Privacy Policy

Data Controller

The controller of your personal data is JUKA CONCEPT Karolina Słabosz, located at ul. Ludwika Rydygiera 12/48, 01-794 Warsaw, Poland (hereinafter: "the Salon").

For matters related to personal data protection, you can contact us via the contact form on our website or through our Instagram profile.

What Data We Collect

Depending on how you interact with us, we process the following categories of data:

• Website contact form — full name, email address, phone number (optional), service of interest (optional), message content.
• Booksy reservations — data provided during registration and booking on Booksy, including name, phone number, visit history, and service preferences. Processing of this data is governed by Booksy's terms and privacy policy.
• On-site appointment booking — your name and email address entered in the online booking form. We use them to confirm the slot and arrange the visit details. The data is stored with our database provider (Convex) and a confirmation is sent by email (Resend). The legal basis is your consent (Art. 6(1)(a) GDPR) given in the form. We keep it until the visit takes place or you withdraw consent.
• SMS and email communication — phone number and/or email address used for scheduling appointments, sending post-treatment skincare recommendations, and automated review requests (sent via the Booksy platform).
• Instagram — publicly available data from your profile when you contact us via direct messages.
• Analytics data — anonymous website usage data collected by Google Analytics 4, Vercel Analytics, and Umami, only after you give consent via the cookie banner.

Purposes and Legal Bases for Processing

• Handling inquiries from the contact form — based on your consent (Art. 6(1)(a) GDPR) given by checking the consent box in the form.
• Providing services and managing bookings through Booksy — for the performance of a contract for cosmetology services (Art. 6(1)(b) GDPR).
• Skincare recommendations sent via SMS or email after your visit — based on the legitimate interest of the controller in ensuring continuity and quality of care (Art. 6(1)(f) GDPR).
• Scheduling appointments via SMS — for the performance of a contract (Art. 6(1)(b) GDPR).
• Review requests — automated SMS messages sent via the Booksy platform after your visit, subject to Booksy's terms.
• Website analytics (Google Analytics 4, Vercel Analytics, and Umami) — based on your consent given via the cookie banner (Art. 6(1)(a) GDPR).

Data Recipients

Your data may be shared with the following categories of recipients, only to the extent necessary for the purposes described above:

• Booksy International S.A. — online booking platform.
• Convex, Inc. — database provider for storing contact form inquiries and on-site appointment bookings.
• Resend, Inc. — email notification service provider.
• Google LLC — provider of Google Analytics 4 (anonymous data, only with consent).
• Vercel Inc. — hosting provider and provider of Vercel Analytics (analytics data only with consent).
• Umami Software, Inc. — provider of Umami analytics (Umami Cloud; anonymous, cookieless data, only with consent).
• Meta Platforms, Inc. — for communication via Instagram.

Data may be transferred to third countries (USA) subject to appropriate safeguards required by the GDPR.

Data Retention Period

• Contact form data — until the inquiry is handled, up to 12 months from submission.
• Booksy reservation data — in accordance with Booksy's retention policy.
• Analytics data (GA4, Vercel Analytics, and Umami) — in accordance with analytics providers' retention settings.
• SMS/email communication — until consent is withdrawn or the service relationship ends.

Your Rights

Under the GDPR, you have the following rights:

• Access to your personal data.
• Rectification of inaccurate or incomplete data.
• Erasure of data ("right to be forgotten").
• Restriction of processing.
• Data portability to another controller.
• Objection to processing based on legitimate interest.
• Withdrawal of consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise your rights, contact us via the contact form.

You also have the right to file a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

Cookies

Our website uses cookies only after you give consent via the banner displayed on your first visit:

• Analytics cookies and signals (Google Analytics 4, Vercel Analytics, and Umami — Umami is cookieless) — used for anonymous analysis of website traffic. They only run after you click "Accept."
• Local storage (localStorage) — we save your cookie consent decision so the banner is not displayed again. This information is not sent to any server.

If you decline cookies, no analytics data will be collected.

Changes to This Privacy Policy

We reserve the right to update this Privacy Policy. We will communicate significant changes via the website. The current version takes effect on the date of publication.

Last updated: March 2026