Legal
Privacy policy regarding the processing and protection of users’ personal data
02.01.2024 · edition for alvaline.pl — 15.10.2026
This Privacy Policy regarding the processing and protection of users’ personal data (hereinafter referred to as the “Policy”) has been adopted and is valid at ALVALINE Sp. z o.o. (hereinafter referred to as the “Company” or “we”). The administrator of personal data is ALVALINE Sp. z o.o., NIP 5273052056, address: ul. Złota 75A m7, 00-819 Warszawa; tel. +48 512 811 211, e-mail: info@alvaline.pl. The collection, use and storage of personal data that you provide to us when using our websites and mobile applications (“Sites”) from any device and when communicating with us in any form and in accordance with this Policy and by the Regulation of the European Parliament and Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, and by the provisions of the Act of 10 May 2018 on the protection of personal data (Journal of Laws of 2018, item 1000). By using our Sites and providing us with your personal data, you consent to the processing of your personal data in accordance with this Policy.
01
1. Key definitions
“Personal data” – information about an identified or identifiable natural person (data subject). “Personal data processing” – operations or a set of operations performed on personal data or sets of personal data in an automated or non-automated manner, such as collecting, recording, organizing, structuring, storing, adapting or modifying, downloading, viewing, using, disclosing by sending, distributing or otherwise making available, aligning or combining, restricting, deleting or destroying.
02
2. Data we collect
We process: personal data provided to us when filling out information fields on our websites, including when filling out the contact form, subscribing to our newsletter, registering for events (webinars, conferences); personal data provided when purchasing services offered by the Company, as well as for the purpose of concluding a contract; personal data that are necessary for the proper and safe provision of cosmetology services, namely information about health, diseases, pregnancy, allergies and other information that an appropriate specialist asks for in a specific situation in order to perform a cosmetology treatment or procedure; technical data that is automatically transmitted by the device through which you access our Sites, including device specifications, IP address; information stored in cookies. Depending on the browser and device used, different sets of cookies are used, including strictly necessary, performance, functional and analytical cookies; personal data we process when the user signs in to the personal account on the website: the phone number (to sign in with a one-time code) and the information the account displays from our online booking and subscription records — name, upcoming and past visits for the last 12 months (date, services, specialist, centre, status), subscriptions (type, remaining visits, validity) and bonus balance; for participants of the referral programme — the participant’s personal code, information about bookings made with that code, and the participant’s choice whether to show their first name on the invitation page; personal data that we collect via video surveillance during a visit to our beauty service center.
03
3. Purposes of personal data processing
We process personal data only for the purposes for which they were provided, including: providing you with information about the Company, our services and events and sending you our news. E-mails are only sent with the user’s voluntary consent. Together with e-mails with information materials, you will always receive a link from us with the option to unsubscribe from receiving messages. If you select this option, your email address will be removed from our database and no further information will be sent; communicating with you when you contact us; providing services to you in accordance with our services agreement, website analytics; conducting our marketing activities towards the user in connection with ongoing and future contracts; providing the personal account (sign-in with a one-time SMS code, viewing one’s bookings, subscriptions and bonuses) and running the referral programme (issuing a personal link and code and recording bookings made with them so that the centre’s administrator can credit bonuses under the Referral Programme Rules); contacting the user for purposes related to permitted marketing activities, in particular and with the user’s consent, by e-mail. For example, in order to answer a question asked in the contact form, sending an email in the form of a newsletter informing about current events in the Company, promotions and news. We monitor both for your personal safety and the safety of our employees, customers and property. Monitoring is carried out in public places in accordance with strict security and privacy rules, using the latest technology and equipment. Areas covered by monitoring are marked with appropriate information signs. The user will be informed separately about the conditions for processing personal data for purposes about which the user has not been informed in this Policy. We do not make any decisions that create legal effects for you or otherwise affect your rights and legitimate interests based solely on automated processing of personal data.
