Privacy policy

General information clause

This Privacy Policy meets the requirements set out in Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: GDPR).

1. Controller of personal data

The controller of your personal data is Magdalena Bednarczyk, running a business under the name Kayomi Clinic, with its registered office at ul. Grochowska 67, Warsaw (hereinafter: the „Controller").

On matters relating to the protection of personal data you can contact us:

• e-mail: kayomi.clinic@gmail.com
• phone: 729 939 111
• address: ul. Grochowska 67, Warsaw

2. What personal data we process

Depending on the purpose, we process the following categories of data:

• Contact details - first name, surname, e-mail address, phone number (provided by you when booking a visit, sending a message or filling in contact forms).
• Data related to a voucher order - the orderer's details, the first name and surname of the person receiving the gift as shown on the voucher, the value and type of voucher, the chosen method of payment and delivery and, in the case of shipping, the recipient's details and delivery address.
• Data related to the purchase of products - the data needed to issue an invoice, handle payment, a return or a complaint, where required in a given case.
• Data contained in a proof of payment - if you voluntarily attach such a file to your order. Please cover your account balance, transaction history and any other information that is not needed to confirm the payment.
• Health data - information about the condition of your skin and your treatment history, necessary to provide cosmetology services.
• Technical data - IP address, device and browser data, cookies and server logs, collected automatically while you use the website.

3. Is providing data obligatory?

Providing personal data is voluntary. However, failure to provide the required data may make it impossible or more difficult to use our services, to answer your question or to conclude a contract.

Consent to marketing contact is entirely voluntary. Withholding it does not affect your ability to order, receive or redeem a voucher.

4. Purposes and legal bases of data processing

We process your personal data for the following purposes:

• Provision of services - arranging and carrying out visits, keeping treatment records. Basis: Article 6(1)(b) GDPR (performance of a contract).
• Accepting and fulfilling a voucher order - preparing the voucher, verifying payment, contact regarding the order and sending it or preparing it for collection. Basis: Article 6(1)(b) GDPR (conclusion and performance of a contract).
• Redeeming the voucher and protection against its unauthorised use - keeping records of issued and redeemed vouchers and handling complaints and claims. Basis: Article 6(1)(f) GDPR (legitimate interest of the Controller).
• Sale of products and complaint handling - conclusion and performance of a sales contract, accepting payment, issuing a sales document, examining complaints and pursuing or defending claims. Basis: Article 6(1)(b) GDPR (performance of a contract), Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interest of the Controller).
• Responding to enquiries - contact through the form, by e-mail or by phone. Basis: Article 6(1)(f) GDPR (legitimate interest of the Controller).
• Direct marketing - sending information about promotions, vouchers, products and services of Kayomi Clinic to the e-mail address or phone number you provide, only after you have given voluntary consent. Basis: Article 6(1)(a) GDPR (consent) and Article 398 of the Polish Electronic Communications Law.
• Fulfilment of legal obligations - issuing accounting documents, storing documentation. Basis: Article 6(1)(c) GDPR (legal obligation).
• Analytics and improvement of the website - traffic statistics, content optimisation. Basis: Article 6(1)(f) GDPR (legitimate interest of the Controller).

5. Recipients of the data

We may share your data with:

• authorised employees and associates of Kayomi Clinic,
• suppliers of IT systems and hosting services with whom we have concluded data processing agreements,
• the e-mail provider through which we handle orders and contact clients,
• the accounting office and providers of systems used for settlements,
• postal operators and courier companies, where this is necessary to deliver an order,
• the appointment booking system (Booksy), in accordance with its own privacy policy,
• providers of analytics and marketing tools - Google (Google Analytics) and Meta Platforms (Meta Pixel) - only after you have consented to the relevant cookies,
• public authorities, where required by applicable law.

We do not sell your personal data and we do not pass client lists to third parties for advertising purposes. Data is shared for marketing purposes solely on the basis of consent given by you, which you can withdraw at any time.

6. Data retention period

We keep your data for as long as it is necessary to fulfil the purposes for which it was collected:

• Treatment documentation - for the period required by law (up to 5 years from the end of the provision of services).
• Data from contact forms - up to 30 days from giving our answer or until the matter is closed.
• Data relating to voucher orders - for the period of fulfilling the order, the validity and settlement of the voucher, and then until any claims become time-barred.
• Data relating to the purchase of products and complaints - for the time needed to complete the sale or examine a complaint, and then until claims become time-barred or for the period required by tax law.
• Attachments with proof of payment - until the payment has been verified, after which they are deleted, unless keeping them longer is necessary to clarify a dispute or defend claims.
• Data used for marketing contact - until consent is withdrawn.
• Accounting documents - for the periods required by tax law (up to 5 years).

6a. Data of the person receiving the gift

We receive the first name and surname of the person receiving the gift from the person placing the order. We use this data solely to prepare, record and redeem the voucher and to protect against its unauthorised use.

The source of this data is the person placing the order. The person receiving the gift may exercise the rights described in point 7 of this Policy.

7. Your rights

In connection with the processing of personal data you have the following rights:

• Right of access - you can request information about what data we hold about you.
• Right to rectification - you can request the correction of inaccurate data or the completion of incomplete data.
• Right to erasure - you can request the deletion of data in the cases provided for by law.
• Right to restriction of processing - you can request the restriction of data processing in specific situations.
• Right to data portability - you can receive your data in a structured format.
• Right to object - you can object to data processing based on the legitimate interest of the Controller.
• Right to withdraw consent - if processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint - you can lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

To exercise the above rights or to withdraw consent to marketing contact, please contact us at the e-mail address: kayomi.clinic@gmail.com. Withdrawing consent does not affect the lawfulness of actions taken before the withdrawal.

8. Cookies

Our website uses cookies.

We use the following types of cookies:

• Essential cookies - necessary for the site to work properly, they do not require consent.
• Analytics cookies - they let us analyse traffic on the site and improve how it works (e.g. Google Analytics). They require your consent.
• Marketing cookies - they make it possible to show tailored ads. They require your consent.

You can change your cookie settings in your web browser at any time or withdraw consent you have given earlier.

Within analytics and marketing cookies we use tools from external providers, which are activated only after you have given your consent:

• Google Analytics (provider: Google Ireland Ltd.) - analysis of traffic and how the site is used. Google privacy policy.
• Meta Pixel (provider: Meta Platforms Ireland Ltd.) - measuring effectiveness and showing tailored ads on Facebook and Instagram. Meta privacy policy.

In connection with the operation of the above tools, your data may be transferred outside the European Economic Area (including to the USA), using the safeguards required by the GDPR. We only use these tools after consent has been given, and you can withdraw it at any time.

Profiling. The advertising tools we use tailor the ads shown to you based on which pages you visited and what you did on them, for example whether you filled in a contact form. This happens only after consent to marketing cookies has been given and you can withdraw it at any time. We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you.

9. Data security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or disclosure. Only authorised persons, bound by confidentiality, have access to the data.

10. Changes to the privacy policy

We reserve the right to change this Privacy Policy. We will inform you of any changes by publishing the updated version on the website with a new effective date.

This Privacy Policy is effective from 1 January 2025 Last updated: 29 July 2026