Last updated: 27 August 2026
1. Who processes your data
The controller of your personal data is Deep Calm Oasis — Paulina Rakoczy, Pniewo 71, 99-311 Bedlno, Poland.
For any matter concerning your personal data:
e-mail: info@deepcalm.pl
phone: +48 726 749 225
2. What we collect and why
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Contact form | name, e-mail address, message | answering your enquiry | Art. 6(1)(f) — our legitimate interest in replying to someone who contacted us |
| Booking an appointment | name, e-mail, phone, chosen treatment, date and time, any notes you add | arranging and delivering the appointment, confirmations and reminders | Art. 6(1)(b) — performance of a contract |
| Client Panel account | as above plus your appointment history | letting you manage your own bookings | Art. 6(1)(b) — performance of a contract |
| Online payment | transaction data | taking payment for the treatment | Art. 6(1)(b) — performance of a contract |
| Accounting | data required for accounting records | tax and accounting obligations | Art. 6(1)(c) — legal obligation |
We do not collect health data through this website. If you tell us about how you feel or about any contraindications before a treatment, that happens in person at the salon and only with your explicit consent (Art. 9(2)(a) GDPR). Please do not enter such information in the booking notes field.
3. Is providing data mandatory
Providing your data is voluntary, but it is necessary to book an appointment or receive a reply. Without it we simply cannot do either.
4. How long we keep it
- Contact form messages — up to 12 months after our correspondence ends.
- Booking data and Client Panel account — for as long as you use our services, and after your last visit until claims become time-barred (as a rule 3 years).
- Accounting records — 5 years from the end of the tax year, as required by law.
5. Who we share it with
Your data only reaches parties we need in order to run the salon and the website. Each of them processes it on our instructions, under a data processing agreement:
- Hetzner Online GmbH (Germany) — the server running the website and booking system;
- OVH — e-mail on the deepcalm.pl domain;
- Stripe Payments Europe Ltd. (Ireland) — online payments. We never see or store your card number — you enter it directly with Stripe;
- EWWW / ExactDN — faster delivery of images on the site;
- Trustindex — displaying client reviews on the home page;
- our accountant — for accounting records.
We do not sell your data and we do not share it with anyone for marketing purposes.
6. Transfers outside the European Union
Our servers and e-mail are located within the European Union. Stripe may transfer data to the USA on the basis of Standard Contractual Clauses approved by the European Commission and under the Data Privacy Framework.
7. Your rights
At any time you have the right to:
- access your data and receive a copy of it,
- have inaccurate data corrected,
- have your data erased (“right to be forgotten”),
- restrict processing,
- data portability,
- object to processing based on our legitimate interest,
- withdraw consent at any time — without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, simply write to info@deepcalm.pl. We reply within one month.
If you believe we process your data unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
8. Cookies
This site uses no tracking or advertising tools — there is no Google Analytics, no advertising pixels and no profiling. That is why we show no cookie consent banner: we only use cookies strictly necessary for the site to work.
- Language cookie — remembers whether you are viewing the site in Polish, Dutch or English.
- Booking system cookie — keeps your session while you book an appointment or sign in to the Client Panel.
- Stripe cookie — appears only at the payment stage and protects the transaction against fraud.
You can delete or block cookies in your browser settings at any time. This may, however, make booking impossible.
9. Automated decision-making
None. We do not profile you and we make no automated decisions about you.
10. Changes to this policy
If we change how we process data, we will update this page and change the date at the top of the document.