Privacy Policy

1. Controller

The controller is Tomasz Antoniszyn prowadzący działalność gospodarczą pod firmą SPEC Tomasz Antoniszyn, ul. Wejherowska 61/1, 54-239 Wrocław, VAT ID: PL8943177673, REGON: 520636669. Privacy contact: spec.tomasz.antoniszyn@gmail.com, +48 451 039 757.

2. Data we process

• Contact and booking data: name, email address, phone number, selected studio, date, additional services and notes.
• Company and invoice data, if an invoice is requested.
• Payment details and correspondence with the customer.
• Technical and security data, including IP address, system logs and information processed by Cloudflare Turnstile.
• Analytics and marketing information collected by Google Analytics and Meta Pixel, but only after the user has given consent.

3. Purposes and legal bases

• Handling a request and entering into and performing the booking agreement — Article 6(1)(b) GDPR.
• Invoicing and compliance with accounting and tax obligations — Article 6(1)(c) GDPR.
• Service security, correspondence, complaints and the establishment or defence of claims — Article 6(1)(f) GDPR, based on the Controller's legitimate interests.
• Analytics, marketing measurement and newsletter communication — Article 6(1)(a) GDPR, only where separate, voluntary consent has been given.

4. Recipients and transfers

Data may be processed by authorised staff and providers of hosting, backups, email, form protection, accounting, analytics and marketing services. These currently include SkillHost.pl, Resend, Cloudflare, Google Workspace and wFirma. If analytics or marketing tools are enabled with the user's consent, data may also be processed by Google and Meta.

Some providers may process data outside the European Economic Area on the basis of a European Commission adequacy decision or safeguards such as standard contractual clauses. Information about the safeguards can be obtained from the Controller.

5. Retention

• Booking, payment and correspondence data: for the time needed to perform and account for the agreement and until related claims expire.
• Invoice and accounting data: for the period required by law.
• Unpaid or cancelled requests: up to 3 years after closure.
• Security logs: up to 2 years; backups: according to the backup schedule, up to 90 days.
• Analytics and marketing data: until consent is withdrawn or for the period configured in the relevant service, whichever occurs first.

6. Your rights

You may request access, rectification, erasure, restriction, portability or object to processing. Where processing is based on consent, you may withdraw it at any time without affecting earlier processing. You may also lodge a complaint with the President of the Polish Personal Data Protection Office.

Providing required booking data is necessary to handle the request. Without it, a booking cannot be submitted. Invoice data is required only if an invoice is requested.

7. Cookies and automated decisions

The website uses technical solutions necessary for operation and security, including Cloudflare Turnstile. Google Analytics and Meta Pixel may be enabled only after the user has given consent in the cookie settings. Consent can be changed or withdrawn at any time by reopening those settings.

Customer data is not used for profiling or solely automated decisions that produce legal or similarly significant effects.