In force since 2026-10-20. It describes what happens on terathai.pl and in the automatic replies on our Instagram, as well as the health questionnaire in our salons and video monitoring at the Gdańsk reception — we checked every tool before naming it here.

This is a translation. The Polish version — Polityka prywatności — is the binding text; in case of any discrepancy, the Polish wording prevails.

1. Who is responsible for your data

The controller is Laura Bach, trading as TERA THAI Laura Bach, entered in the Polish Central Register and Information on Business Activity (CEIDG), tax ID (NIP) 5882514458, statistical number (REGON) 528818507. Salons: ul. Hynka 18/lok. U13, 80-465 Gdańsk and ul. Redłowska 37/10, 81-450 Gdynia.

Contact about your data: terathai.gdansk@gmail.com (Gdańsk), terathai.gdynia@gmail.com (Gdynia), phone +48 538 899 993 or +48 730 823 434.

We have not appointed a data protection officer — the law does not require us to.

2. What we collect and on what basis

Each form is described separately, because each one collects something different and serves a different purpose.

Voucher order form

Data: first name, e-mail, phone (optional), salon, voucher type, amount or massage name, optional dedication.
Purpose: preparing and sending the voucher, and contacting you about the order.
Legal basis: Art. 6(1)(b) GDPR — steps towards and performance of a contract.

Booking request

Data: first name, phone, e-mail (optional), salon, massage, preferred date and time, discount code, message.
Purpose: agreeing an appointment.
Legal basis: Art. 6(1)(b) GDPR.

Contact form

Data: first name, e-mail, phone (optional), your message.
Purpose: answering your question.
Legal basis: Art. 6(1)(b) GDPR where the question concerns our service; Art. 6(1)(f) GDPR — our legitimate interest in handling correspondence — where it does not.

Voucher details after online payment

Data: buyer's name, e-mail, salon, name to appear on the voucher, dedication, plus the amount and the Stripe payment session identifier, so we can match your request to a specific payment.
Legal basis: Art. 6(1)(b) GDPR.

Newsletter

Data: e-mail address.
Purpose: sending offers.
Legal basis: Art. 6(1)(a) GDPR — your consent, which you may withdraw at any time. Sending commercial information by electronic means also requires consent under Art. 398 of the Polish Electronic Communications Law.
How it works: the address you enter goes to MailerLite, the service we use to send the newsletter. You confirm the sign-up by clicking the link in our first e-mail. Every newsletter has an unsubscribe link.

Payment for a voucher (Stripe)

Payment takes place on Stripe's page, not ours. Stripe collects your name, e-mail, phone, billing address and payment instrument details. We receive a payment confirmation with the buyer's contact details and the amount — we never see your card number. The confirmation of a paid transaction (amount, currency and the payment session identifier) also reaches our sales statistics in Google Analytics directly from Stripe's server. This happens outside your browser and stores nothing on your device, and the identifiers are pseudonymous.
Legal basis: Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR for tax and accounting duties, and Art. 6(1)(f) GDPR (legitimate interest) for sales statistics.

Booking through Booksy

The booking button takes you to Booksy. Booking there means giving your data directly to Booksy, which is a separate controller with its own privacy policy. We see your booking as a salon using that system. The charge for a late cancellation or no-show under § 4 of the terms is also collected through Booksy (Booksy Pay).

E-mail

Messages from our forms and e-mails you send us arrive in our mailboxes run on Gmail (Google). Google is therefore our e-mail provider and processes the content of that correspondence on its servers.

Phone and WhatsApp

If you call or message us on WhatsApp, we process your number and the content of the conversation to handle your matter — Art. 6(1)(b) or (f) GDPR. WhatsApp belongs to Meta Platforms Ireland Limited and operates on its own terms.

Instagram — automatic replies (ManyChat)

On our Instagram (@terathaigdansk) some replies are sent automatically through ManyChat. The automation replies when you comment on a selected post with the word given in its caption (for example "TERMIN") or reply to our story with that word; send us a message containing certain words (for example "voucher", "cena", "dojazd"); tap a button or menu item in the chat with us; or mention us in your story. You receive a direct message with information and a link (Booksy booking, price list, voucher or directions), and for a comment also a short public reply under it.
Data: your Instagram account name and ID, profile picture, the text of your comment and messages, and whether a link in the message was clicked.
Purpose: replying quickly to your question or request.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in replying quickly to what you ask in a comment or message. The automation makes no decisions about you; it only sends a prepared message. If you do not want messages from it, send us "STOP" on Instagram.

