Privacy policy

Data controller

The controller of your personal data is Tok Shok Studio, Anna Kovalchuk, ul. Piękna 28/34 lok. 53, 00-547 Warsaw. Company details are in the site footer.

For anything related to your personal data, contact us using the details on the Contact page.

What data we collect

• Booking data: first name, last name, phone number, email address. Online bookings are handled by Booksy, which also processes data under its own privacy policy.
• The content of messages you send us via Instagram, WhatsApp, Telegram, phone or email.
• Health questionnaire and treatment consent. This is health data, processed only with your explicit consent to keep the treatment safe.
• Before and after photos. We take and publish them only with your separate consent, without showing your face unless you agree to it.

Purposes and legal bases

• Booking and providing the service: Art. 6(1)(b) GDPR (contract).
• Health questionnaire: Art. 9(2)(a) GDPR (explicit consent).
• Publishing photos: Art. 6(1)(a) GDPR (consent).
• Visit statistics (Google Analytics) and external services on the site (Booksy, Google Maps): Art. 6(1)(a) GDPR (consent) in connection with Art. 399 of the Polish Electronic Communications Law.
• Billing and accounting records: Art. 6(1)(c) GDPR (legal obligation).
• Establishing, pursuing and defending claims: Art. 6(1)(f) GDPR (legitimate interest).

How long we keep data

Service-related data is kept while you use our services and then until the limitation periods for claims and the periods required by tax law expire. Data processed on the basis of consent is kept until you withdraw it.

Health questionnaires and treatment consents are kept on paper at the studio for 10 years.

Who receives the data

Data may be shared only with parties that help us run the studio: Booksy (bookings), the website hosting provider, our accounting office (AnMa Katarzyna Oglęcka), Google (Analytics and maps, only with your consent), and the messaging providers you use to contact us (Meta: Instagram, WhatsApp; Telegram). Some of them may process data outside the European Economic Area under standard contractual clauses or the EU-US Data Privacy Framework.

Cookies and browser storage

On your first visit we ask for consent. Without it the site uses only essential browser storage, and Google Analytics, the Booksy widget and Google Maps are not loaded. You can change or withdraw consent any time via the "Cookie settings" link in the footer. Withdrawal does not affect the lawfulness of earlier processing.

• Essential (no consent needed): in browser storage (localStorage) we keep your chosen language (lang), theme (theme) and your cookie choice (consent). This stays in your browser and is never sent anywhere; clearing the site data removes it.
• Analytics (with consent): Google Analytics 4, provided by Google Ireland Limited. It collects a pseudonymous browser ID, pages visited, traffic source, device and browser type and approximate location (city); IP addresses are not stored. The _ga and _ga_<ID> cookies are kept for up to 2 years, and data in Google Analytics for up to 14 months. Data may be transferred to the USA under the EU-US Data Privacy Framework.
• Online booking (with consent): the Booksy booking widget (Booksy International sp. z o.o.). Once loaded, Booksy receives your IP address and browser data and may set its own cookies under its privacy policy. Without consent the booking button opens Booksy in a new tab.
• Maps (with consent): Google Maps showing the studio location (Google Ireland Limited). Once loaded, Google receives your IP address and browser data and may set its own cookies under its privacy policy. You can also show the map with the "Show map" button; that consent covers maps only.

Do you have to provide data

• Providing data is voluntary, but without your name and phone number we cannot book an appointment.
• Filling in the health questionnaire and the treatment consent is a condition of the treatment. Without them we cannot perform it safely, so we will not perform it.
• Invoice details are required by tax law if you ask for an invoice.
• Consent to photos, analytics, the Booksy widget and Google Maps is voluntary. Refusing it does not affect the service.
• We do not make decisions based solely on automated processing, including profiling (Art. 22 GDPR).

Your rights

• Access your data and get a copy.
• Rectification, erasure or restriction of processing.
• Data portability.
• Objection to processing based on legitimate interest.
• Withdrawal of consent at any time, without affecting the lawfulness of earlier processing.
• A complaint to the President of the Personal Data Protection Office (uodo.gov.pl).