Privacy policy

This is an English translation provided for convenience. In the event of any discrepancy, the Polish version prevails.

§ 1. General provisions

This Privacy Policy (hereinafter the “Policy”) sets out the rules for processing personal data and for the use of cookies and other tracking technologies on the website available at https://magicbalispa.pl (hereinafter the “Website”), operated by the Controller. The Website comprises the website together with all its subpages and the online shop through which vouchers and products can be purchased.

This document has been prepared on the basis of the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation; hereinafter “GDPR”, in Polish “RODO”);
• ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych (Personal Data Protection Act of 10 May 2018);
• ustawa z dnia 18 lipca 2002 r. o świadczeniu usług drogą elektroniczną (Act of 18 July 2002 on the Provision of Services by Electronic Means);
• ustawa z dnia 30 maja 2014 r. o prawach konsumenta (Consumer Rights Act of 30 May 2014);
• ustawa z dnia 16 lipca 2024 r. – Prawo komunikacji elektronicznej (Electronic Communications Law of 16 July 2024), to the extent that it has entered into force and applies to cookies and similar technologies.

Use of the Website is voluntary. Users should read this Policy before they start using the Website or provide their personal data.

How booking and sales work at Magic Bali SPA:

Appointments (massages, rituals, treatments) are booked and paid for exclusively through the external booking platform Booksy — including when the User starts a booking by clicking a button on magicbalispa.pl. The Controller does not operate its own appointment booking form and does not collect payments for appointments directly on the Website.

Vouchers and products (e.g. cosmetics) are purchased in the Controller’s online shop, with payments handled by the payment operator Przelewy24. In this respect, Magic Bali SPA is the controller of the data.

§ 2. Controller of personal data

The controller of the personal data of Website Users is:

Name:
N 108 s.c. Dorota i Roma Rutkowskie

Registered office:
ul. Malwowa 108, 60-185 Poznań

NIP (Tax ID):
777-332-93-90

REGON (Statistical No.):
380872949

Contact:
marketing@magicbalispa.pl

Salon address:
ul. Malwowa 108, 60-185 Poznań

The Controller has not appointed a Data Protection Officer. In all matters relating to the processing of personal data and the exercise of rights connected with such processing, please contact us at the e-mail address given above.

§ 3. Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

Controller — N 108 s.c. Dorota i Roma Rutkowskie, with its registered office in Poznań, trading under the brand “Magic Bali SPA”.

Website — the website available at https://magicbalispa.pl together with all its subpages and the online shop.

Shop — the part of the Website through which vouchers and products (e.g. cosmetics) can be purchased, with electronic or physical delivery.

Booksy — the external online booking platform operated by Booksy International sp. z o.o., through which the User books and pays for appointments at the salon.

User — a natural person using the Website or sending an enquiry to the Controller via the Website.

Client — a User who has booked an appointment, purchased a voucher or product, or otherwise used the Controller’s services.

Personal data — any information relating to an identified or identifiable natural person within the meaning of Article 4(1) GDPR.

Processing — an operation or set of operations performed on personal data, whether or not by automated means.

Cookies — text files stored on the User’s terminal device while using the Website.

§ 4. Purposes, legal bases and periods of data processing

The Controller processes Users’ personal data for the purposes and on the legal bases described below.

4.1. Booking and paying for an appointment via the Booksy platform

Appointments (massages, rituals and other treatments) are booked, and payment or prepayment for an appointment is made, exclusively through the Booksy platform. The “Book” button on the Website takes the User to the Booksy booking tool (embedded in the Website or opened in a separate window). The Controller does not operate its own appointment booking form on the Website.

Scope of data: first name and surname, telephone number, e-mail address, the selected service with its parameters (duration, additional options, selected therapist, if applicable), the date and time of the appointment, payment or prepayment information, and any comments provided voluntarily by the User.

Purpose: accepting and handling the appointment booking, confirming the date, handling any online prepayment, contacting the User to confirm, change or cancel the appointment, and providing the service at the salon.

Roles of the controllers: Booksy International sp. z o.o. (ul. Prosta 67, 00-838 Warsaw) and the Controller (Magic Bali SPA) process Clients’ data for their own purposes and act as separate controllers, not as joint controllers. Booksy is the controller of the data relating to the User’s account and the operation of the platform; the Controller becomes the controller of the Client’s data transferred to it by Booksy for the purpose of providing the service. The rules on the processing of data by Booksy are set out in its privacy policy available at https://booksy.com/pl-pl/p/privacy.

Legal basis: Article 6(1)(b) GDPR — performance of a contract or taking steps at the request of the data subject prior to entering into a contract.

