Privacy policy

• From the booking form: your name, phone number and the location you chose.
• From the franchise form: your name, email address and city.
• Phone-click event: we record the click itself together with the source of your visit — without a name or number, which we do not have at that point.
• Traffic source data: campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), ad click identifiers (gclid, fbclid), the address of the page you landed on and the referring website.
• Technical connection data: the approximate city and country determined by Cloudflare from your IP address, and whether you are on a phone or a computer.

We never ask for documents or payment details through this website. You pay for your visit at the salon.

• Booking and confirming your visit — GDPR Article 6(1)(b): steps taken at your request before entering into a contract.
• Answering a franchise enquiry — GDPR Article 6(1)(b).
• Measuring advertising performance and visit statistics — GDPR Article 6(1)(a): your consent given in the cookie banner, withdrawable at any time.
• Keeping a record of enquiries — GDPR Article 6(1)(f): our legitimate interest in not losing a booking and being able to evidence it.

We do not sell data and do not pass it to anyone for their own purposes. Access is limited to service providers acting on our instructions:

• Cloudflare, Inc. — website hosting, attack protection and approximate location from your IP address;
• Telegram Messenger Inc. — new bookings are delivered to the team chat;
• Google Ireland Ltd. — the enquiry log spreadsheet (Google Sheets) and, where you have consented, advertising performance measurement (Google Tag Manager, Google Ads);
• CARTO (CARTO DB Inc.) and Unpkg / Cloudflare — map tiles and the map library; their servers see your IP address when the map loads;
• Google Ireland Ltd. (YouTube) — a fallback video player in youtube-nocookie mode, used only if our own video file fails to load.

Some of them may process data outside the European Economic Area. Such transfers rely on the European Commission’s Standard Contractual Clauses (SCC).

Booking and franchise enquiry data is kept for up to 24 months from your last contact. Traffic source markers stored in your browser after you consent expire after 90 days. If you ask us to delete your data sooner, we will do so within 30 days — except where the law requires longer retention, such as accounting records.

You have the right to access your data, correct it, delete it, restrict processing, object to it and receive it in a portable format. Consent for marketing cookies can be withdrawn at any time — clear the site data in your browser and the banner will appear again.

If you believe we are infringing your rights, you may lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland.

Until you consent, nothing is written to your browser for marketing purposes. Google Tag Manager runs in a restricted mode (Consent Mode v2): tags set no cookies and only anonymous signals without identifiers reach Google.

Without consent we store just two things, both necessary for the site to work: your choice in the banner (so we do not ask again) and Cloudflare’s technical protection mechanisms.

Once you consent, these are added: Google Ads and Google Tag Manager cookies used to measure conversions, and a traffic source marker stored in your browser (the unlmtd_mk key, valid for 90 days) — it tells us which ad brought a client in, even if they booked on a later visit to the site.