§ 1. General provisions

1. This Privacy Policy sets out the rules governing the processing and protection of the personal data of users of the website www.zabieginacialo.com (hereinafter referred to as the „Website”).

2. The data controller for Users„ personal data is Womenline Ewa Nieczypor, with its registered office at Pl. Wyszyńskiego 54, 58-500 Jelenia Góra, NIP: 6912192475, REGON: 0212192475 (hereinafter referred to as the ”Controller”).

3. You can contact the Data Controller by email at ewa.nieczypor@gmail.com or by post at the following address: Womenline Ewa Nieczypor, Mała Kamienica 81, 58-512 Mała Kamienica.

4. The Controller has appointed a Data Protection Officer, who can be contacted by email or at the postal address specified in paragraph 3 above.

5. The Controller operates in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR). The Controller adequately safeguards Users’ personal data against unauthorised access by third parties, implements appropriate technical and organisational measures, and ensures the confidentiality, integrity and availability of the processing systems.

§ 2. Purpose, scope and legal basis for data processing

1. User data (including, amongst other things, first name, surname, date of birth, contact telephone number, email address and, where an invoice is requested, also the company name, address and tax identification number) is processed for the following purposes:

   • The provision of services (including laser hair removal and beauty consultations) and the management of appointment bookings,

   • Maintaining records and personal files for patients/clients,

   • Carrying out accounting and tax settlements for services rendered,

   • Any determination, investigation or defence against claims,

   • Analytical, evidence-based and archival,

   • The Controller offering services directly (direct marketing).

2. Data processing for the purposes set out in paragraph 1 is carried out on the basis of Article 6(1)(b), (c) and (f) of the GDPR (performance of a contract/booking, legal obligations, the Controller’s legitimate interests).

3. To the extent that the data processed may include special categories of data (so-called health data, necessary for the safe performance of the procedure), the Data Controller processes such data solely for the purpose of providing laser hair removal services and consultations. The legal basis is the User’s explicit consent (Article 9(2)(a) of the GDPR). The provision of this data is voluntary; however, failure to provide it or to give consent will result in the procedure not being carried out. Consent may be withdrawn at any time.

§ 3. Marketing activities

1. Conducting direct marketing (sending information about services and promotional campaigns) via end devices (telephone, email) takes place only where the User has given separate, voluntary consent (Article 6(1)(a) of the GDPR).

2. Users may opt out of receiving marketing materials at any time by contacting the Data Controller by email or post.

§ 4. User Rights In accordance with the provisions of the GDPR, the User has the right to:

• Access to your data and to receive copies of them.

• Corrections (amendments) their personal data.

• Data erasure („the right to be forgotten”), provided there are no overriding legal grounds requiring their continued retention.

• Restrictions on data processing.

• Lodging an objection with regard to the processing of data, including for the purposes of direct marketing or profiling.

• Data transfers in a commonly used format.

• Withdrawal of consent to object to the processing of your data at any time (without this affecting the lawfulness of the processing prior to the withdrawal of your consent).

• Lodging a complaint to the supervisory authority (the President of the Office for Personal Data Protection), if it considers that the processing infringes the law.

§ 5. Data recipients and transfers outside the EEA

1. The following may have access to the User’s personal data:

   • Authorised staff and associates of the Controller,

   • External service providers supporting the Controller (e.g. an accountancy firm, IT services, booking services, web hosting, courier/postal services),

   • Entities carrying out analytics and marketing (e.g. Google LLC).

2. In connection with the use of analytical and marketing tools, data may be transferred outside the European Economic Area (EEA), including to the USA. The data controller ensures that such transfers are carried out in accordance with the applicable legal mechanisms, in particular the Standard Contractual Clauses (SCCs) or the data protection framework set out in the Data Privacy Framework (DPF) agreement.

§ 6. Data retention period

1. Personal data will be processed for the period necessary to fulfil the purposes for which it was collected.

2. The processing period is determined, amongst other things, by the limitation periods for claims (Civil Code) and by tax and accounting obligations. As a rule, data relating to the provision of services is not retained for longer than 6 years from the date on which the service was provided or the contract was terminated.

3. Data processed on the basis of consent is retained until such consent is withdrawn.

§ 7. Cookies and Analytics

1. The Website automatically collects information contained in cookies. These are used to facilitate access to the Website, to analyse Users’ preferences and for statistical purposes.

2. The data controller uses, amongst other things, Google Analytics and Google Ads. The data collected through these services is of a technical nature and is used to analyse website traffic and optimise promotional activities.

3. The website uses session (temporary) cookies and persistent cookies (which remain on your device until you delete them manually or they expire).

4. Cookies may be used by advertising networks working with the Controller (in particular Google) to display adverts tailored to the User’s preferences. The User can manage their Google ad settings at: https://adssettings.google.com/.

5. Users can disable or restrict the use of cookies themselves via their web browser settings. Restricting the use of cookies may affect the proper functioning of certain features of the Website.

§ 8. Final provisions This Website has not been designed for children under the age of 16 and is not directly aimed at them. Any data provided by the User is done so entirely voluntarily and in full knowledge of the facts.