Privacy Policy

Last updated: 30 October 2026

This is a convenience translation. In case of any discrepancy, the Polish version prevails.

This policy explains what personal data we process when you use ksbraid.com, book an appointment, pay a deposit, contact us or agree to photos of your hairstyle being published. We process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR, in Polish: RODO) and Polish law.

1. Data controller

KSBraid - Kseniia Poddubna
NIP (tax ID): 5833478610, ul. Rogalińska 23A/9, 80-809 Gdańsk, Poland
Website: https://ksbraid.com
E-mail: [email protected]
Phone: +48 730 055 947

We have not appointed a data protection officer. For any matters concerning your data, write to [email protected].

2. What data we process

Booking form data: name and surname, e-mail address, phone number, username or messenger contact (Instagram, Facebook, Telegram, WhatsApp, SMS), the chosen date, the page language and the statements and consents given.
Appointment and payment data: type of service, price, deposit amount, booking status, Tpay transaction ID and status, and refund information. We have no access to your payment card details or your bank login.
Withdrawal statement: name and surname, e-mail address, appointment date, message text and the date and time the statement was received.
Correspondence: e-mails, text messages, phone calls and social media messages about the appointment.
Service notes: e.g. the chosen colour and length, notes for the next visit, and short notes by the stylist on the condition of the hair and scalp observed before the service (point 3.5).
No-show information: that the Client did not come to the appointment without notice, and a marker that further bookings require a deposit (point 3.10).
Photos and videos of the hairstyle: only if you consent.
Technical data: IP address, browser and device information, date and time of the visit and the result of the automatic Cloudflare Turnstile anti-spam check.
Statistical data: pages visited, the referring page address and campaign parameters (UTM). See point 7 for details.

Bookings for minors are made by their parent or legal guardian, who provides their own contact details and the child's details needed for the appointment.

3. Purposes, legal bases and retention periods

3.1. Handling the booking and performing the service

Scope: Accepting the request, confirming the date, sending the deposit link, reminders (including a text message 24 hours before the appointment with a link to confirm or cancel it), rescheduling, cancelling the appointment, performing the service. We keep the phone number and the text of sent messages in the sending system for 90 days.
Legal basis: Art. 6(1)(b) GDPR: steps taken at your request before entering into a contract and performance of the contract.
Period: For the time needed to handle the booking and perform the service, and then for the period in point 3.3. If the request did not lead to a contract (the date was not confirmed or the deposit was not paid), we delete it 3 months after the planned appointment date.

3.2. Online payments (deposit)

Scope: Passing to Tpay the data needed for the payment: name and surname, e-mail, amount and order description; handling refunds.
Legal basis: Art. 6(1)(b) GDPR. Krajowy Integrator Płatności S.A. (Tpay) processes payment data as a separate controller under its own privacy policy.
Period: As in point 3.4 (settlement records).

3.3. Complaints, withdrawal from the contract and establishing, pursuing and defending claims

Scope: Handling complaints, receiving and confirming withdrawal statements, settling refunds, resolving disputes (e.g. about the deposit or the quality of the service).
Legal basis: Art. 6(1)(c) GDPR (obligations under the Polish Consumer Rights Act, including handling complaints and confirming withdrawal) and Art. 6(1)(f) GDPR: our legitimate interest in being able to defend against and pursue claims.
Period: Until the end of the sixth calendar year after the year of your last visit — the general limitation period for claims (Article 118 of the Polish Civil Code). If a dispute is ongoing, we keep the data until it ends.

If you rely on sudden illness or another unforeseen event (point 7.10 of the Terms), we may ask you to show a confirmation. We do not keep copies of such documents.

3.4. Settlements, accounting and taxes

Scope: Sales records, receipts and invoices, documentation of payments and refunds.
Legal basis: Art. 6(1)(c) GDPR in connection with tax and accounting law.
Period: 5 years from the end of the calendar year in which the tax payment deadline expired.

3.5. Visit history and service notes

Scope: Preparing future visits: previous services, chosen colours and lengths, the stylist's notes.
Legal basis: Article 6(1)(f) GDPR: our legitimate interest in ensuring continuity and quality of service for regular clients.
Period: For as long as you use our services and, after your last visit, until the end of the sixth calendar year after the year of that visit (point 3.3) or until an effective objection. After that, visit data is anonymised: we delete the name, surname and contact details, keeping only amounts and dates for statistics.

If, before or during the service, the stylist notices a condition that may affect the safety of the service (e.g. scalp irritation, weakened hair, a reaction to a material), she may make a short note of it — no diagnoses, only what can be seen. We do this so that we can show the condition of the hair and scalp before the service in the event of a complaint or dispute (Article 9(2)(f) in conjunction with Article 6(1)(f) GDPR), and to choose future services safely. We keep such a note together with the visit history, for the period stated above. If you tell us about your health yourself (e.g. an allergy), we record it only with your explicit consent (Article 9(2)(a) GDPR), which you can withdraw at any time.

3.6. Publishing photos and videos of the hairstyle (portfolio)

Scope: Taking photos or videos of the finished hairstyle and publishing them on ksbraid.com and on our profiles (Instagram, Facebook, TikTok, YouTube).
Legal basis: Your consent: Art. 6(1)(a) GDPR and Article 81(1) of the Polish Act on Copyright and Related Rights. For a minor, consent is given by a parent or legal guardian.
Period: Until you withdraw consent. After withdrawal we promptly remove the materials from the website and our profiles. Withdrawing consent does not affect the lawfulness of publication before withdrawal or your booking. We have no control over copies shared further by other people.