No-shows and late cancellations

If you do not turn up for a visit or cancel it too late (rules in § 4 of the terms), we note this with your booking. We do so to apply the rule in the terms: after three such cases within 12 months we may ask for prepayment or accept bookings by phone only. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We delete the note after 12 months.

Health questionnaire (at the salon)

Before your first massage we ask you to fill in a paper health questionnaire. We process the data in it so that the massage can be done safely. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you may withdraw at any time; withdrawal does not affect the lawfulness of processing before it. Filling in the questionnaire is voluntary, but without this information the therapist may limit the massage or refuse it if she cannot judge whether it is safe for you. We scan the completed questionnaire and keep it only on the salon computer, accessible only to staff; the paper original is destroyed after scanning.

Video monitoring (Gdańsk salon reception)

The reception of the Gdańsk salon may be viewed through a camera. We switch the camera on only when needed, for the safety of clients and staff and to protect property (Art. 6(1)(f) GDPR). The image is watched live only: we do not record or save it, so we neither keep nor disclose any recordings. The camera does not cover the massage rooms. A notice about the monitoring is placed at the salon entrance.

Google Maps

Pages with directions embed a Google map. Loading it sends your IP address to Google before any consent decision — the map is part of the page content you asked for, but we want you to know. Legal basis: Art. 6(1)(f) GDPR — showing you how to reach the salon.

Statistics and advertising

Form data in Google Ads. Once you consent to marketing cookies, the Google Ads tag may send Google a hashed form of the e-mail address or phone number you entered, so an enquiry can be attributed to an ad click. Google does not receive them in readable form. Without consent this does not happen at all.

Google Analytics 4, Google Ads, the Meta pixel and Microsoft Clarity start only after your consent. Details — including cookie names and lifetimes — are in our cookie policy.
Legal basis: Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law.

3. Who receives your data

The full list — nobody appears here whose presence we did not confirm in the site's code and network traffic.

Google, Meta and Microsoft process data under their own terms, accepted when the accounts were set up.

4. Transfers outside the European Economic Area

Yes, this happens — and we are not hiding it. Google, Meta, Microsoft, Stripe and Cloudflare have companies in the United States, and some data reaches their servers. The basis is the European Commission adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework — for entities that joined it — and otherwise standard contractual clauses. Canva is based in Australia; data in Canva is protected by standard contractual clauses. ManyChat is based in the United States; data in ManyChat is protected by the standard contractual clauses in its data processing agreement.

To be straight with you: that adequacy decision was upheld by the General Court of the EU on 3 September 2025 (Case T-553/23, Latombe), but an appeal to the Court of Justice is pending. If that changes, we will update this document.

5. How long we keep data

If you ask us to delete correspondence sooner, we will — unless we must keep it for tax settlement or to defend against a claim.

6. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing and objection where processing rests on our legitimate interest. Where the basis is a contract or consent, you also have the right to data portability. You may withdraw consent at any time — withdrawal does not affect what we lawfully did before.

You can change your cookie choice with the “Cookie settings” button in the footer of every page.

You may also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland.

7. Profiling

Yes, it happens — and we would rather say so. After you consent, Google Ads and the Meta pixel build advertising audiences from the pages you visited. That is profiling within the meaning of Art. 4(4) GDPR, used solely to select adverts.

We make no automated decisions producing legal effects within the meaning of Art. 22 GDPR. Advertising does not decide your price, availability or service terms.

8. Do you have to give us your data

Providing data is voluntary, but without a name, phone or e-mail we cannot book a visit or send a voucher. Consent to statistical and marketing cookies is entirely voluntary — refusing blocks nothing on this site.

Our forms and newsletter are intended for adults. A parent or legal guardian books the visit for a minor.

9. Changes

When we change tools or the way we process data, we will update this document and the date at the top. Version of 2026-09-28.