Privacy Policy

This Privacy Policy sets out the rules for processing and protecting personal data provided by Users in connection with the use of the gentlemen-radom.pl website (the “Website”) – including online booking, the purchase of gift vouchers and the recruitment form – as well as the rules for using cookies.

Last updated: 28.09.2026.

§ 1. Personal Data Controller

1. The Personal Data Controller (Controller) is:
   • Name: WK KŁOSOWICZ SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
   • Registered office: ul. Mazowiecka 62, 35-324 Rzeszów, Poland
   • NIP (tax ID): 5170451307
   • KRS: 0001126778
2. You can contact the Controller by e-mail at listopadowa@gentlemen-radom.pl.

§ 2. Purposes and Legal Bases of Processing

We process personal data for the following purposes and on the following legal bases:

• Online booking and handling of your visit (§ 3) – Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract and performance of the service contract).
• Fulfilling gift voucher orders and handling payments (§ 4) – Art. 6(1)(b) GDPR (necessity for the performance of a contract).
• Handling complaints or withdrawal from the contract, and tax and accounting obligations – Art. 6(1)(c) GDPR (legal obligation of the Controller).
• Replying to messages and calls – Art. 6(1)(f) GDPR (the Controller’s legitimate interest in communicating with customers) and, where the matter concerns a visit or an order, Art. 6(1)(b) GDPR.
• Recruitment – legal bases described in § 5.
• Statistics and measuring the effectiveness of advertising (Google Ads, Meta; § 6) – Art. 6(1)(f) GDPR (the Controller’s legitimate interest in analysing the use of the Website, measuring the effectiveness of ads and attributing bookings to advertising campaigns).
• Website security and the establishment, exercise or defence of legal claims – Art. 6(1)(f) GDPR.

Providing data is voluntary, but without a phone number we cannot accept an online booking, and without the buyer’s details we cannot accept a voucher order.

§ 3. Online Booking

1. When you book a visit using the form on the Website, you provide your phone number (in some forms also your first and last name) and choose the service, the barber, the date and the time. Together with these, we record the price of the visit and any discount.
2. Booking data is sent from the Website’s server to the n8n automation system, which saves the visit in the salon’s calendar kept in the Booksy system. A confirmation of the visit may be sent by text message to the number provided.
3. The Website keeps a technical log of booking requests on its server (among other things, to detect duplicate requests) and statistics on how the form is used (e.g. the chosen service, barber, date, price, a random session identifier). The form statistics – without the phone number – are sent to the RazorFlow system, which we use to run the salon and the booking module.
4. The booking form stores in your browser’s storage (localStorage and sessionStorage) the chosen service and random session identifiers, among other things, so that you do not have to select them again.
5. Information that a booking has been submitted and confirmed (together with the hashed phone number) is sent to Google Ads and Meta – see § 6 for details.
6. If you click a button leading to Booksy, you go to the Booksy service, which processes your data under its own privacy policy.

§ 4. Gift Voucher Purchase

1. When you order a voucher, we process: the buyer’s first and last name, e-mail address and phone number, the recipient’s name, the chosen delivery method and shipping details (InPost parcel locker or courier delivery address), the value and status of the order and payment, as well as the IP address and browser information recorded with the order.
2. Payments are handled by PayU S.A. – we pass on to PayU the data needed for the payment (first and last name, e-mail address, phone number, amount, IP address). A physical voucher is delivered by InPost or a courier company.
3. Order data is stored on the Website’s server and, once the order has been paid, sent to the automation system that handles order fulfilment.
4. After the order has been paid, information about the purchase (value, event identifier, hashed e-mail address and phone number, IP address, browser information and identifiers from Meta cookies) is sent to Meta to measure the effectiveness of advertising – see § 6.