3.7. Website security and protecting the form against spam

Scope: Protection against attacks and bots (Cloudflare, Cloudflare Turnstile in the booking and withdrawal forms), server logs, detecting abuse.
Legal basis: Art. 6(1)(f) GDPR: our legitimate interest in keeping the website and bookings secure.
Period: Server logs store a shortened IP address (without the last part), which does not identify the visitor. Logs are automatically overwritten when they reach a size limit.

3.8. Visit statistics

Scope: Counting visits and seeing where visitors come from (point 7).
Legal basis: If you accept cookies: your consent (Art. 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law). Without consent: cookie-free counting based on Art. 6(1)(f) GDPR (our interest in basic website statistics).
Period: We keep the visitor identifier for up to 25 months. Then we replace it with a random code that cannot be linked to the browser and remove the parameters from the referring page address. We keep such anonymised statistics indefinitely.

3.9. Correspondence not related to a booking

Scope: Replying to questions sent by e-mail, text message, phone, messengers or social media.
Legal basis: Article 6(1)(f) GDPR: our legitimate interest in replying to messages.
Period: Up to 12 months after the matter is closed. If the correspondence concerns a booking, we keep it together with the booking data.

3.10. No-shows and deposit requirement

Scope: Recording that the Client did not come to the appointment without notice, and marking that for further bookings we require a deposit or may refuse the booking (point 9.6 of the Terms). The marker is linked to the phone number, e-mail address or messenger profile. A person always decides on the next booking.
Legal basis: Article 6(1)(f) GDPR: our legitimate interest in protecting ourselves against booked slots that go unused.
Period: Together with the visit history, for the period stated in point 3.5, or until an effective objection.

4. Who we share data with

We do not sell personal data or share it for marketing purposes. Data is received only by those who help us run the website and handle appointments, to the extent needed for their tasks:

OVHcloud provides the VPS server on which the website, booking system, database and the stylist's appointment calendar run (data centre in Poland, near Warsaw), and sends text message reminders about appointments. For text messages, we pass on the mobile phone number and the message text (appointment time and a link to confirm or cancel it). The stylist reads the appointment calendar directly from our server — we do not use Google or Apple calendars;
Cloudflare, Inc. handles traffic to the website, protects it against attacks, and provides Cloudflare Turnstile verification and icon libraries (cdnjs);
Resend, Inc. sends booking-related e-mails;
Telegram delivers technical notifications to the administrator (e.g. about a failed payment or a refund). They contain only the booking number, date and a description of the problem — no name, e-mail address, phone number or payment data;
push notification providers (e.g. Apple, Google, Mozilla) deliver notifications to the administrator's devices. The content of notifications is encrypted and the providers have no access to it;
Krajowy Integrator Płatności S.A. (Tpay) handles payments as an independent controller;
our accountants, to the extent of accounting documents;
messengers and social media — Meta (Instagram, Facebook, Messenger, WhatsApp), Telegram, TikTok, Google (YouTube) — handle the messages you send us through these services and, with your consent, the publication of hairstyle photos. You choose the contact channel yourself, and these services act as independent controllers under their own terms and privacy policies. We are jointly responsible with Meta for the statistics of our Facebook and Instagram profiles (Article 26 GDPR);
public authorities, where required by law.

5. Transfers outside the European Economic Area

Some providers are based in the United States or may process data outside the EEA:

Cloudflare, Inc. and Resend, Inc. (USA) participate in the EU-U.S. Data Privacy Framework. The European Commission has recognised it as ensuring an adequate level of data protection (decision of 10 July 2023). Standard contractual clauses approved by the Commission provide an additional safeguard.
Telegram may process data outside the EEA, in countries for which the Commission has not issued an adequacy decision. For this reason we do not send any data that identifies the Client via Telegram — only the booking number and a description of the problem (point 4).
Messengers and social media process data under their own rules, described in their privacy policies.

On request sent to [email protected], we will provide information on the safeguards applied.

6. Your rights

You have the right to:

access your data and obtain a copy;
request rectification of inaccurate data;
request erasure of your data if we no longer need to keep it (e.g. for settlements or defending claims);
request restriction of processing;
receive the data you provided to us in a machine-readable format (data portability) if we process it on the basis of a contract or consent;
object to processing based on our legitimate interest (points 3.3, 3.5, 3.7, 3.8, 3.9, 3.10);
withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).

To exercise your rights, write to [email protected]. We will reply without undue delay and no later than within one month. We may ask for information needed to confirm that the request comes from the person the data concerns.

7. Cookies and statistics

Essential (no consent needed, Article 399(3) of the Polish Electronic Communications Law):

Cloudflare cookies that protect the website against bots and attacks, and the Cloudflare Turnstile mechanism in the booking form;
a record of your cookie choice in browser storage (localStorage, key ksbraid_cookie_consent).

Statistical (only with your consent): after you click "Accept" in the banner, we store a persistent visitor identifier in your browser. It lets us tell new visits from returning ones. The cookie is valid for up to 12 months or until you withdraw consent.

Without consent we do not store any identifier in your browser. Visits are counted on the server using a hash of the IP address and browser data that changes every day. It cannot be used to link visits from different days.

Statistics run on our own server. We do not use Google Analytics, advertising pixels or other external tracking tools, and we do not share this data with anyone.

8. Other information

Do you have to provide data? Providing data is voluntary, but without your name, e-mail address, phone number and contact we cannot accept a booking or contact you. Consent to photos and to statistical cookies is entirely voluntary and does not affect the booking.
Automated decisions: we do not make decisions with legal effects for you solely by automated means and we do not profile clients. The Turnstile check automatically filters out bots. If you still cannot submit the form, call or write to us.
Security: connections to the website are encrypted (TLS), and only authorised persons have access to the admin panel and the database.
Changes to the policy: we publish the current version on this page with the date of the last update. We will inform you by e-mail of significant changes affecting ongoing bookings.

Back to home page