GDPR information clause

Who processes your data

The controller is OTULA Studio Kosmetologii Aleksandra Wierzbicka, ul. Wilcza 42/3, 00-679 Warsaw, NIP 701-000-99-99, REGON 521000999. Contact for data matters: rodo@otulabeauty.pl.

Purposes and legal bases

• *Arranging and delivering the appointment* — art. 6(1)(b) GDPR.
• *Keeping treatment records and assessing contraindications* — art. 9(2)(a) GDPR, on the basis of your explicit consent given at the studio.
• *Replying to an inquiry from the website* — art. 6(1)(b) GDPR.
• *Newsletter and marketing information* — art. 6(1)(a) GDPR, only after separate consent.
• *Accounting and tax obligations* — art. 6(1)(c) GDPR.
• *Defending against claims* — art. 6(1)(f) GDPR.

Is providing data voluntary

A name and phone number are necessary to arrange an appointment — without them we cannot confirm a time. An email address and marketing consent are entirely voluntary, and withholding them does not affect your access to our services.

How long we keep data

• Accounting data — 5 years from the end of the tax year in which the liability arose.
• Treatment records and treatment consents — 6 years, the limitation period for claims.
• Form inquiries — 24 months from the last contact.
• Marketing data (newsletter) — until consent is withdrawn, then up to 12 months in a register of withdrawn consents so the withdrawal itself can be evidenced.

Your rights

Access, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, and withdrawal of consent at any time — without affecting the lawfulness of processing before withdrawal.

You may lodge a complaint with the data protection supervisory authority.

Profiling

We do not make decisions about you based solely on automated processing, including profiling.