Privacy policy

Who handles your data

The controller of your personal data is the company that runs this website and the salon. For anything to do with your data, write to the address below.

What we collect

Only what the service, and the accounts behind it, cannot be delivered without:

• Your name, email address and phone number — so we can confirm the booking, remind you of it and reach you if the time has to change.
• The booking itself: the service, the specialist, the time, the price and any note you wrote.
• The fact of payment: amount, date, method and the payment provider's transaction number. We never see or store your card details — those stay with the payment provider.
• Invoice details, and if you are buying on behalf of a company, its name, registration number and VAT number.
• Account details, if you create one. The password is stored only as a one-way cryptographic hash: we do not have it and cannot recover it.
• Your correspondence with us, so we can see the history of a question instead of asking you to repeat it.
• Notes salon staff have written about your visits, if any. These are your personal data too, and you will see them in the copy you can download.
• Technical data: cookies and a record of your consent with its date and network address. The address is truncated so that no individual device can be identified from it.

Why we process it, and on what legal basis

Each purpose has its own basis. This is not a formality: what you can do about a given processing depends on it.

• To carry out your booking and provide the service — performance of a contract (GDPR Art. 6(1)(b)). While the contract stands this processing cannot be withdrawn, because without it there is no service.
• To take payment, issue invoices and keep accounts — a legal obligation (Art. 6(1)(c)).
• To send news and offers by email — your consent (Art. 6(1)(a)). We ask for it separately from the booking and never with a pre-ticked box.
• For analytics cookies — your consent. Until you give it, no analytics script is loaded at all.
• To keep service quality up, prevent abuse and defend legal claims — our legitimate interest (Art. 6(1)(f)). You have the right to object to this.

How long we keep it

These periods are not approximate — a weekly automated sweep applies them.

• Your client record and visit history — three years from your last visit. After that the record is anonymised: aggregate statistics survive, but they can no longer be connected to you.
• Invoices — ten years, as accounting law requires. We cannot shorten this even at your request; when it expires the document is scrubbed along with the stored PDF.
• Consent records — as long as needed to show we acted lawfully. If your data is erased the consent record stays, but is cut loose from your identity.
• Payment records — without personal details: the name, email and phone the payment provider echoes back are removed, because the booking already holds them.
• Technical records of failed background jobs — thirty days.

Who we share it with

We do not sell data and do not use it for anything not described here. Access is limited to:

• Salon staff, as far as serving your visit requires. Rights in the admin system are granted by role rather than handed to everyone alike.
• The website and database hosting provider.
• The email delivery provider — for confirmations, reminders and invoices.
• OPAY, the payment provider, when you choose to pay online. It receives the amount, the order number and your contact details so it can take the payment; we receive only the result.
• Google Ireland Limited — only if you consented to analytics cookies.
• Our bookkeeper, and public authorities where the law requires it.

Every provider that processes data on our behalf does so under a written data processing agreement.

Transfers outside the European Economic Area

Booking, payment and correspondence data stays within the European Economic Area. The one exception is Google Analytics statistics, which may reach the United States. That happens only if you consented to analytics cookies, and relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework together with standard contractual clauses. Withdrawing your consent stops the transfer.

Your rights

All of these are free to exercise:

• See your data and get a copy of it (Art. 15). Signed in to your account, you can download everything we hold immediately, without waiting for a reply.
• Have inaccurate or outdated details corrected (Art. 16).
• Have your data erased (Art. 17). You can do this yourself in your account. Documents we are legally required to keep for accounting remain until that period ends — we show you the date before you confirm.
• Restrict processing (Art. 18), or object to it where it rests on legitimate interest (Art. 21).
• Receive your data in a structured, machine-readable format and pass it to another controller (Art. 20).
• Withdraw a consent at any time (Art. 7(3)). This does not affect the lawfulness of processing carried out before you withdrew it.

Make a request from your account, or by email from the same address you used to book. We will answer within 30 calendar days at the latest.

Complaining to the supervisory authority

If you believe we are handling your data unlawfully, write to us first — that is usually the faster route. You also have the right to complain to the Lithuanian State Data Protection Inspectorate: L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, vdai.lrv.lt.

Automated decisions and profiling

We make no automated decisions that would have legal effects for you, and we do not profile your behaviour for advertising.

Children's data

Treatments are provided to adults. A younger person can be treated only with a parent or guardian present, who enters into the contract and provides the details.

Security

The site is served only over encrypted HTTPS. Access to client data in the admin system is granted by role, passwords are stored only as cryptographic hashes, and card details never reach our systems at all.

Cookies

Which cookies we use, what they are for and how to change your choice at any time is set out in a separate document.

Changes to this policy

If we change this policy materially we will publish a new version date and, where needed, ask for consent again. Every consent is recorded together with the version of the document it was given against, so it is always clear what exactly you agreed to.