Privacy policy

1. Data controller

The controller of your personal data is SALON ŚLUBNY „GLORIA” Renata Anna Roszkowska, ul. Lipowa 18, 15-427 Białystok, NIP 542-181-91-31, REGON 050381457, which runs the Mija Loraa bridal salon (the “Controller”, the “Salon”, “we” or “us”).

The website available at suknie-slubne.bialystok.pl, together with the short links in the mijaloraa.pl domain sent in text messages, is referred to as the “Website”.

You can contact us about any matter concerning personal data:

• E-mail: salon@mijaloraa.pl
• Phone: +48 735 095 045
• By post or in person: ul. Lipowa 18, 15-427 Białystok

The Controller has not appointed a data protection officer (DPO). Please send all matters concerning personal data to salon@mijaloraa.pl or by post to the Salon’s address: ul. Lipowa 18, 15-427 Białystok.

2. What data we process

The scope of the data depends on which features of the Website you use:

• Booking a visit: phone number (verified with an SMS code), first name and surname, e-mail address and the chosen visit slot. Optionally: wedding date, purpose of the visit, number of accompanying persons, dresses chosen in the virtual try-on and a message for the stylist.
• Measurements (optional): height, clothing size, bra size, and bust, waist and hip measurements. They are visible only to the stylist preparing your visit.
• Client account: phone number, first name and surname and e-mail address if you gave them (when booking a visit or at the Salon), your wedding date if you gave it or if it comes from the former client zone (below), the language in which you use the Website, your history of visits and virtual try-ons, and the number of try-ons available to you.
• Virtual try-on: the full-length photo you upload, the dresses you choose and the generated visualisations (try-on results).
• Newsletter and marketing text messages: the e-mail address to which we send the Newsletter, or the phone number verified with an SMS code to which we send marketing text messages, the language, and the proof of your consent and of its withdrawal (section 12).
• Client language: the language of the Website (Polish, English, Ukrainian or Belarusian) in which you book a visit or sign in. We send messages to you in that language (for the language of marketing messages, see section 12).
• Technical data: a truncated IP address (without its final part), information about your browser and device, the date and time of events, the result of the anti-spam check, security event logs and the Website’s error log (the time, the page address without anything that could identify a person, the error message, the browser family and the window size, without the IP address).
• Consents: the content, date and manner in which consents were given (in forms and in the cookie settings) and withdrawn.
• Correspondence: the content of the messages you send us and the sender’s contact details.
• The assistant (section 13): the content of a conversation held with the automated assistant on Instagram or by phone, your Instagram identifier or phone number, the details given in the conversation to book a visit and, for the phone, the call’s number, time and length and the list of blocked numbers.

Some client-account data comes from the former client zone (Strefa klienta) at suknie-slubne.bialystok.pl, where brides opened an account on the Salon’s previous website. It was run by the same Controller. If you opened an account there in the 5 years before the data was moved to the Website, we moved your first name and surname, e-mail address, phone number and, if you gave it, your wedding date to your client account. Nothing else was moved: neither your password nor any consent. We send no marketing messages because of the move: you will receive the Newsletter or marketing text messages only if you consent to them yourself (section 12).

3. Purposes and legal bases of processing

4. Do you have to provide your data

Providing your data is voluntary, but without some of it we cannot provide our services:

• To book a visit, we need a verified phone number, your first name and surname and your e-mail address.
• To use the virtual try-on, we need a verified phone number, your photo and your consent to its processing.
• All other form fields, including measurements, are optional. They help us prepare your visit better.
• Consent to the Newsletter and to marketing text messages is voluntary. You can book a visit and use the virtual try-on without it.

You may withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

5. Virtual try-on: how we process your photo

• We use your photo solely to generate visualisations of the dresses you have chosen. We do not use it to identify you or to verify your identity.
• The visualisations are generated for us by FASHN LTD, based in the United Kingdom, acting as a processor. We transfer the photo solely for the purpose of generating the visualisations. FASHN does not keep a copy of it after processing and does not use the data to train artificial intelligence models.
• We delete the photo from our servers 24 hours after it is uploaded.
• We keep the try-on results for 90 days. You can see them under ‘My try-ons’, and Salon staff can view them when preparing your visit. You can delete them earlier.
• Downloaded visualisations carry a watermark with the Mija Loraa logo and an ‘AI visualisation’ label.
• We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you.