§ 5. Recruitment

1. Purpose. We process candidates’ data in order to carry out recruitment for the position of barber at Gentlemen Barber Shop Radom (MULTIVO and ul. Listopadowa 17J) – based on an application sent via the form on the Praca page (in Polish), by phone or by e-mail.
2. Scope of data. From the form: first name, phone number and information about your experience (required) and – optionally – e-mail address, a link to your Instagram or portfolio, the date from which you can start, the chosen salon and the content of your message. If you send us other data (e.g. a CV), we process it as well.
3. Legal bases. Data required by law: for an employment contract – Art. 6(1)(c) GDPR in conjunction with Art. 22¹ of the Polish Labour Code; for a civil-law contract (contract of mandate, B2B) – Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract). Additional data you provide voluntarily – your consent (Art. 6(1)(a) GDPR). Use of your data in future recruitment – a separate, voluntary consent (Art. 6(1)(a) GDPR). Keeping data after the end of the recruitment in case of claims – the Controller’s legitimate interest (Art. 6(1)(f) GDPR).
4. Recipients. An application from the form is sent by e-mail from the Website’s server to kontakt@gentlemen-radom.pl – the form does not store applications in a database. The data may be processed by the hosting and e-mail provider (SEOHOST) and by Google (the Gmail service to which mail from this address is forwarded).
5. Retention period. Until the end of the recruitment you are taking part in and, after it ends, for no longer than 3 months (in case of possible claims). If you consent to taking part in future recruitment – for 12 months from sending the application or until you withdraw your consent.
6. Withdrawing consent. You can withdraw your consent at any time by writing to kontakt@gentlemen-radom.pl. Withdrawal does not affect the lawfulness of processing carried out before it.
7. Your rights. You have the rights described in § 11. Providing your first name, phone number and information about your experience is voluntary, but without them we cannot consider your application. We do not make recruitment decisions by automated means. Recruitment contact: kontakt@gentlemen-radom.pl.

§ 6. Analytics and Advertising Tools

1. We use the following tools on the Website:
   • Google Ads (Google Ireland Limited) – the Google Ads conversion tag (AW-11006266225), which measures whether a visit from a Google ad ended with a click on the phone number, the Booksy button or an online booking. The data may also be used to show ads to people who have visited the Website (remarketing).
   • Meta Pixel (1803839671411400) and Meta Conversions API (Meta Platforms Ireland Limited) – measuring the effectiveness of ads on Facebook and Instagram.
2. When the tools start. Google and Meta scripts load after your first interaction with the page (e.g. scrolling, tapping, clicking, pressing a key) or a few seconds after the page has loaded. If you come to the Website from an ad (the address contains e.g. a gclid, gbraid, wbraid or fbclid parameter or a paid campaign tag), they load right after the page has loaded. Clicking the phone number or the Booksy button or submitting a booking starts them immediately.
3. What data Google and Meta receive. Identifiers stored in cookies (§ 7), IP address, information about the browser and device, the address of the page visited and of the referring page, the ad click identifier and information about events: page view, click on the phone number or the Booksy button, submission and confirmation of a booking (with the service name, visit value and booking identifier) and, for vouchers, starting an order and the purchase.
4. Google Ads enhanced conversions. After a booking is confirmed, the Google tag sends to Google Ads the phone number provided in the booking in hashed form (SHA-256 hash function) to match the booking with the ad click. The number is not sent in plain text.
5. Meta Conversions API. Some events are sent to Meta by the Website’s server, independently of the pixel in the browser: the event name and its identifier (shared with the pixel so that Meta does not count the event twice; for a booking it is the booking identifier), time, page address, IP address, browser information (user agent), the Meta ad click identifier (if you come from an ad), the value and name of the service and, when a booking is submitted and confirmed, the hashed (SHA-256) phone number. The server does not read cookies for this purpose and does not store the phone number in plain text. After a voucher has been paid, the server sends Meta the purchase event described in § 4. On a few older subpages of the Website, events may be sent by an earlier version of this mechanism, which also uses identifiers from the _fbp and _fbc cookies.
6. Legal basis. Art. 6(1)(f) GDPR – the Controller’s legitimate interest in keeping statistics, measuring the effectiveness of ads and attributing bookings to campaigns. You can object to such processing at any time (§ 11) and limit it yourself (§ 7).
7. Google and Meta. Google and Meta may also process the data they receive for their own purposes, as separate controllers, in accordance with their own rules: policies.google.com/privacy and facebook.com/privacy/policy.

