Legal
Privacy Policy for the Processing and Protection of User Personal Data
Version of 1 November 2023 · revision for this website — 15 October 2026
This Privacy Policy for the Processing and Protection of User Personal Data (hereinafter referred to as the “Policy”) is adopted and in effect at OÜ KOSMED (hereinafter referred to as the “Company” or “we”). The controller for the processing of personal data is OÜ KOSMED, registry code 10701206, address: Narva mnt 7, 10117 Tallinn; phone +372 5300 3957, email info@artesthetic.ee. We collect, use, and store personal data that you provide to us when using our websites and mobile applications (hereinafter referred to as the “Sites”) from any device and when communicating with us in any form, in accordance with this Policy and with Regulation (EU) 2016/679 of the European Parliament. By using our Sites and providing us with your personal data, you consent to the processing of your personal data in accordance with this Policy.
01
Key concepts
“Personal data” – any information related to a specific individual (data subject). “Processing of personal data” – any action (operation) or set of actions (operations) performed with personal data, with or without the use of automation tools, including collection, recording, systematization, accumulation, storage, updating, modification, retrieval, use, transmission (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
02
Data we collect
We process: – personal data provided by you when filling in information fields on our websites, including when filling in contact forms, subscribing to newsletters, registering for events (webinars, conferences); – personal data provided by you when applying for the purchase of services offered by the Company, as well as for contract conclusion; – personal data necessary for the quality and safe provision of cosmetology services, including information about your health status, past illnesses, pregnancy, allergies, and other information requested by the relevant specialist in a specific situation for the performance of a cosmetology procedure; – technical data automatically transmitted by the device you use to access our Sites, including device technical specifications, IP address; – information stored in cookie files. Depending on the browser and device you use, different sets of cookie files are used, including strictly necessary, operational, functional, and analytical cookie files; – personal data we process when the user signs in to the personal account on the website: the phone number (to sign in with a one-time code) and the information the account displays from our online booking and subscription records — name, upcoming and past visits for the last 12 months (date, services, specialist, centre, status), subscriptions (type, remaining visits, validity) and bonus balance; for participants of the referral programme — the participant’s personal code, information about bookings made with that code, and the participant’s choice whether to show their first name on the invitation page; – personal data obtained through video surveillance during your visit to our cosmetology services centre.
03
Purposes of personal data processing
We process your personal data exclusively for the purposes for which they were provided, including: – providing you with information about the Company, our services, and events, as well as sending you our news materials. Emails are sent only with your voluntary consent. Upon receiving an email with news materials from us, you will always be provided with a link to opt out of receiving news. By choosing this option, your email address will be removed from our newsletter database, and you will no longer receive information; – communicating with you when you reach out to us; – providing the personal account (sign-in with a one-time SMS code, viewing one’s bookings, subscriptions and bonuses) and running the referral programme (issuing a personal link and code and recording bookings made with them so that the centre’s administrator can credit bonuses under the Referral Programme Rules); – providing you with services in accordance with the service agreement. We conduct video surveillance for both your personal safety and the safety of our employees, clients, and property. Video surveillance is carried out in public places according to strict safety and privacy rules, using modern technologies and equipment. Information signs are placed in areas under video surveillance. If we process personal data for purposes not described in this Policy, we will inform you separately about the individual terms of processing those data. We do not make decisions that have legal consequences for you or otherwise affect your rights and legitimate interests based solely on the automated processing of personal data.