6. Who we share your data with

We entrust data only to entities that help us run the Website, to the extent necessary for them to perform their tasks:

We may also disclose data to public authorities where required to do so by law.

7. Transfers of data outside the European Economic Area

Some recipients process data outside the European Economic Area (EEA):

• FASHN LTD is based in the United Kingdom and uses processors in the United States and in Asia. The transfer is based on standard contractual clauses approved by the European Commission.
• Google, Meta and Cloudflare may process data in the United States. The transfer is based on a European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses.
• MailerLite stores data in the European Union. MailerLite, Inc., a company of the MailerLite group in the United States, and some other processors that MailerLite uses outside the EEA may have access to it. The transfer is based on standard contractual clauses approved by the European Commission, as provided for in the data processing agreement concluded with MailerLite. MailerLite, Inc. also participates in the EU-US Data Privacy Framework.
• Anthropic and the assistant’s voice platform (section 13) process data in the United States. The transfer is based on standard contractual clauses approved by the European Commission, as provided for in the data processing agreements concluded with them, and, for a party participating in the EU-US Data Privacy Framework, on the European Commission’s adequacy decision.

You can obtain a copy of the safeguards by writing to salon@mijaloraa.pl.

8. How long we keep your data

Backups of the Website’s database and files are encrypted and kept for 7 days. Data deleted from the Website may therefore remain in an encrypted backup for up to 7 days, after which it is permanently erased from it. Photos uploaded to the virtual try-on are never included in backups.

9. Your rights

You have the right to:

• access your data and receive a copy of it (Article 15 GDPR),
• rectification of your data (Article 16 GDPR),
• erasure of your data (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• data portability (Article 20 GDPR),
• object to processing based on our legitimate interest (Article 21 GDPR),
• withdraw your consent at any time,
• lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

How to exercise your rights:

• Write to salon@mijaloraa.pl, call +48 735 095 045 or visit the Salon.
• So that we can be sure we are dealing with you, we may ask you to confirm your identity with an SMS code sent to the number linked to your account.
• We respond without undue delay and at the latest within one month. In exceptional cases, this period may be extended by a further two months. We will inform you if this happens.
• You can delete your try-on results yourself under ‘My try-ons’.
• You can withdraw your consent to the Newsletter without signing in, on the Newsletter unsubscribe page or with the link in any Newsletter, and your consent to marketing text messages with the link in any of them. You can also withdraw either consent under ‘My try-ons’ or by contacting the Salon (section 12).
• You can change your cookie consents at any time using the ‘Cookie settings’ link in the Website footer.

10. Cookies and similar technologies

Cookies are small files stored on your device. Browser storage (localStorage) works in a similar way. We use them in five categories:

• Essential: always on. They make the Website work and provide security, sign-in and the remembering of your choices.
• Analytics: Google Analytics 4 (analytics_storage signal). They help us understand how you use the Website.
• Marketing: Meta Pixel and Google Ads (ad_storage and ad_user_data signals). They allow us to measure the effectiveness of our ads.
• Ad personalisation: ad_personalization signal. It allows ads to be tailored to your interests.
• External content: Google Maps embedded in the Website. Posts from the Salon’s Instagram profile are copied to the Website’s server and shown without connecting to Instagram, so they need no consent and set no Instagram cookies.

We use Google Consent Mode v2. By default, all categories other than essential are switched off, and analytics and advertising tools do not store cookies until you give your consent. We remember your choice for 12 months and record it in the consent register. You can change it at any time using the ‘Cookie settings’ link in the footer.

You can also delete or block cookies in your browser settings. Blocking essential cookies may prevent some features, such as signing in, from working.

11. Data security

• The connection to the Website is encrypted (HTTPS).
• Only authorised staff have access to the Salon’s panel, and they sign in with a one-time link sent by e-mail.
• We do not store phone numbers in plain text in event logs.
• Database backups are encrypted.

12. Newsletter and marketing messages

If you consent to it, we send you information about new dresses, offers and events at the Salon: by e-mail (the Newsletter), by text message (marketing text messages), or both. Consent to the Newsletter and consent to marketing text messages are two separate consents. Each is voluntary and is not a condition for using any other feature of the Website.