§ 7. Cookies

1. The Website uses cookies, i.e. small pieces of text information stored on your device (e.g. computer, tablet, smartphone), and browser storage (localStorage and sessionStorage).
2. Data stored by the Website: in browser storage – booking form settings (e.g. the chosen service, session identifiers), information about the measurement setting (salon-privacy-v2, meta_marketing_consent) and – for the duration of the visit – the Meta ad click identifier (meta_sygnaly_fbc).
3. Third-party cookies (set once the tools described in § 6 have started):
   • Google Ads: _gcl_au, _gcl_aw and other _gcl_* cookies – attributing conversions to ads (up to 90 days);
   • Meta: _fbp (browser identifier) and _fbc (ad click identifier) – up to 90 days;
   • Google Maps: when a map is displayed (e.g. on the contact page), Google receives your IP address and may set its own cookies.
4. The Website does not display a cookie consent management window. You can limit the use of cookies yourself:
   • in your browser settings – by blocking cookies (including only third-party cookies), deleting stored cookies and site data, or using private browsing;
   • by turning off personalised ads in Google: myadcenter.google.com;
   • by changing your ad settings in Meta (Facebook, Instagram): facebook.com/adpreferences.
5. Blocking cookies or site data may affect how some features of the Website work.

§ 8. Data Recipients

Data may be disclosed – only to the extent needed for the given purpose – to the following entities:

• the server hosting and e-mail provider (SEOHOST);
• Booksy – the salon’s booking system and appointment calendar;
• providers of tools used to handle bookings and orders: the n8n automation system and the RazorFlow system;
• PayU S.A. – to handle and process payments;
• InPost S.A. or a courier company – to deliver a physical gift voucher;
• Google Ireland Limited (Google Ads, Google Maps, Gmail) and Meta Platforms Ireland Limited (Meta Pixel, Conversions API);
• an accounting office, legal advisers and IT service providers – where necessary;
• public authorities – where required by law.

All entities entrusted with processing data guarantee the application of appropriate measures to protect and secure personal data as required by law.

§ 9. Transfers of Data Outside the European Economic Area

Google and Meta may also process data outside the European Economic Area, in particular in the United States (Google LLC, Meta Platforms, Inc.). Such transfers are based on the European Commission’s decision on the adequate level of data protection (EU-US Data Privacy Framework) and, additionally, on standard contractual clauses approved by the European Commission.

§ 10. Data Retention Period

We keep personal data as follows:

• bookings – for the time needed to handle the visit and then until any claims become time-barred;
• vouchers and payments – for the period of voucher redemption and then for the period required by law (e.g. tax and accounting regulations) or until any claims become time-barred;
• correspondence – for the time needed to handle the matter and then until any claims become time-barred;
• recruitment – as described in § 5;
• cookies – for the periods stated in § 7 or until you delete them in your browser; data in Google Ads and Meta – in accordance with the rules of those companies;
• technical server logs (e.g. event sending errors, protection against abuse) – for the time needed to ensure security; request limits store only a hash of the IP address.

§ 11. Rights of Data Subjects

In connection with the processing of personal data, the User has the following rights:

1. The right of access to their data and to receive a copy of it.
2. The right to rectification (correction) of their data.
3. The right to erasure of data (the so-called “right to be forgotten”).
4. The right to restriction of processing.
5. The right to data portability.
6. The right to object to processing based on the Controller’s legitimate interest, including for statistical and advertising purposes.
7. The right to withdraw consent at any time – where processing is based on consent (without affecting the lawfulness of processing before its withdrawal).
8. The right to lodge a complaint with the supervisory authority, i.e. the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

To exercise these rights, please contact the Controller by e-mail at listopadowa@gentlemen-radom.pl.

§ 12. Data Security

The Controller declares that it applies appropriate technical and organisational measures to ensure the security of the personal data processed, in particular by protecting data against disclosure to unauthorised persons, loss or damage. The Website uses an encrypted SSL connection, which protects data sent in forms. The Controller does not make decisions based solely on automated processing of data that would produce legal effects concerning the User or similarly significantly affect them.

§ 13. Final Provisions

The Controller reserves the right to make changes to this Privacy Policy, in particular when the Website’s features, the tools used or the law change. The current version of the Privacy Policy is always available on the Website. Any changes take effect on the day of their publication. Last updated: 28.09.2026.