Last updated: October 4, 2026.
1. Data controller
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "GDPR"), we hereby inform you that the Controller of your personal data is INCOGNITO MENTAL TRAINING SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office at 1 Wandy Street, 40-322 Katowice, NIP: 9542846695, KRS: 0000998835, operating the Floating Nowoczesne SPA salon in Cieszyn (hereinafter referred to as the "Controller"). Contact in matters of personal data: floatingcieszyn@gmail.com.
2. What data do we process?
Depending on how you use our services and website, we may process: your name, phone number, email address, billing information (address, company name, Tax Identification Number), order and payment information (excluding your card number – your card details are processed exclusively by your payment provider), appointment details, correspondence content, and technical data related to your use of the website (IP address, cookie identifiers, browser and device type, information about subpages visited). Please do not provide us with any health data unless it is necessary for the safe performance of the procedure – in such cases, providing such data is voluntary.
3. Purposes and legal basis of processing
- conclusion and performance of the contract (booking and implementation of visits, sale and implementation of vouchers, processing orders and payments) – Article 6(1)(b) of the GDPR;
- fulfillment of legal obligations (in particular tax and accounting, issuing and storing sales documents) – Article 6, paragraph 1, letter c of the GDPR;
- handling inquiries, correspondence and complaints – Article 6 paragraph 1 letter b or f of the GDPR (legitimate interest of the Controller in answering questions and considering complaints);
- establishing, pursuing or defending against claims and ensuring the security of the website – Article 6(1)(f) of the GDPR;
- website traffic statistics and analysis (Google Analytics) and the use of non-essential cookies – Article 6(1)(a) of the GDPR and Article 173 of the Telecommunications Law, based on the consent expressed in the cookie banner.
Providing your data is voluntary, but necessary to conclude a contract, book a visit, or purchase a voucher; without it, we cannot provide the service. We do not make automated decisions, including profiling, that would have legal consequences for you.
4. Data recipients
Data may be entrusted or shared with entities whose services we use, based on a processing agreement or other legal basis, as well as with entities authorized by law (e.g., tax authorities and law enforcement agencies). Recipients include, in particular:
- Polcard limited liability company with its registered office in Warsaw, ul. Cypryjska 72, 02-781 Warsaw, KRS: 0000649243, NIP: 5250010019 – online payment gateway operator (handling card, BLIK and transfer payments);
- Booksy Sp. z o. o. with its registered office in Warsaw, ul. Domaniewska 45E, KRS: 0000672322 – appointment booking system (in terms of bookings made via it);
- IT service providers: website hosting, email and messaging tools;
- entities handling the accounting and settlements of the Administrator and banks in the scope of payment processing;
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (USA) – in relation to Google Analytics and YouTube videos, only on the terms described in points 5, 8 and 9;
- Trustindex – provider of the widget that displays Google reviews on our website.
The LatePoint reservation system installed on our website runs on the Administrator's server, and the data stored in it is not transferred to its manufacturer.
5. Transfer of data outside the European Economic Area
As a rule, we do not transfer data outside the European Economic Area. Data may be transferred to the United States only in connection with the use of Google services (Google Analytics upon consent and playback of YouTube content). This is done based on the mechanisms provided for in the GDPR, in particular the European Commission Implementing Decision of 10 July 2023 establishing an adequate level of data protection under the EU-US Data Privacy Framework, or standard contractual clauses.
6. Data storage period
- data related to the contract and the execution of the order – for the duration of the contract and then until the expiry of the limitation period for claims (as a rule, 6 years, and in the case of claims related to running a business – 3 years);
- sales documents and data contained therein – for the period required by tax and accounting regulations, generally 5 years from the end of the calendar year in which the tax obligation arose;
- correspondence and inquiries – for the time necessary to process them and then until the expiry of the limitation period for any claims;
- data processed on the basis of consent (including analytical cookies) – until its withdrawal or the cookie expires (Google Analytics: up to 2 years).
7. Rule of law
The data subject is entitled to:
- right of access to data and obtain copies thereof;
- the right to rectification incorrect or incomplete data;
- the right to delete data in the cases provided for in Article 17 of the GDPR;
- the right to restrict processing in the cases provided for in Article 18 of the GDPR;
- the right to data portability processed on the basis of consent or contract in an automated manner;
- right to object to processing based on the legitimate interest of the Controller, for reasons related to your particular situation;
- the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You can change your cookie consent at any time using the cookie settings icon in the lower left corner of the page.
To exercise these rights, please contact: floatingcieszyn@gmail.com. You are also entitled to the right to file a complaint to the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, tel. 22 531 03 00, e-mail: kancelaria@uodo.gov.pl).
8. Cookies
The website uses cookies, which are small text files stored on the user's device. We store cookies necessary for the site to function without consent; others only after consent is provided in the cookie banner. We use the following categories:
- necessary – ensure proper operation of the website and security (e.g. remembering the selection in the cookie banner);
- functional – remember user settings, e.g. selected website language;
- analytical – Google Analytics 4, which allows us to count visits and see how users use the site so that we can improve it.
We currently do not use advertising cookies or remarketing tools. If this changes, we will update this policy and request your consent. You can also change cookie settings in your web browser, which may affect some site features.
9. External services embedded on the website
- YouTube – Videos are loaded in enhanced privacy mode only after the user clicks on them. After playing the video, YouTube (Google) receives information that the user has accessed the content on our website.
- Google Reviews (Trustindex) – the widget displaying reviews loads resources from the provider’s servers, which involves sending technical data to it (including the IP address).
- Booksy – after clicking the booking button on the Booksy website, the data is processed in accordance with its privacy policy.
- Social media profiles (Facebook, Instagram) – we process the data of people visiting our profiles solely for the purpose of maintaining and optimizing their content; the relevant social media operator is also a joint data controller in this regard. Clicking a link to a profile takes you to an external website, the terms of which are governed by its privacy policy.
10. Policy Changes
We may update this privacy policy, particularly if the tools we use or the regulations we use change. The current version is always available on this page.