§1Controller
1.1The controller of personal data processed in connection with the website aesthetech.pl (the “Website”) is AESTHETECH Sp. z o.o., ul. Hubska 52/14, 50-502 Wrocław, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS 0001191504, NIP 8993034214, REGON 54257370400000 (“AESTHETECH”, “we”).
1.2We have not appointed a data protection officer. For anything related to your data, contact us at kontakt@aesthetech.pl or by post at the address above, marked “Personal data”.
§2Scope of this policy
2.1This policy explains how we process the personal data of people who visit the Website, contact us, or represent our clients, prospects and suppliers.
2.2It does not cover personal data that our clients process using our products, Loop CRM and the AI agent (for example, data of visitors to a client’s website or of a client’s customers). For that data the client is the controller and we act as its processor under the Data Processing Agreement. Please refer to the privacy policy of the business whose website or service you used.
§3What we process, why, and on what legal basis
3.1We process personal data only for the purposes below, on the legal bases set out in Article 6(1) of Regulation (EU) 2016/679 (“GDPR”).
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Replying to your enquiry sent through the contact form or by email, and preparing a quote | Name, work email, company (optional), content of the message, language of the page | Steps taken at your request before entering into a contract (Art. 6(1)(b)); our legitimate interest in answering business correspondence (Art. 6(1)(f)) | Until the enquiry is handled, then up to 3 years from our last contact to defend against claims, unless a contract follows |
| Performing a contract with a client and keeping in touch with the people who represent the client | Name, role, business contact details, correspondence | Performance of the contract (Art. 6(1)(b)); our legitimate interest in contact with the client’s representatives (Art. 6(1)(f)) | For the term of the contract and until claims under it become time-barred |
| Accounting and tax obligations | Data on invoices and accounting records | Legal obligation (Art. 6(1)(c)), in particular the Polish Accounting Act | 5 years from the end of the financial year concerned |
| Keeping the Website available and secure | IP address, browser and device data, requested URL, time of request (server logs) | Our legitimate interest in the security and operation of the Website (Art. 6(1)(f)) | As long as our hosting provider keeps request logs, which is a short, limited period |
| Measuring how the Website is used, in aggregate | Pages viewed, referrer, country, browser, operating system and device type; a daily request hash that cannot identify you | Our legitimate interest in understanding and improving the Website (Art. 6(1)(f)) | Aggregated statistics only; the request hash is discarded within 24 hours |
| Establishing, exercising or defending legal claims | Data relevant to the claim | Our legitimate interest (Art. 6(1)(f)) | Until the claim is finally resolved |
3.2Where we rely on our legitimate interest, we have balanced it against your interests and rights. You can object to this processing at any time (see Section 7).
§4Where the data comes from and whether you have to give it
4.1We obtain data directly from you, from the person who referred you to us, or from your employer when you represent a client or supplier.
4.2Providing data is voluntary. Without a name, an email address and a message we cannot reply to your enquiry. Data required to conclude and perform a contract or to issue an invoice is a condition of that contract.
§5Who receives the data
5.1We share personal data only to the extent needed, with the following categories of recipients:
- (a)our hosting provider Vercel Inc. (USA), which hosts the Website, keeps request logs and provides Vercel Web Analytics;
- (b)providers of email, communication and office software that we use to handle correspondence;
- (c)accounting, legal and IT service providers bound by confidentiality;
- (d)public authorities, where we are legally required to disclose data.
5.2Our service providers act on our instructions under data processing agreements, except where they are independent controllers by law (for example, banks or authorities).
§6Transfers outside the European Economic Area
6.1Vercel Inc. is established in the United States. Transfers to Vercel are based on its certification under the EU–US Data Privacy Framework (Commission Implementing Decision of 10 July 2023) and, additionally, on the Standard Contractual Clauses adopted by the European Commission. Other transfers outside the EEA, if any, take place only on the basis of an adequacy decision or appropriate safeguards under Chapter V GDPR.
6.2You can request a copy of the safeguards applied by writing to kontakt@aesthetech.pl.
§7Your rights
7.1Under the GDPR you have the right to:
- (a)access your data and receive a copy of it (Art. 15);
- (b)have inaccurate data rectified (Art. 16);
- (c)have your data erased (Art. 17);
- (d)restrict processing (Art. 18);
- (e)data portability, for data processed on the basis of a contract (Art. 20);
- (f)object, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21).
7.2To exercise a right, write to kontakt@aesthetech.pl. We will respond within one month; in complex cases this may be extended by two further months, of which we will inform you.
7.3You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland.
§8Automated decision-making
8.1We do not make decisions about you based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.
§9Security
9.1We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections (TLS), access limited to people who need it, multi-factor authentication for the systems we use, and contracts with our service providers.
§11Changes to this policy
11.1We may update this policy when the way we process data or the law changes. The current version and its effective date are shown at the top of this page, and previous versions are listed in the version history below.
Version history
| 2.0 | 6 October 2026 | Full revision: purposes and legal bases table, retention, recipients, transfers, products processed under the DPA. |
| 1.0 | 13 June 2026 | First version. |
Questions about this document
AESTHETECH Sp. z o.o.
Hubska 52/14, 50-502 Wrocław
kontakt@aesthetech.pl
Other documents