1.1. This Privacy Policy (hereinafter – the Policy) governs the principles of personal data processing carried out by the CLEOPATRA SPA salon, operating at Donelaičio g. 27-1, Kaunas, legal entity code 303170199 (hereinafter – the Salon), when you visit the Salon or purchase services on our website: www.cleopatraspa.lt (hereinafter collectively – the Website).
1.2. Through this policy, the Salon aims to ensure that service users, Website visitors, and other individuals whose personal data we process are informed about the processing of their data. This Policy outlines the ways and formats in which your personal data is collected, how long it is stored, and how it is erased.
1.3. During its operations, the Salon adheres to the following data processing principles:
1.3.1. Personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject;
1.3.2. Personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes shall not be considered incompatible with the initial purposes;
1.3.3. Personal data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
1.3.4. Personal data shall be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
1.3.5. Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, subject to implementation of the appropriate technical and organizational measures required to safeguard the rights and freedoms of the data subject (storage limitation principle);
1.3.6. Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures (integrity and confidentiality principle);
1.3.7. The Salon is responsible for, and must be able to demonstrate compliance with, the principles set out above.
1.4. This Policy is drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter – GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania (hereinafter – General Data Protection Act/ADTAĮ), and other legal acts of the European Union and the Republic of Lithuania. The terms used in the Policy are understood as defined in the GDPR and local data protection legislation.
2. Collection, Processing, and Storage of Personal Data
2.1. When you visit the Website and use our services, this Policy directly applies to the collection, processing, and, in cases provided for in this Policy, transfer of your personal data to data recipients.
2.2. If you do not agree with this Policy and the personal data processing described herein, please do not visit the Website and/or use the Salon’s services.
2.3. By submitting personal data, you grant us the right to collect, store, structure, use, and process for the purposes specified in this Policy all personal data that you directly or indirectly provide when visiting the Website and ordering the services sold on it.
2.4. You are responsible for ensuring that the data you provide is accurate, correct, and complete. Providing knowingly false data is considered a violation of this Policy. If the provided data changes, you must inform us immediately. Under no circumstances are we liable for damage caused to you and/or third parties as a result of you providing incorrect and/or incomplete personal data or failing to request data supplementation and/or modification when changes occur.
2.5. If you provide personal data of another individual when purchasing an e-gift voucher or service on the Website, you undertake to ensure that the submitted data is accurate and not excessive, taking into account the nature of e-gift vouchers or service sales and delivery.
2.6. Access to the data is granted to IT and server hosting service providers acting as data processors, with whom we, as the data controller, have concluded agreements of appropriate form and content.
2.7. In certain cases, the Salon may disclose your information to other entities:
2.7.1. To comply with legal obligations or to respond to a mandatory legal process (e.g., upon receiving a court order to provide data);
2.7.2. To confirm the lawfulness of its actions;
2.7.3. To protect its rights, property, or ensure safety;
2.7.4. In other cases with your consent or upon your lawful request.
3. Processing of Personal Data for the Purpose of Service Provision
3.1. In carrying out our economic and commercial activity, we provide services to Clients. Accordingly, we process our clients’ data as a data controller, where data is necessary for the performance of a contract.
3.2. For the purpose of service provision, we process the following categories of personal data:
3.2.1. First name;
3.2.2. Last name;
3.2.3. Email address;
3.2.4. Phone number.
3.3. Data is collected directly from clients.
3.4. If our client purchases a gift voucher, we also process the name of the intended recipient and any information the client chooses to include in the greeting text. This data regarding the gift voucher recipient is processed exclusively for the purpose of issuing the gift voucher and delivering the service.
4. E-Commerce Operations
4.1. In order to enable you to make purchases in the e-shop located on the Website and to reserve a service time slot, we process the following personal data for service provision:
4.1.1. First name;
4.1.2. Last name;
4.1.3. Phone number;
4.1.4. Email address;
4.1.5. Purchase amount;
4.1.6. Bank account details (if paying by bank transfer).
4.1.7. The legal basis for processing your personal data for e-commerce purposes is the necessity to process the submitted data in order to enter into and perform the contract formed when you purchase our goods or services.