Cancellation and refund rules: the detailed conditions for cancelling appointments, rescheduling and refunding any prepayment are set out in the Terms and Conditions available on the Website and in the terms of the Booksy platform. Pursuant to Article 38(12) of the Consumer Rights Act, a consumer does not have the right to withdraw from a contract for the provision of leisure services if the contract specifies the day or period of performance of the service — which applies to appointments booked for a specific date and time.

Retention period: data received from Booksy concerning a completed appointment is kept by the Controller for the duration of the service and thereafter for the period necessary to pursue or defend against claims (as a rule, up to 6 years from the end of the year in which the service was provided, in accordance with Article 118 of the Kodeks cywilny (Polish Civil Code)). Data required for accounting and tax obligations is kept for 5 years from the end of the calendar year in which the tax obligation arose.

4.2. Purchase of vouchers and products in the online shop

The Controller enables the purchase of vouchers and products (e.g. cosmetics) directly in the online shop forming part of the Website. In this respect, the Controller is the sole controller of the data and handles the order and payment independently (through the payment operator indicated in section 4.6).

Scope of data: first name and surname, e-mail address, telephone number, details for sending the voucher (the recipient’s e-mail address, if provided) or details for product delivery, invoice details (if requested), the greeting text on the voucher (voluntary), the amount and the order ID.

Purpose: fulfilling the order for a voucher or product, generating and sending the voucher (among other things as a PDF file to the e-mail address provided), handling payment, issuing a confirmation of purchase, handling complaints and returns.

Legal basis: Article 6(1)(b) GDPR — performance of a sales contract or taking steps at the request of the data subject prior to entering into a contract.

Right of withdrawal: in the case of products and vouchers purchased at a distance, a consumer is, as a rule, entitled to withdraw from the contract within 14 days, on the terms and subject to the exceptions set out in the Consumer Rights Act and in the Shop Terms and Conditions. The redemption of a voucher (booking and attending a specific appointment), on the other hand, is subject to the rules described in section 4.1.

Retention period: for the duration of the order and thereafter for the period necessary to handle complaints and to pursue or defend against claims (as a rule, up to 6 years). Data for accounting and tax purposes — 5 years from the end of the year in which the tax obligation arose. The validity of a voucher and the rules for its redemption are set out in the Terms and Conditions.

4.3. Newsletter (MailerLite)

Scope of data: e-mail address, optionally first name.

Purpose: sending the Controller’s commercial and marketing information and newsletter by electronic means.

Legal basis: Article 6(1)(a) GDPR — voluntary and separate consent; with regard to commercial information sent by electronic means — Article 10(2) of the Act on the Provision of Services by Electronic Means; with regard to telephone marketing — Article 398(1) of the ustawa z dnia 12 lipca 2024 r. – Prawo komunikacji elektronicznej (Electronic Communications Law of 12 July 2024).

Processor: UAB “MailerLite”, J. Basanavičiaus 15, LT-03108 Vilnius, Lithuania — an entity processing data on the basis of a data processing agreement; data is stored on servers within the EEA.

Retention period: until consent is withdrawn or the User unsubscribes from the newsletter (the “Unsubscribe” link in the footer of every message). After consent is withdrawn, the e-mail address may be kept on a suppression list solely to avoid it being added again.

4.4. Contact form / contact by e-mail or telephone

Scope of data: first name, e-mail address, telephone number (if provided), the content of the message and any other data provided voluntarily.

Purpose: responding to the User’s enquiry and conducting correspondence.

Legal basis: Article 6(1)(f) GDPR — the Controller’s legitimate interest in responding to the enquiry received.

Retention period: for the duration of the correspondence and thereafter for up to 12 months from the last contact or until an objection is effectively raised.

4.5. Telephone bookings

Where an appointment is booked by telephone, the Controller’s reception staff enter the data necessary to arrange the appointment (first name, telephone number, selected service, date) into the Booksy platform in order to maintain a single shared appointment calendar. The purpose, legal basis and retention period are the same as in section 4.1.

4.6. Online payments for vouchers and products (Przelewy24)

Payment operator: PayPro S.A. (Przelewy24), ul. Pastelowa 8, 60-198 Poznań, NIP 779-236-98-87.

Purpose: processing payments for vouchers and products purchased in the Controller’s online shop. Payment or prepayment for an appointment is not handled by Przelewy24 but by the Booksy platform (section 4.1).

Legal basis: Article 6(1)(b) GDPR — performance of a contract.

Scope of data transferred to the operator: first name, surname, e-mail address, transaction amount, order ID.

Payment card data: the Controller does not collect or store the User’s payment card data (card number, expiry date, CVV/CVC code). This data is entered directly on the payment operator’s secure page or in its encrypted component (iframe). The Controller receives only information about the status and result of the transaction. PayPro S.A. is an independent controller of data with regard to payment processing; the rules of processing are set out in its policy available at https://www.przelewy24.pl/polityka-prywatnosci.