04
Legal basis for the processing of personal data
We process your personal data if one of the following conditions is met: – you have given consent for the processing of your personal data; – processing of personal data is necessary for the performance or conclusion of a contract; – processing of personal data is necessary to comply with legal obligations imposed on us by regulatory acts (for example, for the transmission of information to the Tax and Customs Board); – processing of personal data is necessary to ensure our legitimate interests (for example, to ensure the security of property we conduct video surveillance, and we may go to court to recover debts, etc.); – processing of data is necessary to protect your vital interests or the vital interests of another natural person. Personal account and referral programme: the data are processed to perform our contract with the user — providing services and applying the Referral Programme Rules the user joins (Art. 6(1)(b) GDPR); the referrer’s first name is shown to the invited person only with the referrer’s consent, which is given and withdrawn with a switch in the personal account (Art. 6(1)(a)). A booking made by an invited person is marked as referred on the basis of our legitimate interest in crediting bonuses correctly (Art. 6(1)(f)); the centre’s administrator sees the referrer’s first name, the initial of the surname and the last four digits of the phone number, while the full number is available only to an authorised employee in the website’s administration system. Offers and news (optional). If you ticked "I would like to receive Art Esthetic offers and news", we send you news about services, offers and promotions of Art Esthetic centres by email and SMS, to the address and number given in the form. The legal basis is your consent (Art. 6(1)(a) GDPR); it is not a condition of booking. We keep a record of the consent — date and time, the wording of the tick box, the page and form. Before the first mailing we may ask you to confirm by a link. You can withdraw consent at any time via the link in every message (/mail-prefs page) or by writing to info@artesthetic.ee; withdrawal does not affect the lawfulness of earlier messages. We keep your contact for mailings while consent is valid; after withdrawal we keep only an opt-out marker (a pseudonymised identifier of the number/address) so we do not write to you again, and the record of the past consent — 3 years.
05
General principles of personal data processing
The Company processes personal data in accordance with the following principles: – limitation of the purpose of data processing: personal data is processed only for the purpose of processing and use of data specified here, or for actions to which the data subject has given consent; – quality and proportionality of data: personal data is processed accurately and is updated as necessary. Personal data is current, relevant, and does not exceed the necessary volume, taking into account the purpose of processing; – transparency: the data subject understands the purposes for which data processing is carried out; – security: in processing data, we apply technical and organizational security measures corresponding to possible risk factors, such as measures against accidental or unlawful destruction of data, changes, unauthorized disclosure, or access; – minimization: personal data is regularly reviewed with the aim of deleting data that is no longer needed for the purpose of processing.
06
Security of personal data
To ensure the security of your personal data during their processing, we take necessary and sufficient legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, distribution, as well as from other unlawful actions regarding personal data.
07
Confidentiality / transfer of personal data
Information about your personal data will not be posted in publicly available sources or disclosed to third parties, unless the Company receives your express consent, or the information is required in accordance with legal requirements. If necessary, we may disclose your personal data to government and law enforcement agencies to protect our legitimate interests. Also, in order to fulfil our obligations to you, we may transfer your personal data to cooperation partners: data processors who perform the necessary data processing on our behalf, for example, IT infrastructure service specialists, marketing agencies, leasing companies, courier services, etc. These companies, in accordance with the current regulations of the Republic of Estonia and our cooperation agreement, are obliged to protect your personal data and process it only in accordance with the purposes specified by us. Data recipients and transfers outside the EEA. The user’s personal data are received by: Google Ireland Ltd (Google Analytics 4, Google Ads, Google Tag Manager – only after consent in the cookie banner; the embedded Google map on pages showing a centre’s address); Meta Platforms Ireland Ltd (Meta Pixel and Conversions API – only after consent in the cookie banner: for a booking or request made on the website, and later for the confirmation, visit and payment of that booking, our server sends Meta, in the form of a SHA-256 hash, the phone number, email address, first and last name, country and internal customer identifier, as well as the IP address, browser data and ad click identifiers – to measure the results of advertising; WhatsApp – the phone number and the correspondence: an administrator replies on WhatsApp to a request in which the user has themselves asked to be contacted this way); Microsoft Ireland Operations Ltd (Microsoft Clarity – session recordings and heatmaps, only after consent, form input is masked); Anthropic PBC, USA (the text of a message to the website assistant together with information about the page being viewed and the contents of the order, and a downscaled copy of the face photo that the user sends to the assistant chat with the “Upload a face photo” button after ticking the consent box – only upon the user’s explicit action; the photo is not stored); Altegio (online booking system: name, phone, e-mail, contents of the visit); Kommo (CRM: the enquiry in full); Telegram Messenger Inc. (the Telegram messenger: a notification to administrators about a new enquiry or booking – name, phone, e-mail and the text of the request – is delivered to a closed staff chat of the network and stored on Telegram’s servers); Fromni Oy, Finland (sending the SMS with the one-time sign-in code for the personal account: phone number and the text of the message with the code; no marketing messages are sent through this service). Transfers to the USA are made on the basis of the EU standard contractual clauses (Article 46 of the General Data Protection Regulation) and/or the EU-US Data Privacy Framework in the case of certified recipients.
