all Pluma entities (DE, AT, ES) and all staff, including Experts and contractors.
1. Purpose
This policy sets out how Pluma handles personal data and the responsibilities of everyone working for or with Pluma. It is the umbrella document referenced by all other data protection materials.
Pluma GmbH
Schlüterstrasse 86, 20146 Hamburg, Deutschland
Amtsgericht Hamburg, HRB 163902
Managing Directors: Benjamin Schroeter, Rozalla Tapper
VAT ID: DE337403167
Email: hello@pluma.me · Web: www.pluma.me
For treatments provided in studios outside Germany, the respective local Pluma company is the controller of the data collected in the studio:
Pluma Austria GmbH (Vienna) — Neudeggergasse 5/3, 1080 Wien, Österreich · Commercial Register Vienna FN 671080 h · VAT ID ATU83068635
Pluma Spain — the Spanish subsidiary ('Pluma Spain SL', working title) is in the process of being established and is expected to be operational by August 2026. Until registration, services for Spanish customers are provided by Pluma GmbH (Hamburg) as the controller. This policy will be updated immediately after the Spanish company is registered.
Where Pluma GmbH and a local company jointly determine the purposes and means of processing (e.g. a group-wide customer database), joint controllership pursuant to Art. 26 GDPR applies; we will provide you with the essence of this arrangement upon request.
Contact for data protection questions regarding all of the above companies: datenschutz@pluma.me (forwarded to our group-wide data protection officer).
2. Scope
We have appointed an external data protection officer for the entire Pluma group of companies:
Daniel Pohl, LL.M., attorney and certified data protection officer (TÜV), Fritz & Mark Legal Rechtsanwälte (FUM Legal).
You can reach our data protection officer via Pluma with any data protection questions or to exercise your rights under the GDPR:
Email: datenschutz@pluma.me
Phone: +49 40 80813059 (Pluma Hamburg, Mon–Fri 10 am–6 pm)
3. What this policy covers
This policy describes how we process personal data when you visit pluma.me, create an account, book a treatment online, sign up for our newsletter, or purchase products from our shop. A separate notice (Studio Treatment Privacy Notice) governs data processing in the studio during intake and treatment — health data is also processed there.
This policy applies to:
- All Pluma legal entities and studios
- All employees, Experts, freelancers, contractors and interns
Pluma processes personal data in line with the following principles. All staff are expected to apply them in their daily work:
6. Legal bases used at Pluma
5. Cookies and tracking
The signed appointment instrument and supervisory-authority notification (HmbBfDI) are held in 01_Framework_and_Governance/01.1_DPO_Signed_Contract/. Counter-signed copies of subsequent revisions of this policy are added to the framework approval register at each annual review.
6. Recipients of your data
We only pass on personal data to carefully selected service providers who act on our written instructions and on the basis of a data processing agreement pursuant to Art. 28 GDPR, as well as to parties acting as independent or joint controllers. We do not sell your data.
6.1 Processors
6.2 Independent and joint controllers
The following platforms set cookies or pixels on pluma.me if you have consented. For the data collected via these pixels, we and the respective platform are joint controllers within the meaning of Art. 26 GDPR; we will provide you with the essence of these arrangements upon request.
- Meta Platforms Ireland Ltd. — Facebook and Instagram advertising pixels
- Google Ireland Ltd. — Google Ads conversion and remarketing tag
- TikTok Technology Ltd. — TikTok pixel
The following parties act as independent controllers for the data collected on their platforms:
- Google Ireland Ltd. — Google Business Profile / Google Reviews (if you leave a review on Google)
- Apple Inc. / Meta Platforms Ireland Ltd. — if you sign in to Pluma with your Apple or Facebook account, these providers process the sign-in on their own legal basis
6.3 Recipients required by law
We also pass on personal data to our tax advisor (Arenz), to lawyers for asserting or defending legal claims, and to authorities (e.g. tax office, social insurance carriers, data protection supervisory authorities) where a legal obligation or an official request for information exists.
7. Data transfers to third countries
Some of our service providers process data outside the EU/EEA, particularly in the USA. Where this is the case, we base the transfer on:
- an adequacy decision of the European Commission (e.g. the EU-US Data Privacy Framework for correspondingly certified US providers),
- standard contractual clauses of the European Commission, supplemented by a transfer impact assessment, or
- your explicit consent to the specific transfer, where neither an adequacy decision nor standard contractual clauses are applicable.
A current list of service providers based outside the EU/EEA and the safeguards applied is available upon request at datenschutz@pluma.me.
8. Storage periods
9. Your rights
You have the right to:
- Access (Art. 15 GDPR) — a copy of your data along with accompanying information
- Rectification (Art. 16 GDPR) — correction of inaccurate data
- Erasure (Art. 17 GDPR) — subject to statutory retention obligations
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR) — in a structured, machine-readable format
- Objection (Art. 21 GDPR) to processing based on legitimate interests, in particular to direct marketing
- Withdrawal of consent given, with effect for the future
- Complaint to a data protection supervisory authority, in particular at your place of habitual residence or workplace
Please direct requests to datenschutz@pluma.me. We respond to requests within one month.
Competent supervisory authorities
- Germany: The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) — Ludwig-Erhard-Str. 22, 20459 Hamburg
- Austria: Austrian Data Protection Authority (DSB) — Barichgasse 40-42, 1030 Wien
- Spain: Agencia Española de Protección de Datos (AEPD) — C/ Jorge Juan 6, 28001 Madrid
10. Obligation to provide data
Providing your data is necessary for booking and paying for a treatment; without it, we cannot provide the service. For marketing purposes, providing data is voluntary — consent is optional.
11. No automated decision-making
Pluma currently does not use automated decisions with legal effect or similarly significant impact within the meaning of Art. 22 GDPR.
12. Changes to this policy
We update this policy when our processing changes. The date stated below indicates the current version. We will additionally inform you directly about significant changes that affect you.
Version dated: May 27, 2026