How you give your consent:

• Newsletter: you enter your e-mail address in the Website footer and press ‘Sign up’, tick the consent box under the e-mail address in the visit booking form or in the contact form, or switch the Newsletter on under ‘My try-ons’. After a sign-up in the footer, we send an e-mail to that address with a link to confirm the sign-up, valid for 7 days. Consent given in the footer applies from the moment you press the confirmation button on the page that the link opens; without confirmation, we will not send you the Newsletter. Consent given in the visit booking form applies from the moment the visit is booked, in the contact form from the moment the message is sent, and under ‘My try-ons’ from the moment you switch the Newsletter on; in these cases we send no e-mail with a confirmation link.
• Marketing text messages: you tick the consent box under the phone number when booking a visit or signing in to your client account, or switch text messages on under ‘My try-ons’. The consent covers the number verified with an SMS code. It applies from the moment the code is entered correctly or, under ‘My try-ons’, from the moment you switch it on.

As proof of your consent, we record the e-mail address or phone number, the wording of the consent as we displayed it, its language, the version of this privacy policy, where the consent was given (for example the footer, the visit booking form or ‘My try-ons’), and the date and time from which the consent applies and, for a sign-up in the footer, also the date and time of the sign-up itself. We link consent to marketing text messages to your client account, and consent to the Newsletter when you give it under ‘My try-ons’. When a consent is withdrawn, we record the date and manner of the withdrawal and, if the Salon recorded it, the person who did so. We do not record your IP address or any information about your device as part of the proof.

The legal basis for sending the Newsletter and marketing text messages, including the e-mail with the link to confirm the sign-up, is your consent: Article 6(1)(a) GDPR in conjunction with Article 398(1) and Article 400 of the Polish Electronic Communications Law Act. While the consent is in force, we keep its proof to demonstrate that it was given (Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR). We keep the proof of a consent after its withdrawal, and the results of SMS campaigns, on the basis of our legitimate interest in being able to show to whom, when and on the basis of which consent we sent messages, including in proceedings before a supervisory authority (Article 6(1)(f) GDPR).

The Newsletter is sent on our behalf by MailerLite Limited (Ireland), which keeps the list of signed-up addresses for us as a processor (sections 6 and 7). We pass on to it only e-mail addresses for which consent already applies (an address signed up in the footer only once it has been confirmed), with the date from which the consent applies, the language and where the sign-up was made. MailerLite records whether the Newsletter was delivered and which of its links were clicked. We use these statistics on the basis of our legitimate interest in assessing whether the Newsletter is of interest to its readers (Article 6(1)(f) GDPR).

Marketing text messages are sent by SerwerSMS, like the Website’s other text messages. They come from the sender MijaLoraa and cannot be replied to. Each one ends with a personal link for withdrawing your consent. We send marketing messages in Polish, or in your language if we have prepared them in that language.

How long we keep the data:

• Sign-up in the footer awaiting confirmation: 7 days from the sign-up, after which we delete it.
• Consent: for as long as it is in force and, after its withdrawal, for 5 years. An administrative fine for sending a message without consent may be imposed for 5 years after the message was sent (Article 189g § 1 of the Polish Code of Administrative Procedure), and the proof allows us to show that we had your consent.
• Address in MailerLite: after the consent is withdrawn, the address stays in MailerLite marked as unsubscribed, so that it is not included in any further mailing. We delete it from there together with the proof of consent, and MailerLite erases it permanently within 30 days.
• SMS campaign results: for each recipient (for example sent or skipped), 90 days from the end of the campaign.

How to withdraw your consent:

You can withdraw your consent at any time, without giving a reason and without signing in:

• Newsletter: on the Newsletter unsubscribe page (suknie-slubne.bialystok.pl/en/newsletter/unsubscribe), enter your e-mail address and press ‘Unsubscribe me’, or use the unsubscribe link that MailerLite places in the footer of every Newsletter.
• Marketing text messages: open the personal link at the end of any marketing text message (mijaloraa.pl/s/…) and press ‘Unsubscribe me’.
• Salon: write to salon@mijaloraa.pl, call +48 735 095 045 or tell us at the Salon, and we will record the withdrawal.

If you are signed in to your client account, you can also switch either consent off in the ‘Marketing consents’ section under ‘My try-ons’.

A withdrawal takes effect immediately: from that moment we send no marketing messages to that address or number, including in an SMS campaign that is under way. We pass a withdrawal from the Newsletter on to MailerLite without delay. Withdrawing one consent does not change the other. Nor does it affect the lawfulness of messages sent before the withdrawal, or messages about visits and the client account, such as SMS codes and visit confirmations and reminders.

