Privacy Policy (GDPR)

1. Personal Data Controller

The controller of the personal data of users of the website https://studiodewi.pl is:

Milena Mysera, operating under the business name Milena Mysera “DEWI”, located at Aleja Zygmunta Krasińskiego 24A, 30-101 Kraków; Tax ID (NIP): 7282619983; Statistical ID (REGON): 360764218. The entity is registered in the Central Register and Information on Economic Activity (CEIDG), maintained by the Minister of Economic Development and Technology. Email address: biuro@studiodewi.pl

2. Voluntary Provision of Data

Clients provide their personal data on a voluntary basis. However, failure to provide such data may make it impossible to fulfill a service or to communicate with Studio Dewi.

3. Purposes and legal bases for data processing

Personal data is processed for the following purposes: providing services offered by the Website,

handling inquiries submitted via the contact form,

processing orders and payments for services (e.g., vouchers),

marketing activities, subject to the user's consent,

maintaining accounting and tax records,

keeping a register of client reservations and visits,

sending commercial information by electronic means (subject to the user's consent).

4. Scope of processed data

The data processed may include: full name,

email address,

phone number,

shipping address (in the case of voucher delivery),

health-related data (only with the client's consent and to the extent necessary for the provision of massage services),

history of services used at Studio Dewi.

5. Data recipients

Data may be shared with entities cooperating with the Controller, such as: online payment service providers (e.g., Przelewy24.pl, iMoje),

courier and postal service providers (in the case of shipping vouchers),

IT service providers, accountants, and law firms,

entities that manage reservation systems and email marketing platforms,

public authorities, if such an obligation arises from legal regulations.

6. Data retention period

Personal data will be stored for a period: no longer than is necessary for the provision of the service,

in the case of data processed based on consent – until such consent is withdrawn,

for accounting and tax purposes – for the period required by law (typically 5 years).

7. Rights of the data subject

The data subject has the following rights: the right to access their data,

the right to rectify their data,

the right to erase their data (the right to be forgotten),

the right to restrict processing,

the right to data portability,

the right to object to processing,

the right to withdraw consent at any time, if the processing was based on such consent.

8. Complaint to a supervisory authority

The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO) if they believe that the processing of their data violates the provisions of the GDPR.

9. Data security

The Controller implements appropriate technical and organizational measures to ensure the security of the personal data being processed, specifically to prevent unauthorized access or processing in violation of the law.

The Controller regularly tests, measures, and evaluates the effectiveness of the security measures in place.

Personal data is encrypted during transmission using the SSL protocol.

10. Automated decision-making and profiling

Customers' personal data will not be subject to automated decision-making, including profiling, that produces legal effects concerning the Customer or similarly significantly affects them.

The Controller may use profiling for marketing and analytical purposes; however, this will not serve as a basis for automated decision-making regarding the Client.