1. GENERAL PROVISIONS
1.1. This Privacy Policy sets out the rules for processing the personal data of clients and persons contacting the PIED-DE-POULE salon at ul. Piękna 49 in Warsaw.
1.2. Personal data are processed in accordance with Regulation (EU) 2016/679 (GDPR), the provisions of Polish law and the Electronic Communications Law.
1.3. The Policy covers the processing of data related to the booking and provision of services, communication with clients, payments, complaints, marketing and cooperation with the other PIED-DE-POULE salons in Warsaw.
2. PERSONAL DATA CONTROLLER
2.1. The controller of the personal data of the salon’s clients is:
PDP WARSZAWA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
- Address: ul. Piękna 49, 00-672 Warszawa, Poland
- KRS: 0001009749
- NIP: 7011121805
- REGON: 523985809
- E-mail: pieddepoulepiekna@gmail.com
2.2. The Controller determines the purposes and means of processing data related to the provision of services in the salon it operates, subject to processes carried out jointly with other controllers.
2.3. Matters concerning the protection of personal data may be raised at the e-mail address indicated above or by post.
3. SCOPE OF PROCESSED DATA
3.1. To the extent necessary to achieve a given purpose, the Controller may process:
- first name and surname;
- telephone number and e-mail address;
- information on bookings and visit history;
- selected services, preferences and information provided during consultations;
- payment and accounting data;
- correspondence, requests and complaints;
- photographs and video recordings, where an appropriate legal basis exists;
- other data necessary to perform a service or to comply with legal obligations.
3.2. In the case of treatments requiring an assessment of contraindications, the Controller may obtain necessary health-related information, including allergies and contraindications, solely in accordance with Articles 6 and 9 GDPR.
3.3. The scope of processed data is limited in accordance with the data minimisation principle.
4. PURPOSES AND LEGAL BASES OF PROCESSING
4.1. Data are processed for the following purposes:
a) Booking and performance of services, confirmation of appointments and organisation of visits — Article 6(1)(b) GDPR.
b) Customer service, responding to enquiries and ensuring service quality — Article 6(1)(b) or (f) GDPR, depending on the circumstances.
c) Handling payments, accounting and tax documentation and compliance with legal obligations — Article 6(1)(c) GDPR.
d) Handling complaints, establishing and pursuing claims and defending against them — Article 6(1)(b), (c) or (f) GDPR.
e) Marketing of the salon’s services and offers — Article 6(1)(a) or (f) GDPR, as appropriate for the specific process, taking into account the consents required by Article 398 of the Electronic Communications Law.
f) Analysis of client feedback, improvement of service standards and organisation of customer service — Article 6(1)(f) GDPR.
g) Processing of health-related information where necessary for specific treatments — the appropriate basis under Article 6 and a condition under Article 9(2) GDPR, in particular explicit consent, where applicable.
5. COOPERATION AND DATA EXCHANGE BETWEEN THE WARSAW SALONS
5.1. The Controller cooperates with the other PIED-DE-POULE salons in Warsaw, operated by:
- PIED-DE-POULE SP. Z O.O., ul. Grzybowska 4, lok. U3C, 00-131 Warszawa, KRS 0001048126;
- PDP WILANOW SP. Z O.O., Oś Królewska 18/U4, 02-972 Warszawa, KRS 0001016476.
5.2. The cooperation may include the exchange of personal data needed to carry out joint booking and customer service processes, in particular transferring a visit between salons, handling a client’s request and performing an ordered service.
5.3. The scope of shared data may include first name and surname, telephone number, e-mail address, information on the selected service, the date of the visit and the necessary elements of previous service.
5.4. Data are transferred only to the extent necessary and on an appropriate legal basis, in particular Article 6(1)(b) or (f) GDPR, depending on the circumstances. Health data additionally require that the conditions of Article 9 GDPR be met.
5.5. The cooperation does not constitute a basis for unrestricted access by all salons to clients’ full history.
5.6. Each company remains an independent data controller in the processes whose purposes and means it determines on its own. Jointly determining the purposes and means of processing requires the application of the rules on joint controllers, including Article 26 GDPR.
