1. GENERAL PROVISIONS
1.1. This Privacy Policy sets out the rules for the collection, processing, storage and protection of the personal data of clients and of persons contacting the PIED-DE-POULE beauty salon at pl. Tadeusza Kościuszki 13/1A in Wrocław.
1.2. Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), the applicable provisions of Polish law and the Electronic Communications Law.
1.3. This Policy covers the processing of data related to booking and providing services, communication with clients, payments, complaints, marketing activities, photo and video documentation, and the use of booking systems.
1.4. This Policy applies to the activities of the PIED-DE-POULE Wrocław salon. Other salons operating under the PIED-DE-POULE brand, run by other business entities, may apply separate privacy policies.
2. PERSONAL DATA CONTROLLER
2.1. The controller of the personal data of the salon’s clients is:
PIED-DE-POULE OLEKSANDRA LEDOVSKA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
- Address: pl. Tadeusza Kościuszki 13, lok. 1A, 50-028 Wrocław, Polska
- KRS: 0001041027
- NIP: 8971923390
- REGON: 525517366
- E-mail: pdp.wroclaw@gmail.com
2.2. The Controller independently determines the purposes and means of processing personal data related to the operation of the salon it runs.
2.3. The Controller is responsible for the lawful processing of personal data, the application of appropriate legal bases and the implementation of appropriate organisational and technical data protection measures.
2.4. In all matters relating to the processing of personal data and the exercise of rights under the GDPR, the Controller may be contacted at the e-mail address indicated or by post.
3. SCOPE OF PERSONAL DATA PROCESSED
3.1. The Controller may process the following categories of personal data, to the extent necessary to achieve the specified purposes:
- first name and surname;
- contact telephone number;
- e-mail address;
- information about bookings, appointment dates and selected services;
- information about the history of visits and the services and products purchased;
- preferences regarding services and the method of communication;
- information related to payments, accounting documents and settlements;
- correspondence, requests, enquiries and complaints;
- information voluntarily provided during consultations;
- photographs and video recordings, where there is an appropriate legal basis for their processing;
- other data necessary to provide services or fulfil legal obligations.
3.2. In the case of treatments requiring an assessment of contraindications, the Controller may process information concerning allergies, contraindications or other circumstances related to the client’s health, solely to the extent necessary.
3.3. Data concerning health are processed in accordance with Articles 6 and 9 of the GDPR. Where the basis for processing such data is the client’s explicit consent, the Controller obtains it before processing begins.
3.4. Data may be obtained directly during a visit, by telephone, by e-mail, through online forms, instant messengers, booking systems and other contact channels made available by the salon.
3.5. The Controller applies the principle of data minimisation and limits the scope of information processed to the data necessary to achieve a specific purpose.
4. PURPOSES AND LEGAL BASES OF DATA PROCESSING
4.1. Personal data are processed for the following purposes:
a) Booking and provision of the salon’s services
Handling bookings, confirming appointment dates, organising the salon’s work, contact regarding scheduled services and the provision of hairdressing, cosmetic and other services included in the offer.
Legal basis: Article 6(1)(b) of the GDPR.
b) Customer service and communication
Responding to enquiries, providing information about services, handling requests and ensuring an appropriate quality of service.
Legal basis: Article 6(1)(b) or (f) of the GDPR, depending on the nature of the contact.
c) Fulfilment of legal obligations
Keeping settlements, accounting and tax records, and fulfilling obligations arising from applicable laws.
Legal basis: Article 6(1)(c) of the GDPR.
d) Handling complaints and protection of claims
Handling complaints, establishing and pursuing any claims, and defending against them.
Legal basis: Article 6(1)(b), (c) or (f) of the GDPR, as appropriate to the nature of the activity.
e) Marketing and promotional communication
Informing clients about services, news, promotions, special offers and events organised by the salon.
Legal basis: Article 6(1)(a) or (f) of the GDPR, depending on the nature of the processing.
Sending commercial information by e-mail, SMS, telephone and other means of communication covered by Article 398 of the Electronic Communications Law requires prior consent.
f) Satisfaction surveys and improvement of service quality
Analysis of clients’ opinions, comments and requests in order to improve the quality of services provided, service standards and the organisation of the salon’s work.
Legal basis: Article 6(1)(f) of the GDPR.
g) Processing of data concerning health
Collecting information necessary to assess contraindications and to perform certain treatments safely.
Legal basis: the relevant condition under Article 6 of the GDPR and a condition under Article 9(2) of the GDPR, in particular the client’s explicit consent, where applicable.
h) Photo and video documentation
Recording the results of services, documenting certain treatments and creating informational and promotional materials.
