Privacy policy

Last updated: [publication date]

Draft document. Before publishing, fill in the details in square brackets and have a lawyer review it. This is an informational translation; the Polish version is binding.

1. Data controller

The controller of your personal data is [full company name], [registered address], NIP [number], REGON [number] (the Studio or Artberry). For anything about your personal data, write to [email] or call [phone].

2. What data we process, why, and on what basis

Booking form, phone, email, WhatsApp

Data: name, phone, email, description of the idea, placement and size, reference photos, preferred date
Purpose: answering your request, quoting, arranging a date
Legal basis (GDPR): Art. 6(1)(b) — steps taken at your request before entering into a contract

The service at the Studio

Data: booking data, visit history; for a minor, the parent’s or guardian’s details
Purpose: performing the contract, aftercare, corrections
Legal basis (GDPR): Art. 6(1)(b)

Health questionnaire before a procedure

Data: health information (e.g. allergies, medication, pregnancy, skin conditions)
Purpose: checking contraindications and keeping the procedure safe
Legal basis (GDPR): Art. 9(2)(a) — your explicit consent

Academy application

Data: name, contact details, experience
Purpose: admission and agreeing course terms
Legal basis (GDPR): Art. 6(1)(b)

Buying a gift card

Data: buyer’s name, email and phone; recipient’s name and email; message; invoice details
Purpose: selling and delivering the card, handling its redemption
Legal basis (GDPR): Art. 6(1)(b)

Invoices and accounts

Data: data in accounting records
Purpose: tax and accounting duties
Legal basis (GDPR): Art. 6(1)(c)

Data: email address
Purpose: sending news and offers from the Studio
Legal basis (GDPR): Art. 6(1)(a) — your consent

Publishing photos of work

Data: your image, or a photo of the body area with the finished work
Purpose: portfolio on the website and social media
Legal basis (GDPR): Art. 6(1)(a) — your separate consent

Pursuing or defending claims

Data: the data a given matter needs
Purpose: protecting the Studio’s rights
Legal basis (GDPR): Art. 6(1)(f) — legitimate interest

We publish photos of your work only with your consent. You can withdraw consent to the health questionnaire, the newsletter or photo publication at any time; withdrawal does not affect the lawfulness of processing before it.

3. Payments

Online payments are handled by [payment provider], an independent controller of payment data. The Studio never receives or stores your card details.

If you write to us on WhatsApp or Instagram, Meta Platforms Ireland Ltd. also processes your data as an independent controller, under its own privacy policies. We do not embed these services’ plugins on the website — we only link to them.

5. Who receives the data

Data may be received by companies that process it on our behalf: hosting provider [name], email provider [name], payment provider [name], booking system [name], accounting office [name] — only as far as their services require and under data processing agreements. We share data with public authorities only when the law requires it.

6. Transfers outside the European Economic Area

We process data within the EEA as a rule. Where a provider processes data outside the EEA, it does so under a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework) or standard contractual clauses.

7. How long we keep data

requests that did not lead to a visit — up to [6] months after the last contact;
client data and service history — while we provide services, then until claims become time-barred;
health questionnaires — [period to be set];
accounting records — for the period tax law requires, as a rule 5 years from the end of the calendar year in which the tax payment was due;
newsletter and portfolio photos — until you withdraw consent.

8. Your rights

You have the right to access your data (Art. 15 GDPR), rectify it (Art. 16), erase it (Art. 17), restrict processing (Art. 18), data portability (Art. 20), object to processing based on legitimate interest (Art. 21) and withdraw consent (Art. 7(3)). To use these rights, write to [email].

You may also lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa.

9. Do you have to give us data

Giving data is voluntary, but without contact details we cannot answer your request, book a visit or sell a gift card. Without the health questionnaire we may decline a procedure for safety reasons.

10. Automated decisions

We do not make decisions based solely on automated processing, including profiling.

11. Cookies

Cookies and browser storage are described in the Cookie policy.

12. Changes

We will announce material changes to this policy on the website. The current version applies from the date shown at the top.