04
4. Legal basis for the processing of personal data
We process personal data if one of the following conditions is met: the user has consented to the processing of his or her personal data; the processing of personal data is necessary for the performance or conclusion of a contract; the processing of personal data is necessary to fulfill legal obligations imposed on us by regulations (e.g. to provide information to the head of the tax office); the processing of personal data is necessary to secure our legitimate interests (e.g. we carry out monitoring to ensure the security of our property, we can also apply to court for debt collection, etc.); data processing is necessary to protect the vital interests of the user or another natural person. Personal account and referral programme: the data are processed to perform our contract with the user — providing services and applying the Referral Programme Rules the user joins (Art. 6(1)(b) GDPR); the referrer’s first name is shown to the invited person only with the referrer’s consent, which is given and withdrawn with a switch in the personal account (Art. 6(1)(a)). A booking made by an invited person is marked as referred on the basis of our legitimate interest in crediting bonuses correctly (Art. 6(1)(f)); the centre’s administrator sees the referrer’s first name, the initial of the surname and the last four digits of the phone number, while the full number is available only to an authorised employee in the website’s administration system. Offers and news (optional). If you ticked "I would like to receive ALVALINE offers and news", we send you news about services, offers and promotions of ALVALINE centres by email and SMS, to the address and number given in the form. The legal basis is your consent (Art. 6(1)(a) GDPR); it is not a condition of booking. We keep a record of the consent — date and time, the wording of the tick box, the page and form. Before the first mailing we may ask you to confirm by a link. You can withdraw consent at any time via the link in every message (/mail-prefs page) or by writing to info@alvaline.pl; withdrawal does not affect the lawfulness of earlier messages. We keep your contact for mailings while consent is valid; after withdrawal we keep only an opt-out marker (a pseudonymised identifier of the number/address) so we do not write to you again, and the record of the past consent — 3 years.
05
5. General principles of personal data processing
The company ensures the processing of personal data in accordance with the following principles: limiting the purpose of data processing – personal data is processed only for the purpose of processing and using data specified in this document or for the purposes of activities to which the data subject has consented; data quality and proportionality – personal data are processed as correctly as possible and updated when necessary. Personal data is current, relevant and collected in quantities no larger than necessary, taking into account the purpose of processing; transparency – the purposes of data processing should be clear to the data subject; security – when processing data, we use technical and organizational security measures appropriate to the risk, e.g. measures to prevent accidental or unlawful destruction of data, changes, unauthorized disclosure or access; minimization – personal data is regularly reviewed to remove data that is no longer necessary to achieve the purpose of processing.
06
6. Security of personal data
To ensure the security of personal data during their processing, we take necessary and sufficient legal, organizational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, sharing, dissemination, as well as against other unlawful activities related to personal data.
07
7. Confidentiality/transfer of personal data
Information about the user’s personal data will not be included in publicly available sources and will not be disclosed to third parties, unless the Company obtains the user’s express consent or this information is required by applicable law. If necessary, your personal data may be disclosed to public authorities and law enforcement agencies in order to protect our legitimate interests. In order to fulfill our obligations towards you, we may also transfer your personal data to our cooperating partners: data processors that carry out the necessary data processing on our behalf, e.g. IT infrastructure maintenance specialists, marketing agencies, leasing companies, courier companies, etc. Companies these, in accordance with applicable laws and regulations of Polish law and our cooperation agreement, are obliged to protect the user’s personal data and process them only for the purposes specified by us. Data recipients and transfers outside the EEA. The user’s personal data are received by: Google Ireland Ltd (Google Analytics 4, Google Ads, Google Tag Manager – only after consent in the cookie banner; the embedded Google map on pages showing a centre’s address); Meta Platforms Ireland Ltd (Meta Pixel and Conversions API – only after consent in the cookie banner: for a booking or request made on the website, and later for the confirmation, visit and payment of that booking, our server sends Meta, in the form of a SHA-256 hash, the phone number, email address, first and last name, country and internal customer identifier, as well as the IP address, browser data and ad click identifiers – to measure the results of advertising; WhatsApp – the phone number and the correspondence: an administrator replies on WhatsApp to a request in which the user has themselves asked to be contacted this way); Microsoft Ireland Operations Ltd (Microsoft Clarity – session recordings and heatmaps, only after consent, form input is masked); Anthropic PBC, USA (the text of a message to the website assistant together with information about the page being viewed and the contents of the order, and a downscaled copy of the face photo that the user sends to the assistant chat after ticking the consent box – only upon the user’s explicit action; the photo is not stored); Altegio (online booking system: name, phone, e-mail, contents of the visit); Kommo (CRM: the enquiry in full); Telegram Messenger Inc. (the Telegram messenger: a notification to administrators about a new enquiry or booking – name, phone, e-mail and the text of the request – is delivered to a closed staff chat of the network and stored on Telegram’s servers); Fromni Oy, Finland (sending the SMS with the one-time sign-in code for the personal account: phone number and the text of the message with the code; no marketing messages are sent through this service). Transfers to the USA are made on the basis of the EU standard contractual clauses (Article 46 GDPR) and/or the EU-US Data Privacy Framework in the case of certified recipients.
