Privacy policy

Data controller

The controller of personal data is *OTULA Studio Kosmetologii Aleksandra Wierzbicka*, ul. Wilcza 42/3, 00-679 Warsaw, Poland, NIP 701-000-99-99, REGON 521000999. Data-related contact: rodo@otulabeauty.pl.

What we collect

• Data from the visit-inquiry form: name, phone number, optionally an email address, the treatment of interest, preferred times and your comment.
• The email address given when subscribing to the newsletter.
• Technical data: IP address and basic browser information in server logs, used only for security and to limit the number of submissions from one address.

Appointments are booked in an external booking system. Data entered there is processed by that provider under its own privacy policy and does not reach this site.

Health data

Information about your skin, medication and contraindications is collected only at the studio, on a paper or electronic treatment record, on the basis of separate consent (art. 9(2)(a) GDPR). We do not ask for it in the website form and ask that you do not enter it there.

Purposes and legal bases

• Contacting you about an inquiry — art. 6(1)(b) GDPR (steps prior to entering a contract).
• Sending the newsletter — art. 6(1)(a) GDPR (consent), withdrawable at any time.
• Site security and abuse prevention — art. 6(1)(f) GDPR (legitimate interest).

Retention

Inquiries are kept for 24 months from the last contact. Newsletter addresses until consent is withdrawn. Treatment records for as long as needed to defend against claims.

Recipients

The hosting provider, the email delivery provider, the booking-system provider and — if analytics is enabled — the analytics provider. We do not sell data and do not pass it to third parties for marketing.

Your rights

You have the right to access, rectify, erase, restrict, port and object to processing, and to withdraw consent at any time. You may also lodge a complaint with the supervisory authority.

Cookies

Necessary cookies are required for the site to work. Analytics and marketing cookies run only after consent in the banner; consent can be changed at any time by clearing site data in your browser.