PRIVACY POLICY

and information regarding the processing of personal data (GDPR)

Effective date: 11.06.2026
Data Controller: EPIL STUDIO MARIIA ZABOLOTNA
Address: ul. Poznańska 8/U2, 30-012 Kraków
NIP (Tax Identification Number): 6793220632
E-mail: epilstudio2025@gmail.com
Phone: +48 698 272 746
Website: https://epil-studio.pl

§1. General Information

This Privacy Policy defines the rules for processing and protecting the personal data of users who use the website operated by the Data Controller, in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);
• the Act on the Provision of Electronic Services;
• the Telecommunications Law;
• and other applicable provisions of Polish and European law.

The Data Controller exercises special care to protect users’ privacy and the security of personal data provided.

§2. Scope of Collected Data

The Data Controller may process the following personal data of users:

• first and last name;
• telephone number;
• e-mail address;
• content of messages submitted through the contact form;
• IP address;
• technical information about the device and browser;
• data related to website usage;
• data stored in cookies.

Providing personal data is voluntary; however, it may be necessary for communication, booking consultations, or providing services.

§3. Purposes of Data Processing

Personal data may be processed for the following purposes:

1. Contacting users and responding to messages sent via the contact form.
2. Scheduling consultations and appointments.
3. Handling inquiries regarding cosmetology services.
4. Conducting marketing communications — only after obtaining appropriate consent.
5. Carrying out advertising and analytical activities.
6. Improving website performance and functionality.
7. Establishing, pursuing, or defending legal claims.
8. Fulfilling obligations arising from applicable laws.

§4. Legal Basis for Data Processing

Personal data is processed based on:

• Article 6(1)(a) GDPR — user consent;
• Article 6(1)(b) GDPR — actions necessary to conclude or perform a service agreement;
• Article 6(1)(c) GDPR — compliance with a legal obligation;
• Article 6(1)(f) GDPR — the legitimate interests of the Data Controller.

§5. Contact Form

Completing the contact form requires providing data necessary for communication.

Data submitted through the contact form is used solely for handling the inquiry and contacting the user.

§6. Marketing and Advertising

The Data Controller may conduct advertising activities using tools such as:

• Google Ads;
• Facebook / Instagram Ads;
• Google Analytics 4.

For this purpose, cookies and tracking technologies may be used to analyze the effectiveness of advertising campaigns and tailor marketing content.

Data is used exclusively in accordance with applicable laws and after obtaining any required user consent.

§7. Google Analytics 4

The website uses Google Analytics 4, an analytics tool provided by Google Ireland Limited.

Google Analytics enables analysis of how users interact with the website, including:

• number of visits;
• traffic sources;
• time spent on the website;
• user behavior.

Data may be transferred outside the European Economic Area in accordance with GDPR-compliant mechanisms used by Google.

More information:
Google Privacy Policy

§8. Google reCAPTCHA

The website uses Google reCAPTCHA to protect forms against spam and automated bot activities.

The use of reCAPTCHA involves analyzing user behavior on the website.

The service is provided by Google Ireland Limited.

§9. Google Maps

Google Maps may be embedded on the website to present the location of the clinic or service point.

Google may process user data in accordance with its own Privacy Policy.

§10. Booksy

The website may contain links or redirects to the Booksy booking system.

Reservations made through Booksy are subject to the privacy policy of the provider of that platform.

§11. Social Media

The website may contain links to the Data Controller’s social media profiles, including:

• Facebook;
• Instagram.

Accessing these services is subject to the rules and policies established by their respective owners.

§12. Before / After Photos

The Data Controller may publish photographs showing treatment results only:

• without the possibility of identifying an individual;

or

• after obtaining the client’s voluntary and explicit consent.

The publication of images is carried out in accordance with applicable legal regulations.

§13. Data Recipients

Personal data may be transferred to entities cooperating with the Data Controller only to the extent necessary to provide services, including:

• hosting providers;
• IT service providers;
• analytics and marketing tool providers;
• e-mail service providers;
• technical support providers.

§14. Data Retention Period

Personal data is retained for the period:

• necessary to achieve the purpose of processing;
• required by applicable law;
• until consent is withdrawn;
• or until an effective objection to processing is submitted.

§15. User Rights

Users have the right to:

• access their personal data;
• rectify their data;
• erase their data;
• restrict processing;
• data portability;
• object to processing;
• withdraw consent;
• lodge a complaint with the President of the Personal Data Protection Office (UODO).

§16. Cookies

The website uses cookies for the purpose of:

• ensuring proper website functionality;
• statistical analysis;
• marketing activities;
• improving user experience.

Detailed information regarding cookies is provided through the cookie consent management system (Complianz).

§17. Data Security

The Data Controller applies appropriate technical and organizational measures to protect personal data against:

• loss;
• destruction;
• unauthorized access;
• disclosure;
• modification.

§18. Changes to the Privacy Policy

The Data Controller reserves the right to make changes to this Privacy Policy.

The current version of the document is published on the website.