Beautlix – beauty service booking platform
Sign in
Find a salon

BEAUTLIX PRIVACY POLICY

Edition valid from: 2026-02-01
Last updated: 2026-08-17

This Privacy Policy explains how personal data is collected, used, stored, and transferred when using the website www.beautlix.pl, the Beautlix platform, mobile applications, and other related services (hereinafter collectively – the Platform).

1. DATA CONTROLLER

The Platform is administered and the personal data controller in the cases specified in this document is:

UAB Global shops owners
Legal entity code: 306329475
VAT payer code: LT100017569812
Office address: Giedraičių St. 39-R53, LT-09302 Vilnius, Lithuania
Website: www.beautlix.pl
Email for privacy and data protection issues: support@beautlix.com

Hereinafter referred to as UAB Global shops owners called “Beautlix”, “we” or “our”.

2. WHEN BEAUTLIX IS A DATA CONTROLLER OR PROCESSOR

2.1. Beautlix acts as an independent data controller when processing data for Platform accounts, reservation transfers, security, settlements with Business users, customer service, analytics, marketing, legal obligations, and defending its rights.

2.2. When a Client books a service, the required reservation data is transferred to the salon, clinic, studio or specialist chosen by them (hereinafter – Service provider). The Service provider independently determines how the data will be used to provide the service, thus usually acting as a separate data controller for their processing.

2.3. When a Service provider uses Beautlix as a system for managing clients, employees, work schedules, reservations or other business processes and determines the purposes of such processing themselves, Beautlix may act as a data processor on behalf of the Service provider. Such processing is governed by a separate Data Processing Agreement. For these data usages, you should primarily contact the specific Service provider.

2.4. This policy applies to the personal data processing for which Beautlix is responsible. It does not replace the privacy notices of Service providers.

3. WHERE WE GET DATA FROM

We may obtain personal data:

  • directly from you when you register, make a Reservation, complete your profile, contact us, post a review or use Platform features;

  • from the Service provider or their authorized employee when they create or manage a Reservation, client, employee access or update service information;

  • automatically from your device, browser, app, cookies and similar technologies;

  • from payment, authentication, communication, analytics and other service providers used for Platform operation;

  • from public registers or other lawful sources when verifying the Service provider’s identity, registration, license or right to conduct business.

If you submit data about another person, you have the right to do so and, when necessary, inform that person about the data transfer to Beautlix.

4. WHAT PERSONAL DATA WE PROCESS

4.1. Account and identity data

We may process:

  • first name and last name;

  • email address and phone number;

  • login identifiers, encrypted password and authentication data;

  • profile picture, selected language and account settings;

  • account type, role, rights and status;

  • consent, acceptance of terms and their changes history.

4.2. Reservation and service data

We may process:

  • selected Service provider, specialist and service;

  • Reservation date, time, location, duration and status;

  • Information about creating, confirming, modifying, canceling, or no-show of bookings;

  • Notes related to the booking intended for the service provider;

  • Notifications about the booking and their delivery information;

  • Data related to complaints, refunds, or disputes.

4.3. Payment and accounting data

When payments are made or managed on the Platform, we may process:

  • the payment amount, currency, time, and status;

  • the payment transaction number or another limited identifier;

  • information about invoices, subscriptions, payments, and refunds;

  • data necessary for invoices or other accounting documents.

All payment card data are usually handled directly by the selected licensed payment service provider, unless otherwise specified for a particular payment.

4.4. Service provider and their team data

We may process:

  • The first and last names and contact details of the service provider’s representative, owner, specialist, or employee;

  • Data about legal entities, individual activities, professional registration, and representation;

  • Information on licenses, permits, qualifications, or insurance when required;

  • Workplace, job position, Platform role, and access rights;

  • Work schedules, working hours, bookings, and service availability;

  • Data about the selected plan, subscription, billing, and use of business features;

  • Content regarding salons, specialists, services, and profiles.