If we delete your client account at your request, we also withdraw your consent to marketing text messages and the Newsletter consents given under ‘My try-ons’ or for the e-mail address in your account. If we delete the account after 5 years of inactivity, we withdraw only your consent to marketing text messages.

13. The assistant: Instagram messages and phone calls

Direct messages sent to the Salon’s Instagram profile and calls to the assistant’s number are answered by the Salon’s automated assistant — a program that understands your message or words and replies to them. The assistant says so at the start of every conversation and, on Instagram, gives the address of this policy when it asks for your details — your name, phone number or e-mail address — or when it receives them. It does four things: it books a visit to try on dresses, books the collection of an ordered dress, directs cooperation offers to salon@mijaloraa.pl and, for anything else, gives the Salon’s phone number and opening hours or passes the conversation to a member of the Salon’s staff. A member of staff also takes over at your request and whenever the assistant cannot help. The assistant gives no prices, makes no promises about alterations or delivery dates, takes no payment, asks for no marketing consent and never writes or calls first. We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you: booking a visit is what you ask for, and you can confirm, change or cancel every visit.

A member of the Salon’s staff may take over an Instagram conversation at any time: by replying to you from the Salon’s profile (in the Instagram app or in Meta Business Suite) or by choosing to do so in the Salon’s panel. The assistant then stays silent in that conversation until 24 hours pass without any message, or until the Salon hands the conversation back to it. The Salon’s messages in the conversation are recorded with it and kept like the rest of the conversation.

What data we process:

• The content of the conversation: your messages and the assistant’s replies and, for the phone, the call’s transcript.
• Your identifier: on Instagram the technical sender identifier assigned by Meta (not your username); by phone, your number.
• The details given in the conversation to book a visit: your first name and surname, phone number and the chosen time and, optionally, the purpose of the visit, the wedding date, the number of accompanying persons and your e-mail address. A visit booked this way is recorded and handled exactly like a visit booked on the Website (sections 2, 3 and 8), and you receive its confirmation and the link to the visit page by SMS. Before the assistant books a visit on Instagram, you confirm the number you gave with a code we send to it by SMS and you type in the conversation, as on the Website. One visit booked through the assistant may wait at a time for your Instagram account, and one for your number.
• By phone: the number you call from, the time and length of the call and the assistant’s decision (for example, call accepted, passed to the Salon or refused), kept in a call log so that the limits on the number and length of calls that protect the line against abuse can be applied.
• The list of blocked numbers: the number, the reason for blocking it and the date it was added, when the Salon blocks a number from which the line was abused. A call from a blocked number hears a short message and is ended. Blocking does not affect Instagram messages.

Purposes and legal bases: booking a visit, including collecting the details it needs, is steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). Answering messages and calls outside the Salon’s opening hours and protecting the line against abuse, including the limits and the list of blocked numbers, is our legitimate interest (Article 6(1)(f) GDPR); you may object (section 9).

Who we share the data with: Instagram messages pass through Meta Platforms Ireland Limited, the operator of Instagram. The assistant’s replies on Instagram are phrased by a language model provided by Anthropic [contracting entity to be confirmed], under commercial terms and a data processing addendum that exclude training models on the Salon’s data; the model receives only the content of the given conversation. A phone conversation is conducted by a voice platform [voice platform to be confirmed], which recognises speech, replies by voice and keeps the transcript. Both process data in the United States (section 7).

Call recording: phone conversations with the assistant are not recorded unless the Salon turns recording on in its settings — the greeting then says so at the start of the call. A transcript of the conversation is always made.

How long we keep the data: we keep the conversation’s transcript (the Salon’s messages included), your identifier and its outcome for 90 days from the last message, yours or the Salon’s, then delete them. If a visit was booked in the conversation, we keep a short summary of it with the visit data for 5 years from the date of the visit. We keep the call log for 90 days and a blocked number until the Salon removes it from the list. When we delete your client account at your request, we also delete the conversations held from your number and those from which your visits were booked.

14. Changes to this privacy policy

We may update this policy, for example when the law or the Website’s features change. The current version is always available on the Website, and the date from which it applies is shown at the top of the document. We will announce significant changes on the Website.

15. Language versions

This privacy policy is available in Polish, English, Ukrainian and Belarusian. In the event of any discrepancy between the versions, the Polish version prevails.