visible publicly: name, profession/title, practice name, address (street, postal code, city, country), phone number, email address, website and optionally the year of certification/graduation. Internal admin notes are not shown on the website.
The purpose is to help interested persons find trained Scalp-Master therapists. The legal basis is Art. 6(1)(a) GDPR (consent of the listed therapist). An entry is published only if we have the written consent of the person concerned.
Consent may be withdrawn at any time. Please write to office@scalp-concept.com. After withdrawal we remove the entry from the website without undue delay and delete or restrict the directory data unless statutory retention obligations require otherwise.
We only use technically necessary cookies that are required for logging in and for remembering your language choice. There are no analytics, tracking or advertising cookies. No external fonts, scripts, maps, videos or analytics tools from third parties are loaded on this website.
In addition, when you log in or out, the login function places a short entry (nextauth.message) in your browser's local storage so that the login status is consistent across several open browser tabs.
This storage is strictly necessary to provide the service you have requested (login, booking, display in the language you have chosen); no consent is required for it (§ 165(3) Telekommunikationsgesetz 2021). The legal basis for the associated data processing is Art. 6(1)(b) and (f) GDPR. You can delete or block cookies in your browser at any time; however, you will then not be able to log in, and your language choice will not be remembered.
We use the following service providers, who process personal data on our behalf and in accordance with our instructions (processors pursuant to Art. 28 GDPR):
Mollie B.V. receives the data listed in section 4 as an independent controller. Within the association, only persons who need your data to organise and run the courses have access to them. We only pass data on to authorities (e.g. tax authorities) where we are legally obliged to do so. Data are not passed on for advertising purposes or sold.
Vercel Inc. and Databricks, Inc. (including Neon, LLC) are based in the USA. Both companies are certified under the EU-US Data Privacy Framework, for which there is an adequacy decision of the European Commission (Art. 45 GDPR). In addition, the data processing agreements provide for EU standard contractual clauses (Art. 46(2)(c) GDPR). There is also an adequacy decision of the European Commission for Switzerland (hosttech GmbH).
The details requested at registration and booking are required to conclude the contract; without them we cannot accept a booking. No automated decision-making, including profiling (Art. 22 GDPR), takes place.
Data are transmitted between your browser and the website in encrypted form (HTTPS/TLS). We only store passwords as hash values. Access to the data is restricted to the persons responsible.
Under the GDPR you have the following rights:
An informal message to office@scalp-concept.com is sufficient to exercise your rights. We will reply within one month and may ask for proof of your identity for security reasons.
If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at, www.dsb.gv.at.
Last updated: October 2026
