Privacy policy

Data controller

The controller of your personal data is Bohdan Vasylyshyn VB Company, ul. Skłodowskiej-Curie 28b/4, 85-094 Bydgoszcz, Poland, NIP: 9671389596, REGON: 528297273. The controller operates both Theodore’s Barber Shop salons. For privacy enquiries, email kontakt@theodoresbarbershop.com.

Contact form — data and purposes

We process your name, email address, selected subject and message to handle your enquiry. Providing this information is voluntary, but necessary to send the form and receive a response this way. Please do not send sensitive information or other people’s data unless needed to handle your enquiry.

Our basis for ordinary correspondence is our legitimate interest in communicating with people interested in our services (Article 6(1)(f) GDPR). Enquiries about entering into or performing a contract are handled under Article 6(1)(b). Preventing abuse and establishing, exercising or defending legal claims rely on Article 6(1)(f). Statutory record-keeping obligations rely on Article 6(1)(c).

Retention

We keep ordinary contact-form correspondence in our email account for no more than 12 months after the correspondence ends. Messages documenting contracts, accounts or legal claims may be retained longer, for the statutory period or as necessary to establish, exercise or defend claims until the applicable limitation period expires.

The website does not maintain a separate database of message contents. Form protection stores a pseudonymised IP identifier and attempt time in a technical file; records older than one hour are removed during the next processed request. Hosting logs and backups may have separate retention cycles depending on the service and configuration.

Recipients

Data may be processed by authorised people handling correspondence and by hosting, email and IT support providers to the extent necessary to provide their services. Google provides reCAPTCHA, Google Analytics 4 and external maps. Public authorities may receive data where required by law.

reCAPTCHA and security

The form is protected by Google reCAPTCHA. Its script starts when you attempt to submit the form, only after separate consent to reCAPTCHA in privacy settings and analyses technical signals, such as your IP address, browser and interaction information, to detect bots and abuse. It may use the _GRECAPTCHA cookie. Google processes reCAPTCHA data as a processor under its service terms and Google Cloud Data Processing Addendum. We do not use the result to make decisions with legal effects on you; it may block form submission. You can contact us by email or phone instead.

Cookies, browser storage and consent

Necessary localStorage remembers your selected theme (theodores-theme, until site data is cleared) and privacy choice (theodores-consent-v1, for 180 days). Optional services are disabled by default. You may accept all, reject optional services or choose analytics, maps and reCAPTCHA separately. Privacy settings are available in the footer and next to the form. Withdrawing consent does not affect the lawfulness of earlier processing.

Google Maps loads only with your consent to maps. Google then receives your IP address and browser information and may use cookies. Consent to maps and reCAPTCHA covers their optional activation and associated personal data processing (Article 6(1)(a) GDPR). Without these consents, you can use the directions link and contact us by email or phone. Fonts are hosted on our own server without connecting to Google Fonts.

Booksy, Instagram and Facebook are external links. Their operators’ policies apply when you visit them. Appointments are booked through Booksy, outside this website’s contact form.

Google Analytics 4

Once Google Analytics 4 is configured and you consent to analytics, we measure page visits to understand interest in the website and improve it. The legal basis is consent (Article 6(1)(a) GDPR). Google processes cookie identifiers and browser, device and visited-page information. We do not send contact-form entries, URL query parameters or fragments to analytics. Google Signals and advertising personalisation are disabled.

Before consent, we do not load Google Analytics or send measurements. Cookies _ga and _ga_* are set for up to 180 days without automatic renewal by our configuration. Withdrawing consent stops further measurement and deletes analytics cookies accessible to the website. Data already collected is subject to retention settings in the Google Analytics account; contact the controller for details.

Transfers outside the EEA

Google services may involve processing outside the European Economic Area, including in the USA. Safeguards provided for in the provider’s terms include applicable adequacy decisions or standard contractual clauses. Contact the controller for information about the mechanism used and a copy of the safeguards.

Your rights

Subject to the GDPR, you may request access, rectification, erasure, restriction of processing and, where applicable, data portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Send requests to kontakt@theodoresbarbershop.com. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (uodo.gov.pl).