4.7. Loyalty card (stamps for massages)

The Magic Bali SPA loyalty card is kept exclusively in paper form. The card does not contain the Client’s personal data — the Controller does not process data in connection with running the programme unless the Client provides it themselves (e.g. in order to restore a lost card). In such a case, processing is based on consent (Article 6(1)(a) GDPR) and is limited to the first name and telephone number.

4.8. Issuing invoices and accounting and tax obligations

Scope of data: first name, surname / company name, address, NIP (Tax ID; for businesses), the scope of the service or product, the amount.

Purpose: issuing an invoice, keeping accounting records, fulfilling tax obligations.

Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation to which the Controller is subject.

Retention period: 5 years from the end of the calendar year in which the tax obligation arose.

4.9. Establishing, pursuing or defending against claims

Purpose: protecting the Controller’s rights, including pursuing receivables or defending against claims.

Legal basis: Article 6(1)(f) GDPR — the Controller’s legitimate interest.

Retention period: until the limitation period for claims expires, as a rule 6 years (Article 118 of the Civil Code).

4.10. Analytics and marketing (cookies and similar technologies)

The detailed rules are described in § 7 of this Policy. Data is processed for analytical and marketing purposes exclusively on the basis of the User’s consent given via the cookie consent panel (Article 6(1)(a) GDPR).

4.11. Social media profiles (Facebook, Instagram, TikTok)

The Controller runs public profiles on Facebook, Instagram (both operated by Meta Platforms Ireland Limited) and TikTok (TikTok Technology Limited). Links to the profiles are available in the Website footer.

Scope of data: data made publicly available by the User in their profile (including profile name and photo), the content of interactions (likes, comments, shares, private messages), and anonymised reach statistics provided by the social network.

Purpose: conducting marketing and informational communication, building a community around the brand, answering questions and comments, and keeping reach statistics.

Legal basis: Article 6(1)(f) GDPR — the Controller’s legitimate interest in promoting its services, building its image and communicating with the community.

Joint controllership (Facebook, Instagram): with regard to the page statistics (Page Insights) provided by Meta, the Controller and Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland) are joint controllers within the meaning of Article 26 GDPR. The essence of the arrangement is available at https://www.facebook.com/legal/terms/page_controller_addendum. The User may exercise their rights under the GDPR against each of the joint controllers.

TikTok: the rules of processing are set out in TikTok’s privacy policy available at https://www.tiktok.com/legal/privacy-policy-eea.

Retention period: until an objection is effectively raised or the interaction is deleted by the User. Private communications — for the time necessary to handle the matter, but no longer than 12 months from the last interaction.

§ 5. Recipients of personal data

The Controller may transfer Users’ personal data to the following categories of recipients, solely to the extent necessary to achieve the purposes indicated above:

• the online booking platform — Booksy International sp. z o.o., Warsaw (a separate controller with regard to appointment bookings);
• the hosting service provider — SeoHost.pl sp. z o.o.;
• the newsletter service provider — UAB “MailerLite”, Vilnius, Lithuania;
• the payment operator — PayPro S.A. (Przelewy24), Poznań — with regard to payments for vouchers and products;
• the Krajowy System e-Faktur (KSeF, National e-Invoicing System) operated by the Ministry of Finance / National Revenue Administration — with regard to data contained in invoices, in accordance with the ustawa o podatku od towarów i usług (VAT Act) (an obligation for N 108 s.c. from 1 April 2026);
• law firms and advisory, debt collection or audit firms — to the extent necessary;
• providers of analytics and marketing tools (e.g. Google Ireland Limited, Meta Platforms Ireland Limited) — to the extent set out in § 7, solely after the relevant cookie consent has been given;
• social media platform providers — Meta Platforms Ireland Limited (Facebook, Instagram), TikTok Technology Limited — to the extent described in section 4.11;
• public authorities or other authorised entities — only where an obligation to disclose data arises from the law.

Every entity to which the Controller entrusts the processing of data as a processor acts on the basis of a data processing agreement concluded in accordance with Article 28 GDPR. Booksy and the payment operator process data as separate controllers with regard to their own services.

§ 6. Transfer of data outside the European Economic Area

As a rule, Users’ personal data is processed within the European Economic Area (EEA).

Where tools such as Google Analytics, Google Ads, Meta Pixel or other services of providers from third countries (in particular the USA) are used, data may be transferred outside the EEA. Such transfers take place on the basis of:

• European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (the EU–U.S. Data Privacy Framework), with regard to organisations certified under the DPF, or
• standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914) — in the case of transfers to entities not covered by an adequacy decision,
• with the application of additional technical and organisational safeguards in accordance with the guidelines of the European Data Protection Board.

