1. Personal data controller
The controller of personal data processed through the website is the entity operating under the brand Llarion Masaż.
VIKTORIIA ILLARIONOVA LIARION_MASAŻ
ul. Tęczowa 29A/5, 53-601 Wrocław
NIP: 8992930030 · REGON: 522496913
Contact for privacy and personal-data matters:
- email: illarionovav@icloud.com,
- phone: +48 570 145 847 or +48 882 590 483.
If the controller appoints a Data Protection Officer in the future, their contact details will be published here.
2. What data may be processed
The scope of data depends on how the website is used. In particular, we may process:
- full name or first name entered in a form,
- phone number and email address,
- selected service or training, location, price option and preferred appointment time,
- the content of a message or comment submitted through a form,
- technical data connected with website use, such as IP address, device and browser information, server logs and cookie or similar-technology identifiers, where used.
3. Purposes, legal bases & retention
| Purpose | Legal basis | Retention period / criterion |
|---|---|---|
| Handling a massage booking request and contacting you to arrange or confirm the appointment. | Art. 6(1)(b) GDPR — steps taken at the person’s request before entering into a contract and performance of the contract. | Until the booking and visit are completed, then for the period appropriate for any potential claims connected with the service. |
| Handling a training application and contacting you about the date and details. | Art. 6(1)(b) GDPR. | Until the application / training has been handled, then for the period appropriate for any potential claims. |
| Responding to questions and ordinary correspondence not yet connected with a specific booking. | Art. 6(1)(f) GDPR — the controller’s legitimate interest in handling correspondence and customer relations. | Until correspondence is completed and afterwards only where retention is justified by protection against claims or a legal obligation. |
| Ensuring website security, diagnosing errors and preventing abuse and spam. | Art. 6(1)(f) GDPR — the controller’s legitimate interest in website security. | For the period resulting from technical-log settings and rotation, no longer than necessary to diagnose an incident, protect the website or pursue claims. |
| Fulfilling legal, accounting or tax obligations where required by a document or transaction. | Art. 6(1)(c) GDPR. | For the period required by applicable law. |
| Analytics or marketing using technologies not required for the website to function, including Meta Pixel — only after the required consent has been obtained. | Art. 6(1)(a) GDPR and rules governing storage of / access to information on a user’s device. | Until consent is withdrawn or the relevant identifier expires; independently, the tool provider may apply its own retention periods. |
4. Health data
Forms available on the website are not intended for health data, diagnoses, medical histories or other special-category data. Please do not enter such information in the comments field.
Information about massage contraindications should be given directly to staff before treatment, to the extent necessary for safe provision of the service.
5. Who data may be disclosed to
Data may be shared only to the extent necessary for website operation and customer service, in particular with:
- hosting, website-maintenance, email and IT-support providers,
- providers of communication tools used to forward requests to the team, including Telegram,
- analytics and advertising-tool providers — only to the extent consistent with consent given, where consent is required,
- accounting or legal service providers or public authorities where disclosure follows from a legal obligation or is necessary to protect the controller’s rights.
After moving to external services such as Booksy, Instagram or maps, data is processed under the rules of the relevant provider.
6. Transfers outside the European Economic Area
Some technology providers may process data using infrastructure or entities located outside the EEA. This applies in particular to certain communication and advertising services.
Where such a transfer occurs, it should rely on a mechanism permitted by the GDPR, such as an adequacy decision or Standard Contractual Clauses, depending on the provider and processing.
7. Cookies & similar technologies
The website may use technologies necessary for proper operation, security and remembering technical settings. Such technologies may be used where necessary to provide a service requested by the user.
Analytics or marketing technologies not necessary for the website to function should be activated only after user consent. Users should be able to refuse consent and later change their decision.
8. Meta Pixel & marketing technologies
The website uses Meta Pixel, provided by Meta Platforms Ireland Limited. It may be used to measure advertising effectiveness and produce statistics about website use.
If Meta Pixel or similar tools store or read information on the user’s device and are not necessary for the website to function, they should be activated only after appropriate consent. Consent can be withdrawn through the cookie-consent settings.
9. Data-subject rights
To the extent provided by the GDPR, you may request:
- access to your data and a copy of it,
- rectification of data,
- erasure of data,
- restriction of processing,
- data portability where the legal conditions are met,
- to object to processing based on legitimate interest,
- withdrawal of consent at any time where processing is based on consent; withdrawal does not affect the lawfulness of processing carried out before withdrawal.
You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office, if you believe your data is being processed unlawfully.
Is providing data mandatory?
Providing data in the form is voluntary, but fields marked as required are necessary to handle a booking, training application or contact request. Without this data, the request may be impossible to fulfil.
10. Automated decisions & profiling
Data submitted through booking and training forms is not used to make decisions about customers that produce legal effects solely by automated means.
If the user consents to marketing technologies, providers of those tools may create audiences or marketing profiles under their own rules. This does not automatically affect access to Llarion Masaż services.
Data security
The controller applies appropriate organisational and technical measures to protect data from unauthorised access, loss, alteration or disclosure. Access should be limited to people who need it for customer service or website operation.
11. Privacy Policy changes
This policy may be updated if the way the website operates, the tools used or applicable law changes. The current version will be published on this page together with the date of the latest update.
Last updated: 9 October 2026