Privacy Policy

This Privacy Policy sets out the rules for processing and protecting the personal data of Users of the gentlemen-krakow.pl website (the “Website”) and the rules for using cookies.

§ 1. Data Controller

1. The controller of personal data is:
   • Name: ELTAJ MAMISHOV SHAH
   • Address: ul. Starowiślna 22/U5, 31-032 Kraków, Poland
   • Tax ID (NIP): 9452317622
   • REGON: 542799070
2. The Controller can be contacted by e-mail: kontakt@gentlemen-krakow.pl or by phone: +48 732 126 188.

§ 2. Purposes and Legal Bases of Processing

Users’ personal data are processed for the following purposes and on the following legal bases:

• Handling phone or e-mail contact (name, phone number, e-mail address, message content) – Art. 6(1)(f) GDPR (the Controller’s legitimate interest in replying) or Art. 6(1)(b) GDPR where the contact concerns booking an appointment.
• Providing services at the salon (name, phone number, visit history) – Art. 6(1)(b) GDPR (necessary for the performance of a contract).
• Booking appointments via Booksy – data entered in Booksy are processed by its operator as a separate controller under the Booksy privacy policy; the Controller receives the data necessary to carry out the appointment (Art. 6(1)(b) GDPR).
• Handling complaints – Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (establishing and defending claims).
• Analytical, statistical and marketing purposes (activity data collected through cookies and similar technologies) – Art. 6(1)(f) GDPR or the User’s consent (Art. 6(1)(a) GDPR) where required by law.

§ 3. Recipients of Data

Users’ personal data may be shared with the following categories of recipients:

• hosting and e-mail service providers that store data on their servers,
• Booksy International sp. z o.o. – the operator of the online booking system,
• Google Ireland Ltd. – analytics and advertising tools (Google Analytics, Google Ads),
• Meta Platforms Ireland Ltd. – analytics and advertising tools (Meta Pixel),
• entities authorised under applicable law.

Entities entrusted with data processing are obliged to apply the data protection measures required by law. In the case of Google and Meta tools, data may be transferred outside the European Economic Area on the basis of standard contractual clauses or an adequacy decision of the European Commission.

§ 4. Rights of Data Subjects

In connection with the processing of personal data, the User has the following rights:

1. The right of access to their data and to obtain a copy.
2. The right to rectification of their data.
3. The right to erasure (the “right to be forgotten”).
4. The right to restriction of processing.
5. The right to data portability.
6. The right to object to processing.
7. The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
8. The right to lodge a complaint with a supervisory authority, i.e. the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

To exercise these rights, please contact the Controller by e-mail: kontakt@gentlemen-krakow.pl.

§ 5. Data Retention Period

Personal data are stored for the period necessary to achieve the purpose for which they were collected: contact data – until the correspondence is completed, visit-related data – for the period required by law (e.g. tax and accounting regulations) or until any claims become time-barred, analytical data – for the period set in the settings of the individual tools, no longer than 26 months.

§ 6. Cookies

1. The Website uses cookies, i.e. small text files stored on the User’s device (e.g. computer, tablet, smartphone).
2. The Website uses the following types of cookies:
   • necessary – ensuring the proper functioning of the Website (e.g. remembering the selected language),
   • analytical – Google Analytics, used to analyse traffic and how the Website is used,
   • marketing – Google Ads and Meta Pixel, used to measure the effectiveness of advertising and to tailor advertising content.
3. The User can manage cookies in their web browser, including blocking or deleting them entirely. Disabling cookies may affect the functioning of some elements of the Website.
4. More information on data processing by Google and Meta is available in the privacy policies of those providers.

§ 7. Data Security

The Controller applies appropriate technical and organisational measures to ensure the security of the personal data processed, in particular protecting data against disclosure to unauthorised persons, loss or damage. The Website uses an encrypted SSL connection.

§ 8. Final Provisions

The Controller reserves the right to amend this Privacy Policy. The current version of the Privacy Policy is always available on the Website. This version applies from 11 September 2026.