When the service provider manages work schedules, remuneration, clients, or other business management data for their own purposes, the data controller is the service provider, and Beautlix acts according to their instructions.

4.5. Communication, support, and content data

We may process:

  • Your inquiries, complaints, and correspondence with Beautlix;

  • Date, channel, content, and resolution status of communications;

  • Feedback, ratings, photos, and other content you have published;

  • Reports of potentially illegal or rule-violating content;

  • Newsletter subscriptions and marketing preferences.

4.6. Technical, usage, and security data

We may process:

  • IP address, device and session identifiers;

  • Device type, model, operating system, app version, and browser;

  • Logs of login, logout, errors, and security events;

  • visited pages, performed actions, searches, filters, and usage time;

  • approximate location determined by IP address, or a more precise location if allowed in device settings;

  • data from cookies and similar technologies.

4.7. Special categories of data

Normally, Beautlix does not request diagnoses, detailed health histories, or other special category data for reservations. If information about allergies, contraindications, or other health conditions is necessary for the safe provision of service, it is recommended to provide it directly to the selected Service Provider.

If a feature specifically for such data is implemented on the Platform in the future, additional information will be provided before collecting it and a proper GDPR Article 9 basis will be ensured. Please do not write unnecessary health information in general notes or communication fields.

5. PURPOSES AND LEGAL BASES OF DATA PROCESSING

Purpose Processed data Legal basis
Create, authenticate, and manage Account Account, identity, contact, and security data Contract performance or pre-contractual measures – GDPR Article 6(1)(b).
Accept, transmit, confirm, and manage Reservations Contact, Reservation, service, message, and, where applicable, payment data Contract performance or pre-contractual measures – GDPR Article 6(1)(b).
Provide business management functions to Service Providers Service provider, team, clients, Reservations, schedule, and plan data Contract performance – GDPR Article 6(1)(b); when acting as processor – documented instructions from the Service Provider
Manage payments, subscriptions, invoices, and refunds Payment, accounting, plan, and contact data Contract performance – GDPR Article 6(1)(b); legal obligation – GDPR Article 6(1)(c).
Provide customer support and handle complaints Contact, communication, Account, Reservation, and related data Contract performance – GDPR Article 6(1)(b); legitimate interest in effectively handling inquiries – GDPR Article 6(1)(f).
Ensure Platform security, prevent fraud and abuse Technical, login, actions, Account, payment, and incident data Legitimate interest to protect the Platform and its users – GDPR Article 6(1)(f); legal obligation – GDPR Article 6(1)(c), when applicable
Verify Service Provider identity and legality of operations Identity, registration, contact, licenses, and representation data Legal obligation – GDPR Article 6(1)(c), when applicable; legitimate interest to ensure a reliable Platform – GDPR Article 6(1)(f).
Manage reviews and other content Data on reviews, ratings, reservation confirmations, content, and messages Contract execution – GDPR Article 6(1)(b); legitimate interest to ensure reliable information – GDPR Article 6(1)(f); legal obligation – GDPR Article 6(1)(c), where applicable
Analyze and improve the Platform Aggregated usage, technical, error, and statistical data Legitimate interest to improve the Platform – GDPR Article 6(1)(f); consent – GDPR Article 6(1)(a), when consent-requiring technologies are used
Send news and marketing offers Name, email, phone number, marketing preferences, and interaction data Consent – GDPR Article 6(1)(a) and electronic communications rules
Fulfill legal, tax, and accounting obligations Data related to contracts, payments, accounting, identity, and communication Legal obligation – GDPR Article 6(1)(c)
Establish, claim, or defend legal claims Data related to disputes, contracts, reservations, payments, security, or communication Legitimate interest to defend rights – GDPR Article 6(1)(f)

When relying on legitimate interest, we assess Beautlix’s or a third party’s interest, necessity of processing, and potential impact on your rights. You have the right to object to such processing as specified in section 12.

