Privacy policy

This site uses no analytics or advertising tools. I only process your personal data when you give it to me yourself, for example in the contact form or in an email.

Last updated: 4 November 2026.

Data controller

The controller of your personal data is Karolina Bucka, Aleja Pokoju 93/1, 31-982 Kraków, Poland, tax ID (NIP): 6782787795. For any matter related to personal data, write to karolinabucka@gmail.com.

What data I process and why

• Contact form and email: your name, email address, optionally your phone number, the course you chose and your message. I use them to reply to your enquiry and prepare a course offer, which means taking steps at your request before entering into a contract (Article 6(1)(b) GDPR), and to correspond with you, which is my legitimate interest (Article 6(1)(f) GDPR).
• Course booking: the data needed to enter into and perform the contract (Article 6(1)(b) GDPR) and for accounting required by tax law (Article 6(1)(c) GDPR).
• Form protection: the form is protected by Cloudflare Turnstile, which uses technical data about your browser and device (such as your IP address) to check that the message is sent by a person and not by a spam bot. Protection against spam is my legitimate interest (Article 6(1)(f) GDPR).
• Technical data: on every visit the Cloudflare servers that run this site record technical data: IP address, date and time, the address of the page visited and the browser type. They are used for the security of the site and for troubleshooting, which is my legitimate interest (Article 6(1)(f) GDPR).

How long I keep the data

• Enquiries that did not lead to a booking: up to 12 months after the last contact.
• Contract data: for as long as the contract is performed, and accounting records for the period required by tax law, usually 5 years from the end of the tax year.
• Technical data: Cloudflare server logs are deleted automatically after 3 days. Data that Cloudflare processes to protect the site against attacks and spam is kept in line with Cloudflare’s own privacy policy.

Who receives the data

Data may only go to companies that help me run the site and handle contact:

• Cloudflare, whose servers run the site, which forwards contact form messages to me and protects the site from attacks and spam,
• the email provider (Google, Gmail service),
• an accounting office, if you enter into a contract with me.

I do not sell data and do not share it for marketing purposes.

Transfers outside the European Economic Area

Cloudflare and Google may process data outside the EEA, including in the USA. This is based on the European Commission's adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses.

Your rights

You have the right to:

• access your data and receive a copy of it,
• have your data corrected,
• have your data erased,
• restrict processing,
• data portability,
• object to processing based on legitimate interest (Article 6(1)(f) GDPR),
• lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office in Poland (UODO, Stawki 2, 00-193 Warsaw, uodo.gov.pl).

To exercise these rights, write to karolinabucka@gmail.com.

Do you have to provide data

Providing data is voluntary. Without your name, email address and message, however, I cannot reply to your enquiry. I do not make automated decisions about you and I do not use profiling.

Cookies and external services

This site does not use analytics or advertising tools and does not store cookies itself. Fonts are loaded from the same server, with no connection to Google.

The links to Instagram profiles (mine and the Give Me Mani salon’s) are plain links. This site does not embed Instagram content or load Meta scripts, so Meta Platforms receives no data unless you click a link yourself. Once you are on Instagram, Meta’s privacy policy applies.

The form protection (Cloudflare Turnstile) only loads when you scroll down to the form. It may store a technical cookie in your browser, used solely to protect against spam and bots, not for tracking.

If you switch between light and dark mode, your browser remembers that choice on your device. This information is not sent anywhere.

Changes to this policy

If I change how I process data, I will update this page and the date of the last update.