5. Processing of Personal Data for Direct Marketing Purposes
5.1. The Provider carries out direct marketing with respect to Website visitors and clients who have given their consent. Accordingly, the legal basis for such personal data processing is the consent provided by the client or visitor.
5.2. To receive our announcements or other beneficial offers, the client or visitor must express consent for such messages or offers to be sent to them. Without your consent, we will not use your personal data for marketing purposes or send promotional or informational messages. Consent may be expressed under the following circumstances:
5.2.1. Clients visiting our physical location can fill out a form and sign to confirm consent to receive marketing offers.
5.2.2. Participants in various events and courses organized by us can check the consent box to receive marketing offers when filling out registration forms.
5.3. For direct marketing purposes, we process the following categories of personal data:
5.3.1. First name;
5.3.2. Last name;
5.3.3. Email address;
5.3.4. Phone number.
5.4. Depending on the channel used for direct marketing, received personal data is manually transferred to the newsletter distribution database (email addresses, first names, last names) and the SMS promotional distribution database (phone numbers only).
5.5. Data processed for direct marketing purposes is not transferred to third parties.
6. Procedure and Retention Periods for Personal Data Storage
6.1. In processing and storing personal data, we implement organizational and technical measures that ensure the protection of personal data against accidental or unlawful destruction, alteration, disclosure, as well as against any other unlawful processing.
6.2. Personal data processed for service provision purposes is retained for 5 years from the date of last data submission.
6.3. Personal data stored for direct marketing purposes is retained for 5 years from the date of last data submission.
7. Your Rights
7.1. You have the right at any time, by submitting a request in writing or via email, to access your personal data processed by us, to learn how it is processed, to request rectification of incorrect, incomplete, or inaccurate personal data, and to request restriction of processing activities (except for storage) if the data is processed in violation of legal requirements.
7.2. To the extent that personal data processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent prior to its withdrawal.
7.3. You have the right at any time, by submitting a written request via mail or email, to demand the erasure of your data or the restriction of processing actions (except for storage) (the right to erasure and the “right to be forgotten”).
7.4. You may exercise your rights by submitting a written request via email to info@cleopatraspa.lt.
8. Contact Information and Complaints
8.1. If you have any questions regarding personal data protection, please contact us via email at info@cleopatraspa.lt.
8.2. If you are not satisfied with our response or believe that we are processing your data in violation of legal requirements, you have the right to lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania as the supervisory authority.
9. Information About Cookies, Beacons, and Similar Technologies
9.1. When you visit the Website, we aim to deliver content and functionality tailored to your needs. To achieve this, we use cookies. Cookies are small text files stored on your browser or device (personal computer, mobile phone, or tablet).
9.2. Cookies help us ensure a smoother browsing experience for individuals using the Website and help improve the Website itself.
9.3. Cookies used on our Website can be grouped into the following categories:
9.3.1. Strictly necessary cookies are required for the Website to perform its basic functions. These cookies allow you to navigate the site and use requested features, such as accessing secure areas of a specific site;
9.3.2. Performance (analytical) cookies collect anonymous information about how visitors use the site. By providing insights into visited areas, time spent on the site, and any issues encountered (such as error messages), these cookies help us understand user behavior and improve Website performance.
9.4. You can delete or block cookies by selecting the appropriate settings in your browser that allow you to refuse all or some cookies. Please note that using browser settings that block cookies (including strictly necessary cookies) may prevent you from accessing all or parts of the Website’s functionality.
11. Processing of Personal Data by Third Parties
11.1. When using third-party services, such as visiting our page on the “Facebook” social network, third-party terms and conditions may apply. For instance, Facebook applies its Data Policy to all users and visitors. Therefore, when using such third-party services, it is recommended to review their applicable terms.
12. Final Provisions
12.1. Legal relations arising under this Policy shall be governed by the laws of the Republic of Lithuania.
12.2. This Policy is reviewed and, if necessary, updated at least once every two years. Amendments or additions to the Policy take effect on the day they are published on the Website.
12.3. If you use the Website and our services after the Policy has been updated, you will be deemed to have accepted and acknowledged the changes made.