6. WHICH DATA YOU MUST PROVIDE

Data marked as mandatory during registration, reservation, payment, or service provider verification is necessary to provide the relevant function or fulfill legal obligation. Without it, creating an account, making or confirming a reservation, enabling payment, activating a service provider profile, or providing a specific Platform feature may be impossible.

Filling optional profile fields is not required. Consent to direct marketing is voluntary and does not affect your ability to use the core Platform services.

7. WHO WE MAY DISCLOSE DATA TO

To the extent necessary for the specific purpose, we may disclose data to:

  • The service provider you selected, their authorized specialists or employees to fulfill the reservation;

  • Payment, banking, or fraud prevention service providers;

  • Hosting, cloud, database, backup, and cybersecurity service providers;

  • Email, SMS, messaging, customer service, and other communication service providers;

  • Authentication, software, technical support, and analytics service providers;

  • Accountants, auditors, lawyers, insurers, and other professional consultants;

  • Related companies, investors, or business acquirers in case of restructuring, merger, financing, or business transfer, applying confidentiality and data protection measures;

  • Courts, law enforcement, supervisory, tax, and other state authorities when we are required or have a legal basis to provide data;

  • Other persons when you have given valid consent or transfer is permitted by law.

We allow data controllers to use data only according to our documented instructions, concluded agreements, and applicable data protection requirements.

Beautlix does not sell or rent personal data to third parties.

8. SERVICE PROVIDERS AS INDEPENDENT DATA CONTROLLERS

8.1. Only the data necessary for booking and service administration is transferred to the service provider. Typically this includes your name, contact details, selected service, time, booking status, and any notes you provided related to the booking.

8.2. Having received the data, the service provider may use it to provide the service, communicate, perform accounting, comply with legal obligations, and protect their rights according to their privacy notice.

8.3. The service provider may not use the customer's data obtained through the platform for marketing unrelated to the booking without a proper legal basis.

8.4. For matters regarding processing by the service provider, their retention periods, or marketing, you should contact that service provider directly. Beautlix can assist in identifying which party is responsible for a specific request.

9. INTERNATIONAL DATA TRANSFER

We primarily aim to process data within the European Economic Area (EEA). When a service provider or their infrastructure is outside the EEA, or data is accessed from there, transfers are carried out only with a lawful basis and appropriate safeguards, such as:

  • European Commission adequacy decision on an adequate level of data protection;

  • Standard contractual clauses approved by the European Commission and, where necessary, additional technical or organizational measures;

  • Another transfer mechanism provided for in Chapter V of the GDPR.

Information about the safeguards applicable to a specific transfer or a copy of them can be requested by email support@beautlix.com. Commercially or security sensitive information may be reasonably redacted.

10. DATA RETENTION PERIODS

We retain data no longer than necessary to achieve the purpose, fulfill legal obligations, or assert and defend claims. The main retention periods applied are as follows:

Category of data Standard retention period
Account and profile data While the account is active and up to 3 years after its closure, except for data that must or should be retained longer
Booking history, changes, and cancellations Up to 5 years from the completion or cancellation of the booking, as needed for disputes, fraud prevention, and service history verification
Customer service inquiries and complaints Up to 3 years from final resolution, and in case of a dispute – until its final resolution and the applicable limitation period expiration
Service provider contract, verification, and business account data During the term of the contract and up to 10 years after its end, as needed for legal requirements or statutory compliance
Payment and accounting documents For the period established by law; when Beautlix is required to keep accounting documents – typically 10 years
Marketing data Until consent withdrawal or another lawful basis ends; proof of consent and its withdrawal may be retained for another 2 years
Reviews and public User content While content is published; upon removal, a limited copy may be retained for up to 3 years for violation, dispute, and legal defense purposes
Technical, usage, and security logs Usually up to 12 months; data related to incidents, fraud, or disputes – until the conclusion of investigations and legal deadlines
Cookie data For the periods specified in the cookie policy

After the period ends, data is deleted, irreversibly anonymized, or securely isolated until technical deletion from backups according to the established backup cycle.

