Data Controller:

Nail Station Sp. o..

Address: 13/u3 Magazynowa Street, 02-652 Warsaw
Email: akademiamc1@gmail.com
Phone: [specify]

‍The Data Controller (hereinafter: “Controller”) is the entity responsible for the processing and protection of personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the applicable provisions of the law of the Republic of Poland.

The following categories of personal data may be processed as part of the business and provision of services:

- name and surname of the client,

- phone number,

- e-mail address,

- if necessary — data to issue an invoice,

- photo and video materials (if documentation is carried out during the provision of services).

The scope of the collected data is limited only to the data necessary for the achievement of the indicated purposes.

The data is provided by customers voluntarily and collected through:

- booking form (online or in the messenger),

- telephone conversation,

- e-mail,

- personal contact (during a visit or consultation).

The Company does not enter into written contracts — making a reservation and providing data is considered as an expression of consent to their processing in accordance with this Policy.

Personal data are processed exclusively for the following purposes:

1. Reservation of services — in order to arrange appointments, confirm reservations, provide hairdressing services and contact the client in matters related to the visit.

2. Issuance of accounting documents and implementation of tax obligations.

3. Contact with the customer — to confirm the visit, provide organizational information or changes.

4. Photographic and video documentation — for archival and marketing purposes (only with the consent of the customer).

5. Marketing and Advertising — sending information about promotions, publishing photos, subject to express consent.

The controller does not use personal data for other purposes without prior informing and obtaining the consent of the data subject.

The processing of personal data is carried out on the basis of Art. 6 GDPR:

point b) — the processing is necessary for the performance of the contract or for taking action prior to its conclusion (booking a service, contacting the customer);

point (c) — compliance with legal obligations (e.g. tax and accounting);

point a) — consent of the data subject (e.g. marketing, photo/video publication).

Where processing takes place on the basis of consent, the person has the right to withdraw it at any time, without affecting the lawfulness of the processing carried out before its withdrawal.

Access to personal data is available only to authorized persons and entities cooperating with the Administrator in order to provide services correctly.

Data may be transferred:

- the accounting office,

- postal and data storage service providers (e.g. Gmail, Mailerlite),

- hosting and IT support providers,

- payment operators (if necessary).

All data processors are obliged to maintain confidentiality and comply with the provisions of the GDPR.

1. Customer data (name, phone, email) are stored up to 5 years — for tax and accounting purposes.

2. Photo and video materials — until the consent is withdrawn.

3. Marketing data — until you unsubscribe or withdraw your consent.

4. After the expiry of the storage period or receipt of a deletion request, the data is permanently deleted or anonymized.

Every person has the right to:

1. Right of access — find out what data about you is stored and how it is used.

2. Right to rectification — rectification or supplementation of data if they are incorrect or out of date.

3. Right to erasure (“right to be forgotten”) — requests the deletion of data if they are no longer needed for the purposes indicated.

4. Right to restriction of processing — temporary suspension of the use of data, e.g. in the event of a complaint.

5. Right to object — prohibition of the use of data for marketing purposes or newsletters.

6. Right to data portability — request the transfer of data to another organization in a usable format.

7. Right to lodge a complaint — contact the supervisory authority if the participant believes that their data is being used in violation of the law.

The controller implements appropriate technical and organizational security measures to prevent unauthorized access, loss or modification of personal data.

Security measures include:

- use of secure servers located in the European Union;

- Storage of data in systems encrypted with passwords;

- Access to data limited to authorized employees;

- Regularly update passwords and software;

- Backups and access control.

If you have any questions about the processing of personal data, you can contact the Administrator:

‍Email: akademiamc1@gmail.com

If you believe that your rights have been violated, you have the right to file a complaint with a supervisory authority —

‍President of the Office for Personal Data Protection (UODO)
‍ul. Stawki 2, 00-193 Warsaw Website: https://uodo.gov.pl

1. During trainings or events Nail Station Sp. z o.o. can photograph and film customers.

2. Consent to participate in filming is expressed orally or in writing (e.g. during registration or in a message).

3. Photos and videos can be used for publication:
‍
- on the company's website,
- in social media (Instagram, Facebook, TikTok, etc.),
- in advertising materials and presentations of the Academy.

4. The customer has the right to revoke the consent to the use of the photos at any time. For this purpose, please contact us by email at the following address: akademiamc1@gmail.com.

5. Once the request is received, the use of photos/videos will be discontinued and the materials will be removed within 30 days.

1. This Privacy Policy is valid from the date of publication and regulates the processing of personal data in Nail Station Sp. z o.o.

2. The Administrator reserves the right to make changes to this document if necessary.

3. Any changes will be published on the official website or communicated to customers and participants.

4. Use of services, application or participation in courses means acceptance and agreement to the provisions of this Privacy Policy.