08
Rights of the data subject
The Company respects your rights to review, correct, update, object to, or otherwise change, or delete, information provided to the Company. For this purpose, you can contact us by sending a request with the subject line “Request for personal data” or “Withdrawal of consent to the processing of personal data” (in case of withdrawal of consent to the processing of personal data) to the email address info@artesthetic.ee. In the event of your request to delete information associated with you, we will immediately delete your personal data, because respect for your rights is our priority. Unfortunately, we will not be able to delete your personal data if regulations impose an obligation on us to retain it.
09
Retention period
All personal data received from you is stored for the period during which you use our services, or, if your personal data is processed on the basis of your consent, until you withdraw your consent. A longer retention period for personal data is permitted in order to comply with legal requirements regarding the minimum retention period for documents or information, or to protect our legitimate interests (for example, but not limited to, for accounting or legal proceedings). Specific periods: enquiries and consultation requests left on the website – until consent is withdrawn; the text of messages to the website assistant – depersonalized (erased) after 180 days, while service details of the conversation (city, language, date) remain without a link to a person; login codes for the client account – 24 hours; records of taps on the booking button (without name and phone) – 12 months; database backups – up to 60 days; web server logs containing an IP address – 14 days. Data in the online booking system and in accounting documents is kept for the periods established by law. Requests for follow-up without a booking: if the user entered a phone number and ticked consent in the online booking window or in the booking card in the website assistant chat but did not press “Book now” (unfinished booking), left a phone number or email address on the waiting list for free time, or asked for the calculation of a treatment set to be sent via WhatsApp or by email, we keep this contact, the name (if entered) and what was selected – treatments, centre, time – solely to follow up on that request, including via WhatsApp. Like any other request, such requests are passed to the CRM (Kommo) and to the administrators’ internal chat. If we could not reach the user, the phone number, name and email address are deleted from the website database after 30 days or, if by that time an administrator is still handling the request, immediately after the request is closed. Opting out is simple: do not tick consent; data already saved will be deleted on request (section “Rights of the data subject”). Personal account: one-time sign-in codes — 24 hours; the sign-in cookie — 30 days (until the browser is closed if “someone else’s device” is chosen); the service record used for “sign out on all devices” — 12 months after the last sign-in. The account does not store visits, subscriptions or bonuses on the website: they are retrieved from the booking system when viewed. Referral programme: the participant’s personal code — while the participant uses the programme, but no longer than 24 months without bookings made with the code, or until a deletion request; records of bookings made with the code — 12 months from the visit date; the invitation code in the invited person’s browser — up to 60 days or until a booking is made. Once the purpose of processing personal data has been achieved, we will delete your personal data in a secure manner, or make it inaccessible (archiving), or unidentifiable so that it can no longer be associated with you.
10
Cookies
We use cookies. You can find out more about the policy and technical details related to cookies in the relevant section – the cookie policy. A strictly necessary session cookie is used to sign in to the personal account; it is not used for analytics or advertising and does not require consent in the cookie banner. Microsoft Clarity session recording does not run on personal account pages.
11
Changes to the privacy policy
The Policy is subject to change without prior notice. The amended version of the Policy, which is published on the Site, replaces all previous versions of the Policy. Any changes do not affect the Company’s general policy regarding respect for the rights of the data subject.