Privacy policy

Who we are

The controller of your data is Παπαϊωάννου Πηνελόπη (Penelope's Beauty), a beauty studio in Elefsina, Greece:

Business name

Παπαϊωάννου Πηνελόπη (Penelope's Beauty)

Legal form

Sole proprietorship

Address

Sotiriou Tsoka 8-10, Elefsina

Phone

210 554 5988

Email

info.penelopesb@gmail.com

VAT no.

134762509

Tax office

KEFODE Attikis

GEMI no.

056838009000

Professional title

Beautician (aesthetician), degree in Aesthetics from a Greek TEI (Greece)

Licence to practise

ref. no. 6697 — Prefecture of West Attica, Directorate of Health & Public Hygiene

Professional rules

Greek Legislative Decree 361/1969, Law 276/1977 and Presidential Decree 83/1989 on the beautician profession

What we collect

Only what we need to reply to you and look after you:

• Contact form: your name, phone or email, the service you are interested in (optional) and your message.
• Phone, email or social media messages: whatever you choose to tell us.
• At the studio: contact details and treatment history. We ask for health information (e.g. pregnancy, medication, skin conditions) only as far as we need it to check contraindications, and only with your explicit written consent (a consent form at the studio).
• Skin analysis or before/after photos: only with your consent, and never published without separate written permission.

Visit statistics (Google Analytics) — ONLY if you accept them in the cookie banner: which pages you view, your device type and rough area, with no name or contact details. This site does NOT use advertising cookies, the Facebook pixel or remarketing. It has no user accounts and takes no payments.

Why we use it

• To reply to your enquiry and book an appointment — steps before entering into a contract (GDPR Art. 6(1)(b)).
• To provide the service safely (GDPR Art. 6(1)(b)).
• Health information: with your explicit consent (GDPR Art. 9(2)(a)), which you can withdraw at any time.
• To meet our tax and accounting obligations (GDPR Art. 6(1)(c)).

We do not sell or rent your data, and we do not use it for advertising.

Do you have to give us your data?

No. But without your name and one way to contact you, we cannot reply or book an appointment. Without the health information needed to check contraindications, a treatment may not be safe to carry out — we will tell you if so.

Automated decisions

We make no automated decisions about you and do no profiling. Every decision is made by a person.

How long we keep it

• Form or email enquiries that did not lead to an appointment: up to 12 months.
• Client record and treatment history: while you are a client and up to 2 years after your last visit.
• Receipts and invoices: as long as Greek tax law requires.

After that, the data is deleted or anonymised.

Who we share it with

Only those needed to communicate with you, and only what they need:

• Our email provider (Google — Gmail), where your messages arrive.
• Meta (Instagram, Facebook) and Viber — only if you message us there.
• Cloudflare, which hosts the site and forwards contact-form messages to our email. It also sees technical details of each visit (e.g. IP address) for security.
• Google Maps — ONLY if you choose to show the map.
• Google Analytics — ONLY if you accept statistics. Data is kept for 14 months and never used for advertising.
• Our accountant, for receipts and invoices.

Some of these providers (Google, Cloudflare) may process data in the US. Where they do, transfers rely on GDPR safeguards (the EU–US Data Privacy Framework or standard contractual clauses).

Children

This site is not aimed at children under 15. If you are under 15, please ask a parent or guardian to contact us for you. That is why the form asks you to confirm your age.

If we learn that we have received data from a child under 15 without a parent's consent, we delete it.

Treatments for minors (under 18) require the consent of a parent or guardian — see the Terms of use.

Your rights

At any time, free of charge, you have the right to:

• find out what data we hold about you and get a copy (access)
• have it corrected (rectification)
• have it deleted (erasure)
• restrict how it is used (restriction)
• receive it in a machine-readable format (portability)
• object to its use (objection)
• withdraw any consent — without affecting what happened before you withdrew it

If you believe we have not respected your data, you can complain to the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, www.dpa.gr).

Request your data

For access, correction or deletion, email us, call us or tell us at the studio. The buttons open a ready-made email — just add your name and the phone or email you used with us, so we can find your details.

We reply within one month. If the request is complex, this can be extended by up to two further months — we will tell you within the first month. We may ask you to confirm your identity so that we never hand over or delete someone else's data. Anything we are legally required to keep (e.g. receipts) cannot be deleted before that obligation ends — we will tell you if so.

Emails and updates

We do not send newsletters or marketing emails or texts. We contact you only about your enquiry or appointment.

If we ever start sending updates, it will only be with your consent, and every message will include a one-click unsubscribe link.

Cookies

This site sets no cookies of its own. Two Google services may — the map and statistics (Google Analytics) — each only if you accept it. Details in the Cookie policy.

Security

The site is served over HTTPS only. Messages and client records are accessible only to the studio staff who need them.

Changes

If anything in this policy changes, you will see it here with a new date.