The User has the right to obtain a copy of the safeguards applied by contacting the Controller.

§ 7. Cookies and similar technologies

7.1. What cookies are

Cookies are small text files saved by the browser on the User’s terminal device while using websites. In particular, they contain the name of the website from which they originate, their storage period and a unique identifier.

7.2. Types of cookies used on the Website

Necessary:
Purpose: proper functioning of the Website, session handling, remembering cookie consent preferences, securing forms.
Legal basis: Article 173(3)(2) of the Prawo telekomunikacyjne (Telecommunications Law) — consent is not required.

Functional:
Purpose: remembering the User’s settings (language, region, display preferences).
Legal basis: the User’s consent (Article 6(1)(a) GDPR).

Analytical:
Purpose: anonymised statistics on the use of the Website (Google Analytics 4 and similar).
Legal basis: the User’s consent.

Marketing:
Purpose: personalised advertising, remarketing, measuring campaign effectiveness (Google Ads, Meta Pixel).
Legal basis: the User’s consent.

7.3. Consent management

On the first visit to the Website, the User is presented with a cookie consent panel (cookie banner) which makes it possible to:

• accept all cookies;
• reject all cookies (except necessary ones);
• select individual categories of cookies (granular consent).

The User may change or withdraw consent at any time by clicking the “Cookie settings” link in the Website footer. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

7.4. Managing cookies in the browser

Irrespective of the consent panel, the User may change cookie settings in their browser themselves (block, delete or restrict cookies):

• Google Chrome — Settings → Privacy and security → Cookies;
• Mozilla Firefox — Options → Privacy & Security;
• Safari — Preferences → Privacy;
• Microsoft Edge — Settings → Cookies and site permissions.

Disabling or restricting cookies may make it difficult to use some features of the Website.

7.5. Third-party providers

• Google Analytics 4 — Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — traffic and behaviour analytics;
• Google Ads — Google Ireland Limited — remarketing and conversion measurement;
• Meta Pixel — Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland) — remarketing and conversion measurement.

§ 8. Rights of the data subject

In connection with the processing of personal data, the User has the following rights:

• the right of access to data (Article 15 GDPR);
• the right to rectification of data (Article 16 GDPR);
• the right to erasure of data (the “right to be forgotten”, Article 17 GDPR);
• the right to restriction of processing (Article 18 GDPR);
• the right to data portability (Article 20 GDPR);
• the right to object (Article 21 GDPR) — to processing based on legitimate interest, including direct marketing;
• the right to withdraw consent at any time (Article 7(3) GDPR);
• the right not to be subject to automated decision-making (Article 22 GDPR) — the Controller does not make decisions based solely on automated processing, including profiling, which produce legal effects;
• the right to lodge a complaint with the supervisory authority — the Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl.

To exercise the above rights, please contact the Controller at: marketing@magicbalispa.pl. The Controller responds without undue delay and no later than one month from receipt of the request. This period may be extended by a further two months where the request is complex — in which case the User will be notified accordingly.

§ 9. Voluntary provision of data

Providing personal data is voluntary; however, in some cases it is necessary in order to use certain features or services, namely:

• to book an appointment via Booksy — it is necessary to provide the data required by the Booksy platform (first name, telephone number, e-mail address);
• to purchase a voucher or product in the shop — it is necessary to provide the data required to fulfil the order and process the payment;
• to subscribe to the newsletter — it is necessary to provide an e-mail address;
• to issue an invoice — it is necessary to provide the identification data required by tax law.

Failure to provide the data indicated means that the service or feature concerned cannot be used.

§ 10. Data security

The Controller applies appropriate technical and organisational measures to protect personal data against loss, destruction, unauthorised access, modification or disclosure, in accordance with Article 32 GDPR. In particular:

• the Website uses the encrypted SSL/TLS protocol (https://);
• only authorised persons bound by confidentiality have access to the data;
• backups and software updates are performed regularly;
• data processing agreements are concluded with every processor;
• the principle of data minimisation is applied — the Controller processes only the data necessary to achieve the purposes indicated.

§ 11. Changes to the Privacy Policy

The Controller reserves the right to make changes to this Policy, in particular in the event of:

• changes in the law affecting the rules of data processing;
• the introduction of new features on the Website;
• changes in the entities processing data or in the tools used.

Each change will be published on the Website together with the date on which it enters into force. In the event of significant changes, Users subscribed to the newsletter will be informed electronically.

§ 12. Final provisions

In matters not governed by this Policy, the provisions of the GDPR and other generally applicable provisions of Polish law apply.

Any questions concerning this Policy or the processing of personal data should be sent to: marketing@magicbalispa.pl.

Poznań,
1 June 2026