5.7. Exchanging data for marketing activities and directing offers of other salons require an appropriate legal basis and proper consents to marketing contact, identifying the specific entities and communication channels.
6. BOOKING SYSTEMS AND DATA RECIPIENTS
6.1. Services may be booked directly at the salon, by telephone or via the p-de-p.pl website and the booking.warsaw.p-de-p.com system.
6.2. Booking-related data are processed in order to handle the booking, carry out the visit, contact the client and fulfil obligations related to the service provided.
6.3. Recipients of the data may include providers of booking systems, IT, accounting, legal, payment, communication and marketing services, as well as competent public authorities.
6.4. Entities acting on behalf of the Controller are given access to data on the basis of appropriate agreements, in particular data processing agreements, where required.
6.5. Where data are transferred outside the EEA, the Controller applies the safeguards provided for in Chapter V GDPR.
7. MARKETING AND CONSENTS
7.1. The Controller may carry out marketing activities concerning the salon’s services in accordance with the GDPR and the provisions of the Electronic Communications Law.
7.2. Within the cooperation of the Warsaw salons, promotional activities covering offers of more than one location may be carried out.
7.3. Marketing consents should clearly indicate which companies they concern and through which channels communication may be conducted.
7.4. Marketing consent may be withdrawn at any time, and an objection to direct marketing may be submitted to pieddepoulepiekna@gmail.com.
7.5. Refusal to give marketing consent does not affect the possibility of using the salon’s basic services.
8. PHOTOGRAPHS AND VIDEO RECORDINGS
8.1. The salon may invite clients to take part in photo sessions or recordings documenting services, treatment results and advertising materials.
8.2. The capture and use of a client’s identifiable image for promotional purposes takes place on the basis of separate, voluntary consent, taking into account Article 81 of the Act on Copyright and Related Rights and the relevant provisions of the GDPR.
8.3. The separate consent specifies the purposes of use of the materials, the publication channels, the scope of the permission and the entities entitled to use the materials.
8.4. Publishing materials on the channels of other Warsaw salons or the brand’s central channels requires that such use be covered by the scope of the consent given.
8.5. Lack of consent to take part in advertising photo sessions and recordings does not constitute grounds for refusing to provide services.
8.6. Photographic documentation made in connection with a treatment, especially where it reveals information about health, is processed separately from advertising materials and solely on an appropriate legal basis.
9. DATA RETENTION PERIOD
9.1. Data are processed for the period necessary to achieve the purpose for which they were collected.
9.2. Data relating to services and bookings are stored for the duration of the provision of services and, to a justified extent, until the expiry of the limitation periods for pursuing or defending against claims.
9.3. Accounting and tax data are stored in accordance with statutory periods.
9.4. Data processed on the basis of consent are used until such consent is withdrawn or the purpose ceases to exist earlier, subject to the possibility of retaining evidence of the lawfulness of prior processing.
9.5. Data used for direct marketing on the basis of legitimate interest are processed no longer than until an effective objection is raised or the purpose ceases to exist.
10. RIGHTS OF DATA SUBJECTS
10.1. Data subjects have, where applicable, the rights of access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent.
10.2. Requests concerning the exercise of rights may be sent to pieddepoulepiekna@gmail.com. They are handled in accordance with Article 12 GDPR.
10.3. Everyone has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa.
11. DATA SECURITY
11.1. The Controller applies appropriate technical and organisational measures designed to ensure the confidentiality, integrity and availability of data.
11.2. Only authorised persons are given access to data, to the extent necessary to perform their duties.
11.3. Personal data breaches are handled in accordance with the provisions of the GDPR.
12. FINAL PROVISIONS
12.1. Providing the data necessary for booking or performing a service is voluntary, but failure to provide them may make it impossible to provide the service. Data required by law are processed in accordance with the applicable provisions. Consents to marketing and to the use of image for advertising purposes are voluntary.
12.2. The Controller reserves the right to update the Policy in the event of changes in the law or in processing operations.
12.3. Any questions concerning the protection of personal data should be sent to pieddepoulepiekna@gmail.com.
Date of update: 4 November 2026