11. AUTOMATED DECISIONS, SEARCH AND PROFILING

11.1. Beautlix does not make decisions based solely on automated data processing that would cause you legal or similarly significant consequences, unless you have been separately informed about the specific case and your available rights.

11.2. The platform may automatically sort search results or recommendations by selected location, date, service category, availability, price, reviews, and your selected filters. The main ranking principles are described in the Terms of Use.

11.3. Security and fraud prevention measures may automatically flag unusual activity for additional verification, but significant account restriction complaints are reviewed with the participation of an authorized person.

12. YOUR RIGHTS

Depending on the circumstances and GDPR conditions, you have the right to:

  • obtain information about the processing of your data;

  • access the processed data and receive a copy;

  • request correction of inaccurate or completion of incomplete data;

  • request deletion of data;

  • request restriction of data processing;

  • object to data processing based on legitimate interest;

  • at any time and free of charge object to direct marketing;

  • receive the data you provided in a structured, commonly used, and machine-readable format and, where technically feasible, transmit it to another controller;

  • withdraw consent at any time without affecting the lawfulness of processing before withdrawal;

  • obtain human intervention, express your view, and challenge the decision when a legally applicable significant decision is made solely based on automated processing;

  • file a complaint with the supervisory authority.

Rights are not absolute. For example, deleting data may be impossible if we must retain it under laws or need it to assert or defend legal claims.

You can submit a request by email support@beautlix.com. To protect data, we may ask for reasonably necessary information to verify your identity. We respond to requests without undue delay and no later than within one month. In complex cases, this term may be extended by two months, with notification and explanation within the first month.

If you believe your data is processed unlawfully, you have the right to file a complaint with:

The State Data Protection Inspectorate
Address: L. Sapiegos g. 17, LT-10312 Vilnius
Email: ada@ada.lt
Website: vdai.lrv.lt

Before filing a complaint, we suggest contacting us first so we can investigate the matter; however, this is not mandatory and does not limit the right to contact the Inspectorate directly.

13. CHILDREN'S PERSONAL DATA

Only a person aged 18 or older can independently create an Account. If the service is booked for a minor, the booking must be made by their parent, guardian, or another lawful representative. In such cases, please provide only the minor's data necessary for the specific service and booking.

If we learn that a minor has submitted data or created an Account without lawful representative involvement, we may restrict the Account and delete unnecessary data.

14. DATA SECURITY

We apply risk-appropriate technical and organizational measures to protect data against unauthorized access, loss, alteration, disclosure, or destruction. Depending on the nature of the data and risks, these may include:

  • data transmission encryption;

  • access rights and role management;

  • authentication and password protection measures;

  • logging of actions, errors, and security incidents;

  • backups, recovery procedures, and system updates;

  • assessment of service providers, contractual obligations, and employee confidentiality;

  • incident management and response procedures.

No electronic system can guarantee absolute security. If a personal data security breach poses significant risk to your rights and freedoms, we will inform you as required by law.

15. COOKIES AND DIRECT MARKETING

15.1. Necessary cookies are used to ensure the Platform and its security. Analytics, advertising, or other non-essential cookies are used only with consent when such consent is required. Detailed information about cookie names, providers, purposes, and expiration periods is provided in the Cookie Policy.

15.2. We send marketing emails or SMS only with an appropriate legal basis. Consent can be withdrawn anytime by clicking the opt-out link in the message, changing Account settings, or by writing to support@beautlix.com.

15.3. Service and security messages, such as Booking confirmation, password recovery, or important Terms changes, are not direct marketing and may be sent as needed to fulfill the contract or legal obligation.

16. PRIVACY POLICY CHANGES

We may update this policy when Platform functions, data processing, or laws change. The latest version is always published on the Platform with the update date indicated.

We will inform users by email, Platform notification, or another appropriate method about significant changes that may materially affect registered users' rights or expectations before changes take effect, when practically and legally required.

17. CONTACTS

For questions about this policy, your rights, or Beautlix’s personal data processing, please contact:

Email: support@beautlix.com
Website: www.beautlix.pl