Privacy Policy

Controller and contact

The data controller is SHODO j.d.o.o. (brand EPIL ZAGREB), Drage Gervaisa 44, Zagreb, Croatia. For any question relating to privacy or data protection, contact epilzagreb@gmail.com.

What data we collect and why

• Account data (name, email, phone, password hash) — to create and manage your client account and authenticate you.
• Guest booking data — if you book without creating an account first, an account is automatically created for you using the details you provide, so that your booking, history and consents can be tracked correctly.
• Booking data (service, date, time, specialist, status, price, deposit) — to schedule, perform and administer your appointments.
• Payment data (transaction status, amount, payment method type) — processed via Stripe to take deposits and payments. We do not store full card numbers.
• Health questionnaire and procedure records (medical conditions, medication, pregnancy, allergies, skin condition, hormonal treatment, treatment notes) — special category data processed with your explicit consent, to assess suitability and perform the treatment safely.
• Before/after documentation photographs — to document treated areas and treatment progress.
• Loyalty and package data — hours, points, balances and history connected to packages, loyalty programmes and gift certificates.
• Shop/reservation and drinks-order data, where applicable — for in-salon products and beverage service.
• Notifications — booking confirmations, reminders and service messages sent by email and, internally, via Telegram to our staff.
• Support and complaint correspondence — to respond to your questions and requests.

Legal bases for processing

• Performance of a contract — account creation, bookings, payments, package and gift-certificate administration.
• Explicit consent — health/questionnaire data, procedure and documentation photographs, marketing communications and marketing use of photographs, guardian consent for minors.
• Legal obligation — invoicing, accounting and tax records, responding to lawful authority requests.
• Legitimate interest — fraud prevention, service security, improving the booking platform, defending legal claims (including using photographs as evidence in a dispute where relevant, as explained further below).

Special category data

Information about your health, medication, pregnancy, allergies, skin condition or hormonal treatment is special category personal data under Article 9 GDPR. We process it only on the basis of your explicit, informed consent, strictly for the purpose of assessing suitability for treatment and performing it safely. Access is restricted on a role basis to the specialist performing your treatment where necessary, Anastasiia Vando, and authorised administrators, and access to this data is logged. Your questionnaire history is versioned: earlier answers are preserved, not silently overwritten, so a full record of what you disclosed and when is always available.

Recipients and processors

We share personal data only with processors and recipients that need it to provide the service, under appropriate contractual safeguards. A full, current list is maintained in the Data Processors document.

International transfers

Where a processor stores or processes data outside the European Economic Area, we ensure an appropriate transfer mechanism is in place (such as the European Commission's Standard Contractual Clauses or an adequacy decision). Details per processor, where relevant, are listed in the Data Processors document.

Retention

[LEGAL REVIEW REQUIRED]

We keep personal data only for as long as necessary for the purposes described above, taking into account statutory retention obligations (e.g. for accounting and tax records), the need to defend or bring legal claims, and — for health data and documentation photographs — a documentation and evidentiary purpose subject to periodic review. Retention periods for photographs and health data are subject to ongoing legal/DPO review.

Security

We apply technical and organisational measures appropriate to the sensitivity of the data, including access controls, role-based permissions, encrypted storage and transmission where applicable, and logging of access to sensitive records.

Minors

Our services are available from age 11, only during puberty, and only with the verified consent and identification of a parent or legal guardian, as described in the Minors document. We do not knowingly process personal data of children below that age without such guardian consent.

Automated decision-making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

Your rights

You have the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and the right to lodge a complaint with the supervisory authority. These are explained in full in our GDPR Rights document, and can generally be exercised from the Privacy / GDPR requests section of your client account, or by emailing us.

Changes to this policy

We may update this policy from time to time, for example to reflect new processors or legal requirements. The version number and dates above indicate the current version; material changes will be highlighted in your client account.