1. Data controller
The data controller within the meaning of Article 4(7) GDPR is Valeryia Lebiadzevich, operating a sole proprietorship under the business name Valeryia Lebiadzevich Self Love Spot, ul. Barska 61A / LU1, 30-307 Kraków, Polska, NIP 6762644302, REGON 525470593.
For any matters related to personal data protection please contact us at selflovespotkrk@gmail.com or by phone at +48 574 472 931.
2. Scope of processed data
Browsing selflovespot.pl does not require providing personal data. We process only the technical data necessary for the operation and security of the site (IP address, browser type, visit date), kept in logs provided by Cloudflare.
On the careers page (/praca) we provide a recruitment form. If you choose to fill it in, we process the data you provide: name, phone number, optionally a messenger contact (Telegram/Instagram), information about your experience, portfolio links and the message text. Providing this data is voluntary and you decide its scope yourself.
If you choose to book a visit through the Booksy system (via the “Book” buttons), your data is collected directly by Booksy sp. z o.o. under Booksy’s own privacy policy. Once your appointment is confirmed, the data necessary to deliver the service is made available to us (first name, phone, chosen treatment, time slot).
During your visit we may process your contact details (first name, phone) and information necessary to perform the treatment correctly (e.g. allergies, preferences, treatment history). This data is stored in the Booksy system.
3. Purposes and legal bases
We process your data exclusively for the following purposes:
• performance of the contract for hair and beauty services — Art. 6(1)(b) GDPR;
• fulfilment of legal obligations, including tax and sanitary law — Art. 6(1)(c) GDPR;
• legitimate interest of the controller (billing, complaint handling, site security) — Art. 6(1)(f) GDPR;
• running recruitment and contacting you about your application — based on your consent (Art. 6(1)(a) GDPR) and steps prior to entering into a contract (Art. 6(1)(b) GDPR);
• where you consent to marketing purposes (incl. measuring ad performance) — Art. 6(1)(a) GDPR.
4. Recipients of data
We may share personal data with trusted processors:
• Booksy sp. z o.o. (booking and payment system);
• Cloudflare, Inc. (hosting and site delivery);
• Google LLC (embedded Google Maps and any technical statistics);
• Meta Platforms, Inc. (embedded Instagram content and marketing/ad-measurement tools — only after your consent);
• the provider of the messenger through which we receive recruitment applications (Telegram FZ-LLC) — only for the data submitted in the recruitment form;
• providers of accounting and legal services — to the extent necessary for settlement and complaints.
We do not sell personal data.
5. Retention periods
We retain data for as long as necessary to achieve the purposes listed in section 3 and for the period required by applicable law (e.g. tax law — 5 years from the end of the year in which an accounting document was issued).
Recruitment application data is processed until the given recruitment process ends, and — if you consent — also for future recruitment until you withdraw your consent.
Data collected on the basis of consent is processed until consent is withdrawn.
6. Your rights
In connection with the processing of personal data you are entitled to:
• the right of access (Art. 15 GDPR);
• the right of rectification (Art. 16 GDPR);
• the right to erasure (Art. 17 GDPR) — subject to legal obligations;
• the right to restrict processing (Art. 18 GDPR);
• the right to data portability (Art. 20 GDPR);
• the right to object (Art. 21 GDPR);
• the right to withdraw consent at any time;
• the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).
To exercise your rights, please contact us at selflovespotkrk@gmail.com.
7. Transfers outside the EEA
Some of our providers (Cloudflare, Google, Meta) may process data outside the European Economic Area. Such transfers are carried out under standard contractual clauses approved by the European Commission or an adequacy decision (Data Privacy Framework), ensuring an appropriate level of protection.
Recruitment applications are received via the Telegram messenger, whose operator is located outside the EEA. You provide this data voluntarily, on the basis of your consent (Art. 49(1)(a) GDPR).
8. Cookies
Detailed information about cookies used is provided in a separate document — the Cookie Policy.
9. Changes to the policy
This Privacy Policy may be updated along with changes in the services offered or legal requirements. The latest version is always published on this page together with the date of the last update.