Last updated: 6 October 2026
This policy explains which personal data we process when you visit eliterecovery.at, book an appointment or contact us, and what rights you have under the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
1. Controller
Franck Paul Jean Pannetier (“Max Pannetier”), trading as Elite Recovery Vienna
Schwertgasse 4/8, 1010 Vienna, Austria
Email: hello@eliterecovery.at
Phone: +43 681 20641668
We have not appointed a data protection officer, as we are not legally required to.
2. Hosting
This website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you visit the website, Netlify automatically processes technical data such as your IP address, date and time of access, the page requested, browser type and operating system (server log files). This is necessary to deliver the website securely and to prevent attacks.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and functioning website). Netlify processes the data on our behalf under a data processing agreement. Netlify is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection (Art. 45 GDPR).
3. Booking appointments via Calendly
When you click “Book”, you are taken to the booking service Calendly (Calendly, Inc., 115 E Main St, Ste A1B, Buford, GA 30518, USA). Calendly processes the data you enter there, such as your name, email address, phone number, the selected appointment, any notes you add and your acceptance of our cancellation policy.
We use this data only to schedule and carry out your appointment and to contact you about it. Legal basis: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual steps).
Please do not enter health information in the booking form unless you want to. Any health information you choose to share is processed only with your explicit consent (Art. 9(2)(a) GDPR) and only for your treatment. You can withdraw this consent at any time.
Calendly acts as our processor and is certified under the EU-U.S. Data Privacy Framework. Calendly’s EU representative is DPO Centre Europe, Berlin, Germany (eurep@calendly.com). More information: https://calendly.com/privacy (opens in a new tab)
Payment. Online bookings are paid in advance (e.g. by card, Apple Pay or Google Pay). The payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, which is integrated into Calendly. Stripe processes your payment details (e.g. card data, name, amount) to carry out the payment and to prevent fraud; we do not receive your full card details. Stripe may transfer data to Stripe, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (legal obligations, e.g. anti-money-laundering). More information: https://stripe.com/privacy (opens in a new tab). If you pay in cash at the practice, no payment data is processed online. We keep invoices and payment records for 7 years as required by Austrian tax law (§ 132 BAO).
4. Contact by email or phone
If you contact us by email or phone, we process your details and your message to answer your enquiry. Legal basis: Art. 6(1)(b) GDPR if your enquiry relates to a treatment, otherwise Art. 6(1)(f) GDPR. We delete the data once your enquiry has been dealt with, unless statutory retention obligations apply.
5. Treatment records
If you come for treatment, we keep the information needed for it, including health information you give us (e.g. complaints, injuries, previous treatments). Legal basis: Art. 9(2)(a) and (h) GDPR. We keep these records for 3 years after your last treatment, unless a longer period is needed to establish or defend legal claims, and invoices for 7 years, as required by Austrian tax law (§ 132 BAO).
6. Meta Pixel (only with your consent)
With your consent, we use the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. It helps us measure how our Facebook and Instagram ads perform and show ads to people who have visited our website. The pixel sets cookies and sends data such as your IP address, browser information and pages visited to Meta. Meta may combine this data with your Facebook or Instagram account and may transfer it to the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework.
For the collection and transfer to Meta, we and Meta are joint controllers (Art. 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum (opens in a new tab). Legal basis: your consent, Art. 6(1)(a) GDPR and § 165(3) Austrian Telecommunications Act (TKG 2021). You can withdraw your consent at any time via “Cookie settings” in the footer. Meta’s privacy policy: https://www.facebook.com/privacy/policy (opens in a new tab)
Campaign attribution (only with your consent). If you arrive via one of our ads or campaign links and have consented to marketing cookies, we store the campaign source (UTM parameters such as source, medium and campaign name) in the cookie er_utm for 30 days and pass it on to Calendly when you click a booking link. This tells us which campaign led to a booking. Legal basis: your consent, Art. 6(1)(a) GDPR and § 165(3) TKG 2021. You can withdraw your consent at any time via “Cookie settings” in the footer.
7. Plausible Analytics
We use Plausible Analytics (Plausible Insights OÜ, Tartu, Estonia) to count visits and see which pages are popular. Plausible does not use cookies and does not store personal data. Your IP address is used only briefly to create an anonymous daily identifier and is not stored. All data stays in the EU.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in understanding how the website is used). More information: https://plausible.io/data-policy (opens in a new tab)
9. How long we keep your data
We keep personal data only as long as needed for the purposes above or as required by law. Server log files are kept by our host only as long as needed for security and operation.
10. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future. To exercise your rights, email hello@eliterecovery.at.
You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at (opens in a new tab).
11. Changes
We may update this policy when our website or the law changes. The current version is always available on this page.