Privacy policy

Bober Beauty · Kraków-Kazimierz

1. Who is the data controller

The controller of your personal data is Bober Beauty, ul. Przemyska 4/1, 31-036 Kraków, Poland. For anything concerning personal data, write to kontakt@boberbeauty.pl.

We have not appointed a Data Protection Officer — please use the address above for all matters.

2. What we collect on this site

What	Why	Legal basis	How long
Statistics from Google Analytics 4 (anonymised IP address, device, traffic source)	To see which pages help and which do not	Your consent — Art. 6(1)(a) GDPR	14 months, or until you withdraw consent
Ad click identifiers (gclid, gbraid, wbraid, fbclid) and UTM parameters	To check which ads actually bring clients, so we stop paying for the ones that do not	Your consent — Art. 6(1)(a) GDPR	90 days
Data from the calendar booking form: first name, phone, service, stylist, time, notes	To accept the request, confirm the time by SMS and carry out the visit	Steps at your request before a contract — Art. 6(1)(b) GDPR	Up to 12 months from sending the form in the active mailbox, then the Gmail bin (permanently deleted within 30 days)
Your email address or Instagram handle, if you choose to enter it in the try-on to save a design	To send you the saved manicure, brow or lash design	Your consent — Art. 6(1)(a) GDPR	Until you withdraw consent, no longer than 24 months
The photo of your hand in the virtual try-on	Only to show you the colour on your own hand	We do not process it — see the box below	Never stored

The try-on photo never leaves your phone. All image processing happens in your browser, on your device. The photo is not uploaded to our server, not stored by us and not shared with anyone. Close the tab and it is gone.

To recognise the nails, your browser downloads the MediaPipe model (Google's open-source library) from a content delivery network — only at the moment you add a photo yourself, never before. What travels is the model file; your photo goes nowhere. During that download the CDN sees your IP address, the same as with any file fetched from a website.

3. Booking an appointment

The calendar on this site. When you send a booking request in our calendar you give your first name, phone number, the chosen service, stylist and time, and optional notes. The form is run by Netlify, Inc.; the request goes to the salon's mailbox and we confirm the time by SMS via SMSAPI (LINK Mobility Poland sp. z o.o.). We process this data to accept and confirm your booking and carry out the visit (Art. 6(1)(b) GDPR — steps at your request before a contract), and accounting data for as long as the law requires (Art. 6(1)(c) GDPR). We keep a request in the active mailbox for up to 12 months from the moment the form was sent; then it goes to the Gmail bin, from which it is permanently deleted within 30 days. The copy in the Netlify form system is deleted within the same period. Ad click identifiers and UTM parameters are attached to a request only if you accepted them earlier in the cookie window — without consent the request is sent without them.

Booksy. You can also book through Booksy (Booksy International sp. z o.o.). Then it is Booksy that collects your name, phone number and email under its own privacy policy. We see that data afterwards, in the salon calendar, and use it only to carry out your visit (Art. 6(1)(b) GDPR) and for accounting (Art. 6(1)(c) GDPR).

4. Who we share data with

Google Ireland Ltd. — Google Analytics and Google Ads: limited measurement without cookies before your choice, full measurement after you accept
Netlify, Inc. — site hosting, the calendar booking form and the design-saving form
LINK Mobility Poland sp. z o.o. (SMSAPI service) — sending the SMS that confirms your time
Booksy International sp. z o.o. — the booking system
Our accounting office — for accounting documents only

Google and Netlify may process data outside the European Economic Area. This happens under standard contractual clauses approved by the European Commission.

We do not sell your data. We do not profile you in a way that produces legal effects for you, and we make no automated decisions about you.

5. Cookies

Without your consent we store no analytics or advertising cookies. The Google scripts load right away, but until you make your choice they run in a limited mode: they store no cookies and send only the data listed below.

Essential — remembering your choice in the consent box. Without it we would ask you every visit.
Analytics and advertising (Google Analytics 4, Google Ads) — we store cookies only after you tap "Accept". Before you choose, we send Google limited data without cookies: a timestamp, browser type, page address and your consent choice. The page address may include the ad click parameter — Google Analytics uses it for approximate traffic source measurement. Google Ads strips the click identifier from its own requests.

You can withdraw consent at any time — right here, or with the "Cookie settings" link in the footer of the home page. Withdrawal does not affect the lawfulness of processing carried out before it.

6. Your rights

You have the right to access your data, rectify it, erase it, restrict processing, port your data, object to processing, and withdraw consent at any moment. Write to kontakt@boberbeauty.pl — we reply within one month at the latest.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, Poland.

7. Do you have to give us data

No. Providing data is entirely voluntary. Without cookie consent the site works exactly the same — you can browse the offer, use the try-on and book a visit.

← Back to the main page