PRIVACY POLICY

§1. General information

This Privacy Policy sets out the rules for the processing and protection of personal data of users of the website operated by the Controller, in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR),
• the Act on the Provision of Electronic Services,
• the Telecommunications Law Act,
• and other applicable provisions of Polish and European law.

The Controller exercises particular care to protect users’ privacy and the security of the personal data provided.

§2. Scope of data collected

The Controller may process the following personal data of users:

• first and last name,
• phone number,
• e-mail address,
• the content of a message sent via the contact form,
• IP address,
• technical data concerning the device and browser,
• data related to the use of the website,
• data stored in cookies.

Providing data is voluntary; however, it may be necessary in order to make contact, arrange a consultation or provide services.

§3. Purposes of data processing

Personal data may be processed for the following purposes:

1. Contacting the user and responding to a message sent via the contact form.
2. Arranging consultations and appointments.
3. Handling enquiries concerning cosmetology services.
4. Conducting marketing communications — only after obtaining the appropriate consent.
5. Conducting advertising and analytical activities.
6. Improving the operation of the website.
7. Pursuing or defending against claims.
8. Fulfilling obligations arising from applicable law.

§4. Legal bases for data processing

Data is processed on the basis of:

• Article 6(1)(a) GDPR — the user’s consent,
• Article 6(1)(b) GDPR — steps taken to conclude or perform a service,
• Article 6(1)(c) GDPR — a legal obligation,
• Article 6(1)(f) GDPR — the legitimate interests of the Controller.

§5. Contact form

Completing the contact form requires the provision of data necessary for the Controller to respond.

Data submitted via the form is used solely to handle the enquiry and contact the user.

§6. Marketing and advertising

The Controller may carry out advertising activities using tools such as:

• Google Ads,
• Facebook / Instagram Ads,
• Google Analytics 4.

In connection with this, cookies and tracking technologies may be used to analyse the effectiveness of advertising campaigns and tailor marketing content.

Data is used only in accordance with applicable law and after obtaining the user’s required consents.

§7. Google Analytics 4

The website uses Google Analytics 4 — an analytics tool provided by Google Ireland Limited.

Google Analytics makes it possible to analyse how users use the website, including, among other things:

• the number of visits,
• traffic sources,
• time spent on the website,
• user behaviour.

Data may be transferred outside the European Economic Area in accordance with GDPR-compliant mechanisms used by Google.

More information:
Google Privacy Policy

§8. Google reCAPTCHA

The website uses Google reCAPTCHA to protect forms against spam and automated bot activity.

Using reCAPTCHA involves analysing the user’s behaviour on the website.

The service is provided by Google Ireland Limited.

§9. Google Maps

Google Maps may be embedded on the website in order to show the location of the studio or service location.

Google may process user data in accordance with its privacy policy.

§10. Booksy

The website may contain links or redirects to the Booksy booking system.

Bookings made via Booksy are subject to the privacy policy of the provider of that platform.

§11. Social media

The website may contain links to the Controller’s social media profiles, in particular:

• Facebook,
• Instagram.

Accessing these services is subject to the rules established by their respective owners.

§12. “Before / after” photos

The Controller may publish photographs showing treatment results only:

• where the person cannot be identified,
• or after obtaining the client’s voluntary and explicit consent.

The publication of a person’s image is carried out in accordance with applicable law.

§13. Recipients of data

Data may be disclosed to entities cooperating with the Controller only to the extent necessary for the provision of services, in particular to:

• hosting providers,
• IT service providers,
• providers of analytics and marketing tools,
• e-mail service providers,
• entities providing technical support.

§14. Data retention period

Personal data is retained for the period:

• necessary to achieve the purpose of processing,
• required by applicable law,
• until consent is withdrawn,
• or until an objection is effectively raised.

§15. User rights

The user has the right to:

• access their data,
• rectify their data,
• erase their data,
• restrict processing,
• data portability,
• object to processing,
• withdraw consent,
• lodge a complaint with the President of the Personal Data Protection Office.

§16. Cookies

The website uses cookies for the following purposes:

• ensuring the proper operation of the website,
• collecting statistics,
• marketing activities,
• improving the user experience on the website.

Detailed information concerning cookies is provided through the cookie consent management system (Complianz).

§17. Data security

The Controller applies appropriate technical and organisational measures to protect personal data against:

• loss,
• destruction,
• unauthorised access,
• disclosure,
• modification.

§18. Changes to the Privacy Policy

The Controller reserves the right to make changes to this Privacy Policy.

The current version of the document is published on the website.