This Privacy Policy describes how personal data of visitors to thearchstudio.pl (the „Site") is processed, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Polish Act on Providing Electronic Services of 18 July 2002.
The Polish-language version of this Privacy Policy available at /polityka-prywatnosci is the legally binding version. This English version is provided for informational convenience only.
1. Data controller
The data controller is The Arch Studio Sp. z o.o., with its registered seat at ul. Kazachska 3/154, 02-972 Warszawa, Poland, Tax ID (NIP) 9512646477 (the „Controller").
Contact regarding personal data: biuro@thearchstudio.pl, phone +48 577 010 299.
2. Scope of data processed
The Controller processes only data voluntarily provided by the User:
- contact details (name, email address, phone number) provided in email or telephone correspondence with the salon;
- data stored in cookies set by the Instagram embed component used on the Site (see Section 7).
The Site does not contain its own booking form — appointments are made on the external Booksy platform, operated (and acting as a separate data controller) by Booksy International Sp. z o.o.
3. Purposes and legal bases
- responding to inquiries directed to the salon — Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest of the Controller);
- compliance with legal obligations (accounting, taxes) — Art. 6(1)(c) GDPR;
- marketing of the Controller's own services — Art. 6(1)(f) GDPR;
- ensuring the security of the Site — Art. 6(1)(f) GDPR.
4. Data retention
- email and phone correspondence — up to 3 years from last contact or until consent is withdrawn;
- data processed in connection with tax and accounting obligations — for the period required by law (usually 5 years);
- data processed on the basis of consent — until consent is withdrawn.
5. Recipients of data
- Meta Platforms Ireland Ltd. — through cookies and data transmitted by the embedded Instagram component and social media buttons;
- Booksy International Sp. z o.o. — as a separate data controller if the User follows the link to the booking platform;
- accounting firm and IT service providers cooperating with the Controller on the basis of data processing agreements.
6. Transfers outside the EEA
Data transmitted to Meta Platforms (Instagram, Facebook) may be processed in the United States. Transfers are carried out under the European Commission's adequacy decision regarding the EU–U.S. Data Privacy Framework or, where applicable, under Standard Contractual Clauses (SCC) approved by the European Commission.
7. Cookies
The Site uses only cookies necessary for the proper functioning of the website and cookies set by Instagram in the section displaying posts from the salon's profile. The Site does not use any analytics or advertising tools such as Google Analytics or Meta Pixel.
The User may change cookie settings in their browser or withdraw consent given in the cookie banner at any time. Disabling Instagram cookies may cause the embedded section to render incorrectly.
8. Rights of the data subject
The User has the following rights:
- right of access to their data and to obtain a copy;
- right to rectification of inaccurate data;
- right to erasure („right to be forgotten");
- right to restriction of processing;
- right to object to processing;
- right to data portability;
- right to withdraw consent at any time (without affecting the lawfulness of processing carried out before withdrawal);
- right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).
To exercise these rights, please contact the Controller at biuro@thearchstudio.pl.
9. Voluntary nature of providing data
Providing personal data is voluntary; however, failure to provide it may prevent the Controller from responding to an inquiry or providing the requested services.
10. Changes to the Privacy Policy
The Controller reserves the right to make changes to this Privacy Policy. The current version is always available on the Site, indicating the date of the last update.