08
8. Rights of the data subject
The User has the right to view, rectify, update, object or otherwise modify or delete the information provided to the Company. For this purpose, the user may contact us by sending a message with the subject “Question regarding personal data” or “Withdrawal of consent to the processing of personal data” (in the event of withdrawal of consent to the processing of personal data) to the e-mail address info@alvaline.pl. If you request the deletion of your information, we will delete your personal data immediately because respecting your rights is our priority. Unfortunately, we will not be able to delete your personal data if we are required to retain it by law. How to submit a request: write to info@alvaline.pl from the phone number or e-mail address given when you contacted us – this is how we make sure the request comes from the data subject. We reply within 30 days at the latest. Upon an erasure request, the data are removed from the website database, the CRM and the staff notification chat; from the online booking system and accounting records – to the extent permitted by law.
09
9. Storage period
All personal data collected from you will be stored for as long as you use our services or, if your personal data is processed on the basis of your consent, until you withdraw this consent. Longer retention periods for personal data are permitted in order to comply with legal requirements regarding minimum retention periods for documents or information or to protect our legitimate interests. (including, in particular, for the purposes of accounting or legal proceedings). Specific periods: enquiries and consultation requests left on the website – until consent is withdrawn; the text of messages to the website assistant – anonymised (erased) after 180 days, while service data about the conversation (city, language, date) remain without any link to a person; personal account sign-in codes – 24 hours; data on clicks of the booking button (without name or phone) – 12 months; database backups – up to 60 days; web server logs with the IP address – 14 days. Data in the online booking system and in accounting records are kept for the periods laid down by law. Requests for follow-up without a booking: if the user entered a phone number and ticked consent in the online booking window or in the booking card in the website assistant chat but did not press “Book now” (unfinished booking), left a phone number or email address on the waiting list for free time, or asked for the calculation of a treatment set to be sent via WhatsApp or by email, we keep this contact, the name (if entered) and what was selected – treatments, centre, time – solely to follow up on that request, including via WhatsApp. Like any other request, such requests are passed to the CRM (Kommo) and to the administrators’ internal chat. If we could not reach the user, the phone number, name and email address are deleted from the website database after 30 days or, if by that time an administrator is still handling the request, immediately after the request is closed. Opting out is simple: do not tick consent; data already saved will be deleted on request (section “Rights of the data subject”). Personal account: one-time sign-in codes — 24 hours; the sign-in cookie — 30 days (until the browser is closed if “someone else’s device” is chosen); the service record used for “sign out on all devices” — 12 months after the last sign-in. The account does not store visits, subscriptions or bonuses on the website: they are retrieved from the booking system when viewed. Referral programme: the participant’s personal code — while the participant uses the programme, but no longer than 24 months without bookings made with the code, or until a deletion request; records of bookings made with the code — 12 months from the visit date; the invitation code in the invited person’s browser — up to 60 days or until a booking is made. Once the purpose for processing your personal data has been achieved, we will securely delete your personal data or make it inaccessible (by archiving) or unidentifiable so that it can no longer be associated with you.
10
10. Cookies
We use cookies. More information on cookie policy and technical issues can be found in the relevant section. A strictly necessary session cookie is used to sign in to the personal account; it is not used for analytics or advertising and does not require consent in the cookie banner. Microsoft Clarity session recording does not run on personal account pages.
11
11. Change of privacy policy
The policy is subject to change without prior notice. The modified version of the Policy published on the Website replaces all previous versions of the Policy. Any changes do not affect the Company’s general policy regarding compliance with the rights of the personal data subject.