Privacy policy

Last updated: 23 September 2026

1. Who is responsible for your data

The controller of the personal data collected on this website is [Company name], NIF [NIF], with premises at Rua Nova dos Mercadores, 5C, 1990-175 Lisboa (Persona Beauty Studio). For any question about your data, write to [data protection email] or call +351 928 369 259.

2. What data we collect

Booking request (website form): name, phone number, requested service, specialist, preferred date and time, preferred confirmation method and comments.
Online booking: name, email, phone number, service, specialist, date and time and, if you create an account, your login details (the password is stored encrypted).
Visit history: services performed, dates and notes needed to serve you (for example the colour used or allergies you tell us about).
Communications: messages you send us by WhatsApp, phone or email.
Technical data: IP address and browser data logged by the server for security.

We do not use your data for advertising and we do not sell it.

3. Why we use the data and on what legal basis

To answer your request, make, confirm, change or remind you of an appointment — steps prior to and performance of the service contract (Art. 6(1)(b) GDPR).
To keep your visit history so that we can serve you properly — performance of the contract and legitimate interest in the quality and safety of the service (Art. 6(1)(b) and (f)).
To meet legal obligations such as invoicing — legal obligation (Art. 6(1)(c)).
To protect the website against abuse — legitimate interest (Art. 6(1)(f)).

4. Who has access to the data

The studio team, as far as necessary: each specialist sees only their own appointments.
Zen Webmaster (zen-webmaster.fr) — builds, hosts and maintains the website, as a processor.
IONOS SE — data centre in the European Union where the website is hosted.
Google (email service) — to receive requests by email.
Telegram — internal notifications to the team about new requests. Telegram is based outside the European Economic Area; the transfer is made only to act on your request (Art. 49(1)(b) GDPR).
WhatsApp (Meta Platforms Ireland) — only if you choose to contact us on WhatsApp.

5. How long we keep the data

Booking requests sent through the form: 12 months.
Client data and visit history: while you are our client and up to 5 years after your last visit; after that they are deleted or anonymised.
Invoicing records: 10 years, as required by tax law.
Technical server logs: up to 30 days.

6. Your rights

You can ask for access to your data, its correction or deletion, restriction of or objection to processing, and data portability. Just write to [data protection email]. We reply within one month at the latest. You also have the right to complain to the CNPD — Comissão Nacional de Proteção de Dados.

7. Children

Appointments for children are made by their parents or legal guardians, who give us the necessary data.

8. Security

The website uses an encrypted connection (HTTPS), access to data is limited to the team and the technical processor, and we make regular backups.

9. Cookies

For the cookies we use, see the Cookie policy.

10. Changes

We may update this policy. The date of the last update is shown at the top.