Effective date: 29 July 2026

1. General provisions

These rules set out the principles for processing personal data by Fast Line Studio Sp. z o.o. (hereinafter the „Controller”), in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR/RODO).

The purpose of these rules is to ensure transparency and security in processing the personal information of the Salons’ clients and business partners.

2. Data controller

The controller of personal data is:

Fast Line Studio Sp. z o.o.
Registered office: Osiedle Avia 1/U4, 31-877 Kraków
Email: [email protected]
Phone: +48 579 777 634

3. Categories of personal data processed

The Controller processes the following categories of personal data:

  • Identification data: first name, surname, PESEL number (if required);
  • Contact data: e-mail address, phone number, residential address (if required);
  • Booking data: preferred appointment times, booking history;
  • Service data: type of treatment, treatment result, staff notes, „before and after” photos (with consent);
  • Health data: information on allergies, contraindications, medical conditions (Art. 9 GDPR);
  • Payment data: bank account number, transaction history, payment method;
  • Financial data: invoices, bills, settlement data;
  • Employee data: first names, surnames, PESEL numbers, contact details.

4. Purposes of processing personal data

Personal data are processed for the following purposes:

  • Provision of hairdressing and beauty services (Art. 6(1)(b) GDPR);
  • Handling online bookings and managing the appointment schedule;
  • Processing payments via Przelewy24 and other payment systems;
  • Issuing invoices and tax settlements (Art. 6(1)(c) GDPR);
  • Handling complaints and claims (Art. 6(1)(b) and (c) GDPR);
  • Marketing communication (newsletter, SMS, email) — with the client’s explicit consent (Art. 6(1)(a) GDPR);
  • Ensuring the safety of clients and staff — storing information on allergies (Art. 9(2)(h) GDPR);
  • The controller’s legitimate interest — own marketing, client satisfaction surveys (Art. 6(1)(f) GDPR);
  • Fulfilling obligations arising from labour and tax law (Art. 6(1)(c) GDPR).

5. Legal basis for processing

Personal data are processed on the basis of:

  • Art. 6(1)(b) GDPR — performance of a service contract;
  • Art. 6(1)(c) GDPR — compliance with legal obligations (tax law, labour law);
  • Art. 6(1)(a) GDPR — consent to processing (marketing, photos);
  • Art. 6(1)(f) GDPR — the controller’s legitimate interest (own marketing, satisfaction surveys);
  • Art. 9(2)(h) GDPR — health protection (information on allergies and contraindications).

6. Disclosure of personal data

Clients’ and employees’ personal data may be disclosed to the following entities:

  • Payment service providers: Przelewy24 (PayPro S.A.) — for processing online payments;
  • IT and hosting service providers — for maintaining the booking system and website;
  • Accounting office — for keeping tax and financial books;
  • Salon administrative staff — to the extent necessary to perform their duties;
  • Public and judicial authorities — on the basis of law or a court decision;
  • Other entities — solely with the explicit and voluntary consent of the data subject.

7. Retention period for personal data

The retention period depends on the purpose of processing:

  • Service data (visit history, notes) — for the entire duration of the business relationship and 2 years after the contract ends;
  • Data for invoices and tax settlements — 5 years (tax law provisions);
  • Health data (allergies) — for the entire duration of the relationship and 3 years after it ends;
  • Employee data — for the entire period of employment and 5 years after it ends (labour law provisions);
  • Data for marketing communication — until consent is withdrawn;
  • „Before and after” photos — for the entire period of use in marketing (until consent is withdrawn).

8. Rights of data subjects

Under the GDPR, every data subject has the right to:

  • Access to their personal data — the right to obtain a copy of the data processed;
  • Rectification (correction) of data — the right to correct erroneous or incomplete data;
  • Erasure of data („right to be forgotten”) — the right to have data deleted in certain cases;
  • Restriction of processing — the right to suspend the processing of data;
  • Data portability — the right to receive the data in a structured format and transfer it to another controller;
  • Objection to processing — the right to object to processing based on legitimate interest;
  • Withdrawal of consent at any time — without affecting the lawfulness of processing before withdrawal;
  • Not to be subject to decisions based solely on automated processing.

To exercise the above rights, please contact us:
Email: [email protected]
Phone: +48 579 777 634
In person at: Osiedle Avia 1/U4, 31-877 Kraków

9. Security of personal data

The Controller applies appropriate technical and organisational measures to protect personal data:

  • Encryption of transmitted data (https, SSL/TLS);
  • Access control — only authorised staff have access to the data;
  • Regular data backups;
  • Password and authentication security policy;
  • Staff training in data protection;
  • Security incident response procedures;
  • Data processing agreements with subcontractors (e.g. Przelewy24, accounting office).

10. Cookies policy and technical data

The Fast Line Studio website (www.fastlinestudio.pl) may use cookies and other tracking technologies:

  • Session cookies — to remember the user’s session state;
  • Analytics cookies (Google Analytics) — to analyse website traffic;
  • Functional cookies — to remember the user’s preferences;
  • Marketing cookies — for retargeting advertising (with consent).

The user can manage cookie settings in their web browser settings (Chrome, Firefox, Safari, Edge).

11. Contact with the controller and Data Protection Officer

For any questions regarding the protection of personal data, you may contact:

Data controller:
Email: [email protected]
Address: Osiedle Avia 1/U4, 31-877 Kraków

12. Right to lodge a complaint

If a person believes that their rights have been violated, they have the right to lodge a complaint with:

The President of the Personal Data Protection Office (UODO)
Address: ul. Stawki 2, 00-193 Warszawa
Website: www.uodo.gov.pl

13. Final provisions

  • These rules enter into force on the date of publication on the website.
  • The Controller reserves the right to amend these rules. It will notify users of any changes by publishing the amended text on the website.
  • These rules are binding on all website users and clients of Fast Line Studio.