Legal basis: the appropriate condition under Article 6 of the GDPR and, in the case of special categories of data, also under Article 9 of the GDPR. The promotional use of a client’s identifiable image takes place on the basis of separate consent, taking into account the provisions on the protection of image.
4.2. Data are processed solely for specified, explicit and legitimate purposes.
5. BOOKING SYSTEM AND USE OF ONLINE SERVICES
5.1. The salon’s services may be booked in person, by telephone, via instant messengers and through the online booking system: https://booking.wroclaw.p-de-p.com/
5.2. Data provided when booking are used to handle the booking, organise the visit, provide the selected service and communicate in connection with the booking.
5.3. The controller of personal data related to bookings and the provision of services at the PIED-DE-POULE Wrocław salon is the entity indicated in section 2 of this Policy, subject to any separate processing operations carried out by other controllers.
5.4. Information about the salon may also be presented on the main website of the PIED-DE-POULE brand: https://p-de-p.pl/
5.5. Where a user moves from the brand’s main website to the booking system of the salon in Wrocław, the data necessary to handle the booking are processed by the Controller running the salon.
5.6. The processing of data related to the use of the brand’s main website, before or independently of making a booking, may be subject to a separate privacy policy of the operator of that website.
5.7. The Controller may use external providers of booking systems and IT services. Their access to data takes place in accordance with the appropriate legal bases and agreements, in particular data processing agreements, where required.
6. DATA RECIPIENTS AND COOPERATION WITH OTHER ENTITIES
6.1. Personal data may be disclosed to entities supporting the Controller in conducting its business, to the extent necessary to achieve the specified purposes.
6.2. Recipients of the data may include:
- providers of booking and CRM systems;
- providers of IT and hosting services;
- providers of accounting, legal and administrative services;
- payment operators;
- providers of communication and marketing tools;
- entities providing services to the Controller;
- public authorities entitled to receive data under the law.
6.3. The PIED-DE-POULE Wrocław salon operates under the common PIED-DE-POULE brand but is run by a separate company.
6.4. The use of a common brand does not mean that the data of all clients are automatically shared with the other companies running PIED-DE-POULE salons.
6.5. Any transfer of data to other companies operating under the PIED-DE-POULE brand may take place only for a specific, legitimate purpose, on an appropriate legal basis and to the extent necessary to achieve that purpose.
6.6. The transfer of data for the purpose of serving a client at another salon, providing services or responding to an individual request requires an appropriate legal basis to be established in each case.
6.7. Disclosure of data to other companies for marketing purposes requires an appropriate legal basis. The sending of marketing communications by such entities requires compliance with the relevant consent requirements for the given contact channel.
6.8. Data concerning health and other special categories of data may not be freely disclosed to other entities and are subject to the additional requirements of Article 9 of the GDPR.
6.9. Where personal data are transferred outside the European Economic Area, the Controller applies the appropriate bases and safeguards provided for in Chapter V of the GDPR.
7. MARKETING AND CONSENTS TO COMMUNICATION
7.1. The Controller may conduct marketing activities related to the offer of the PIED-DE-POULE Wrocław salon.
7.2. Marketing activities may include information about new services, special offers, promotions, events and other activities of the salon.
7.3. Marketing communication by e-mail, SMS, telephone or other means covered by Article 398 of the Electronic Communications Law requires prior consent.
7.4. Marketing consent is voluntary and may be withdrawn at any time.
7.5. Refusal to give marketing consent does not affect the ability to use the salon’s basic services.
7.6. Consent to receive marketing information from the PIED-DE-POULE Wrocław salon does not automatically constitute consent to receive communications from other PIED-DE-POULE companies.
7.7. When organising joint marketing campaigns with other entities, the Controller ensures an appropriate legal basis for data processing and the required consents identifying the relevant senders and communication channels.
7.8. Withdrawal of consent or an objection to direct marketing may be submitted to: pdp.wroclaw@gmail.com
8. PHOTOGRAPHS, VIDEO RECORDINGS AND USE OF IMAGE
8.1. The salon may offer clients the taking of photographs and video recordings documenting the results of services, the course of treatments and materials intended for marketing communication.
8.2. The promotional recording and use of a client’s identifiable image takes place on the basis of separate, voluntary consent, taking into account Article 81 of the Act on Copyright and Related Rights and the relevant provisions of the GDPR.
8.3. Consent to the use of image is given separately from consent to the processing of data necessary for booking and providing services.
8.4. A separate consent document should specify:
- the purpose of creating and using the materials;
- the scope of recording and publishing the image;
- the communication channels in which the materials may be used;
- the entities authorised to publish and use the materials;
- the rules for withdrawing consent to the processing of personal data.
