How we protect your data

1. Data controller

The data controller is VHAYE&KESS ENTERPRISES spółka z ograniczoną odpowiedzialnością, ul. Skierniewicka 14, 01-230 Warszawa, Poland, NIP 5252877627, REGON 520013649, KRS 0000923326 (the "Studio", "we").

Privacy contact: hello@vibratewarsaw.com

2. What data we collect and why

Contact form

We collect your name, email address, subject and message. Legal basis: Art. 6(1)(a) GDPR (consent) for general enquiries, or Art. 6(1)(b) GDPR (steps prior to a contract) for service-related enquiries.

Diagnostic form (pre-consultation)

We collect your name, contact details and a free-text description of your hair condition and goals. This is not special-category data under Art. 9 GDPR. Legal basis: Art. 6(1)(b) GDPR (necessary for delivering the service).

Server logs

Our hosting provider (Vercel Inc.) processes access logs that include IP addresses under legitimate interest (security and diagnostics), in accordance with Vercel's own privacy policy.

Google Maps

The map on the contact page is loaded only on your request (clicking the button). Loading it sends your IP address to Google LLC (USA). Legal basis: Art. 6(1)(a) GDPR (your consent, expressed by clicking).

3. Recipients — processors

• Resend Inc. — transactional email delivery from forms (DPA signed)
• Vercel Inc. — site hosting and serverless functions (DPA signed)
• GitHub Inc. — CMS backend (Decap CMS; studio staff access only)
• Booksy Inc. — online booking system; Booksy is a separate data controller and bookings made through it are subject to Booksy's own privacy policy

Resend and Vercel are based in the USA. Transfers rely on Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46(2)(c) GDPR.

4. Retention

Form data is retained for as long as needed to handle your enquiry, then up to 12 months, unless it gives rise to a contract or claim. After that period data is deleted.

5. Your rights

You have the right to access, rectify, erase, restrict processing of, port, and object to the processing of your data, and to withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, contact us at: hello@vibratewarsaw.com

You have the right to lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

6. Client images and testimonials

Photos of service results and named client testimonials published on this site are used on the basis of consent (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time — the photo or testimonial will be removed. Contact us at hello@vibratewarsaw.com.

7. Children's data

This site is not directed at children under 16 submitting their own enquiries. The Polish digital consent age is 16. Bookings for minors should be made by a parent or legal guardian.

8. Automated decision-making

We do not engage in automated decision-making or profiling within the meaning of Art. 22 GDPR.

9. Cookies and tracking

For full details see our Cookie Policy. We do not use analytics or marketing cookies.