Privacy Policy
May 28, 2026
1. Data Controller
The data controller is NORM WARSZAWA SP. Z O.O. (NIP 5273066259), located in Warsaw. Contact: hi@norm.place.
2. Data We Collect
We collect anonymous analytics data using Google Analytics (cookies): device type, browser, location (country/city), pages visited, time spent on site. We do not collect personal data (name, email, phone) through this website.
3. Cookies
We use Google Analytics cookies (ID: G-8PVSKMW4YE) for statistical purposes only. Cookies are loaded only after user consent. You can change your choice by clearing site data in your browser.
4. Purpose of Processing
Analytics data is used solely for analyzing site traffic and improving the website. We do not use it for profiling or behavioral advertising.
5. Data Sharing
Analytics data is processed by Google LLC as part of the Google Analytics service. We do not sell or share data with third parties for marketing purposes.
6. Your Rights
Under GDPR you have the right to: access your data, rectify it, erase it, restrict processing, data portability, and object to processing. To exercise your rights, contact us at hi@norm.place.
7. Data Retention
Google Analytics cookie data is retained for up to 14 months, in accordance with Google Analytics data retention settings.
8. Telegram Bot, Booking Panel and Customer Communication
This section covers data processed in the @normplacebot Telegram bot, booking panel, and customer communication (SMS, WhatsApp). Data controller — see section 1. A Data Protection Officer has not been appointed. We collect: name, phone number, Telegram user ID and username, message content, visit data (Booksy customer ID, dates, services, amounts). Information about allergies or medical contraindications is treated as special category data (Art. 9 GDPR) — processed only with your explicit consent and solely to deliver the service safely. Purposes: appointment booking, visit-related contact, reminders, responding to inquiries. Legal basis: consent (Art. 6(1)(a) GDPR, Art. 9(2)(a) for allergens), contract performance (Art. 6(1)(b)), our legitimate interest — security and accounting (Art. 6(1)(f)). Recipients (processors): Booksy (booking system), HostedSMS (SMS), Meta Platforms (WhatsApp Business — transfer to the USA based on Standard Contractual Clauses and Data Privacy Framework), Hetzner Online GmbH (hosting, Germany), Google Ireland (Analytics — transfer to the USA based on DPF). Retention: linked Telegram account data — until consent is withdrawn; message content — up to 12 months; visit data — up to 5 years after the last visit (tax records and claim defence). Rights: access, rectification, erasure, restriction, portability, objection, consent withdrawal at any time (contact: hi@norm.place). Complaint: President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
9. Policy Changes
We reserve the right to update this policy. The current version is always available on this page.