Privacy policy
Last updated: 27 September 2026
This site collects personal data only in order to arrange and carry out a visit. Below is exactly what, and why.
Who the controller is
The data controller is Nataliia Shevchenko, Studio Masażu KaTTeM, Juliana Ursyna Niemcewicza 14/J, 71-520 Szczecin, Poland, NIP 8513325243. Contact: +48 575 119 406.
What data, and what for
For a booking: first name, surname and phone number — in order to record the visit and confirm it by phone (Art. 6(1)(b) GDPR — performance of a contract). The optional field about what hurts is health data, a special category (Art. 9(2)(a) GDPR). I process it only on explicit consent and only to choose the right treatment. You may leave it empty and tell me in person.
Consent to messages
A separate, optional consent to messages about free times and offers, under Art. 398 of the Polish Electronic Communications Law. You may withdraw it at any time with a call or a message, without giving a reason.
Who else sees this data
The database and hosting providers: Supabase (servers in the European Union) and Vercel (site hosting). Both act as processors under a data processing agreement. I do not sell the data and do not pass it to anyone for marketing.
How long
Booking data is kept for the duration of our cooperation and 3 years after the last visit (the limitation period for claims). Health data is deleted immediately on request. Marketing consents are kept until withdrawn.
Your rights
You have the right of access, rectification, erasure, restriction of processing, portability, objection, and withdrawal of consent at any time. A phone call is enough: +48 575 119 406. You may also complain to the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
Cookies and statistics
This site uses no advertising or tracking cookies and does not profile visitors. There is no Google Analytics, no pixels and no social widgets — which is why there is no cookie banner either. A short entry in browser storage only remembers your chosen language and a booking in progress.
Security
The website has no access to the client database. Every request goes through a server-side function that returns free times only — no names, no numbers, and nothing about who is booked in.