Privacy policy — Glomani

Data controller

The controller of your personal data is Barbara Jerzykiewicz-Młynarska (Glomani), ul. Stefana Starzyńskiego 2, 35-508 Rzeszów, Poland, NIP 8132543718. For data matters, write to [email protected], call +48 534 432 584 or send a letter to the salon address. We have not appointed a data protection officer, as we are not required to.

What data we process

Booking data — name, phone, email, the chosen service, the time and your notes.
Client card — if you agree: your visit history and colour formulas, so we can repeat your shade next time.
Health information — only what you choose to tell us, such as an allergy or a patch test result, solely to perform the service safely and with your explicit consent.
Gift voucher data — the buyer's details, the recipient's name (if it is to appear on the voucher), and the voucher number, value and expiry.
Online payment data — if you pay via Stripe: name, email, amount, card brand and last 4 digits, payment status. The full card number and CVC are processed only by Stripe — we never receive them.
Technical data — IP address and browser information, recorded in the web server's log to run and secure the website.

Purposes and legal bases

Booking and performing a visit, taking a deposit, selling and redeeming a voucher (Art. 6(1)(b) GDPR).
Keeping a client card with colour formulas and sending text reminders about your visit — based on your consent (Art. 6(1)(a) GDPR).
Health information given to perform the service safely — based on your explicit consent (Art. 9(2)(a) GDPR).
Issuing receipts and keeping tax records (Art. 6(1)(c) GDPR).
Handling complaints and payment disputes, and establishing, pursuing or defending claims (Art. 6(1)(b), (c) and (f) GDPR).
Website security (Art. 6(1)(f) GDPR).

Providing data is voluntary, but without a phone number or email we cannot confirm a visit. We do not make automated decisions or profile you. This website uses no analytics or marketing tools. We never publish photos of your hair without your consent.

Recipients

Stripe — Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland: online payment provider; also as an independent controller for fraud prevention and legal obligations (stripe.com/privacy).
Hosting and email — our website and email hosting provider, acting under a data processing agreement.
Telecoms operator — for calls and text messages.
Accounting office — for data on receipts, under a data processing agreement.
The bank holding our business account — for bank transfers and refunds.
Public authorities — only where the law requires it.

We do not sell data or share it for marketing.

Transfers outside the EEA

Stripe may transfer data to the United States. The basis is Stripe's participation in the EU-U.S. Data Privacy Framework (European Commission decision of 10 July 2023) and standard contractual clauses. We will provide a copy of the safeguards on request.

Retention

Booking data — up to 12 months from your last visit, unless we keep a client card for you.
Client card and health information — until you withdraw consent, or 3 years from your last visit.
Voucher, receipt and payment data — for 5 years from the end of the calendar year in which the tax payment deadline passed.
Data needed to handle complaints and claims — until the claims become time-barred.

Your rights

You have the right to access your data, rectify it, erase it, restrict its processing, port it, and object to processing based on our legitimate interests. You can withdraw consent at any time without affecting the lawfulness of earlier processing. Write to [email protected]; we reply within one month.

Right to complain

You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) or with the supervisory authority in your country of residence. For browser storage, see the Cookie policy.