8.5. Photo and video materials may be published on the salon’s social media, websites and in promotional materials only to the extent covered by the consent given or another appropriate legal basis.
8.6. The use of materials on the central channels of the PIED-DE-POULE brand or in the communications of other salons requires this scope to be explicitly included in the consent given or an appropriate separate legal basis.
8.7. Refusal to take part in promotional photographs or recordings does not affect the ability to use the salon’s services.
8.8. Personal data processed on the basis of consent may be processed until it is withdrawn or until the purpose ceases earlier. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
8.9. Photographs taken solely for the purpose of documenting a treatment, in particular those that may reveal data concerning health, are subject to separate processing rules and are not automatically intended for marketing publication.
8.10. A client’s image is used with respect for their personal rights and the rights provided for by applicable law.
9. COOKIES AND INTERNET TECHNOLOGIES
9.1. Online systems used in connection with the salon’s activities may use cookies and similar technologies to ensure proper operation, carry out statistical analyses and conduct marketing activities.
9.2. Depending on the solutions used, these technologies may include:
- cookies necessary for the system to function;
- functional cookies;
- analytical and statistical cookies;
- advertising and marketing cookies.
9.3. Cookies and similar technologies requiring consent are used after such consent has been obtained, in accordance with Article 399 of the Electronic Communications Law.
9.4. The user should be able to manage consents to optional tracking technologies, including giving, refusing and changing consent.
9.5. Detailed information on the technologies used, their providers, purposes and periods of operation should be made available on the relevant website or in the consent management tool.
9.6. The mere use of the booking system or website does not automatically constitute consent to optional tracking technologies.
10. PERSONAL DATA RETENTION PERIOD
10.1. The Controller stores personal data only for the period necessary to achieve the purpose of their processing or as required by law.
10.2. The data retention period depends on the category of data and the purpose of processing:
a) Data relating to bookings and the provision of services — for the time necessary to perform the service and thereafter for the period justified by the establishment of, or defence against, claims.
b) Accounting and tax data — for the period required by the applicable laws.
c) Data related to complaints — for the period necessary to handle the matter and to protect any claims.
d) Data processed on the basis of consent — until it is withdrawn or until the purpose of processing ceases earlier, subject to the possibility of storing information necessary to demonstrate the lawfulness of the prior processing.
e) Data processed for marketing purposes on the basis of legitimate interest — until an objection is effectively raised or the purpose of processing ceases.
f) Technical data related to the use of online systems — in accordance with the retention period applicable to the specific system and purpose of processing.
10.3. After the relevant retention period has expired, the data are deleted or anonymised, unless there is a separate legal basis for further processing.
11. RIGHTS OF DATA SUBJECTS
11.1. Every person whose personal data are processed has, in the cases provided for by the GDPR, the following rights:
- the right of access to personal data;
- the right to rectification of data;
- the right to request erasure of data;
- the right to restriction of processing;
- the right to data portability;
- the right to object to processing;
- the right to withdraw consent at any time.
11.2. Where data are processed for direct marketing purposes, the data subject has the right to object to such processing at any time.
11.3. To exercise these rights, please contact the Controller at: pdp.wroclaw@gmail.com
11.4. The Controller handles requests in accordance with the time limits and rules set out in Article 12 of the GDPR.
11.5. The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO):
ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Polska.
12. DATA SECURITY AND FINAL PROVISIONS
12.1. The Controller applies appropriate technical and organisational measures to ensure the security of the personal data processed.
12.2. Access to personal data is granted only to authorised persons, to the extent necessary to perform their assigned duties.
12.3. The Controller takes measures to protect data against unauthorised access, disclosure, loss, accidental destruction or alteration.
12.4. In the event of a personal data breach, the Controller takes the actions required by the GDPR, including making the appropriate notifications and communications where the statutory conditions are met.
12.5. Providing the data needed for booking and providing services is voluntary; however, failure to provide the necessary data may make it impossible to perform the service. Data required by law are provided to the extent resulting from the law.
12.6. Marketing consents and consents to the advertising use of image are voluntary.
12.7. If the Controller uses profiling or automated decision-making, it provides the appropriate information required by the GDPR, in particular in cases covered by Article 22 of the GDPR.
12.8. The Controller may update this Privacy Policy in the event of changes in the law, in the methods of data processing or in the organisation of its business.
12.9. Any questions concerning the protection of personal data should be sent to: pdp.wroclaw@gmail.com
12.10. This Privacy Policy has been prepared taking into account the provisions of the GDPR and the relevant provisions of Polish law.
Last updated: 4 November 2026