Privacy policy

Data controller

The controller of personal data collected through this website is Musito Adam Muszalik, ul. Powstańców Śląskich 96, 44-177 Paniówki, Poland, VAT ID (NIP) 6431657937.

For any matter concerning personal data, write to adam@musito.pl.

This website

musito.pl sets no cookies, collects no visit statistics, does not profile visitors and embeds nothing from third-party services. Typefaces are served from the same server as the page, so opening this site sends no data to anyone else.

The hosting provider records the IP address, time and type of each request in its technical logs. That data is necessary to provide and secure the hosting service (Art. 6(1)(f) GDPR — legitimate interest).

Email and telephone contact

If you write or call, the data in your message is processed to reply and, where relevant, to prepare an offer — on the basis of Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (conducting correspondence).

Correspondence is kept for the duration of the discussion and then for two years, unless a contract is signed — in which case for its term and the limitation period for claims.

Data inside musito studio

Within musito studio, the controller of the salon's client data is the salon itself. Musito processes that data solely on the salon's documented instructions, under a data processing agreement concluded pursuant to Art. 28 GDPR.

In practice this means requests concerning a client's data — access, rectification, erasure — go to the salon first. Musito carries them out on the salon's instruction and helps the salon fulfil them.

Each salon's data is isolated at the database level. A salon has no technical means of seeing another salon's data.

Sub-processors

Providing the service relies on infrastructure providers: application and database hosting, file storage and an SMS gateway operator. Each processes data only under a processing agreement and only to the extent needed for its own service.

The current list of sub-processors is made available to salons before a contract is signed, on request, and whenever it changes.

Integrations with third-party services

A salon may connect musito studio to its own profiles on third-party services — its Google Business Profile and its Facebook and Instagram accounts. The connection is made only by the salon's explicit action, through that service's standard authorisation flow, and can be withdrawn at any time.

Once connected, musito stores only what the feature needs: the connected profile's identifier and an access token. What is sent to those services is salon business data — opening hours, and posts the salon has approved. No personal data of the salon's clients is sent to any of them.

Disconnecting is possible both inside musito studio and on Google's or Meta's side. On disconnection the token is deleted.

Transfers outside the EEA

Some infrastructure providers may process data outside the European Economic Area. Such transfers take place on the basis of Standard Contractual Clauses approved by the European Commission.

Your rights

You have the right of access to your data, to rectification, erasure or restriction of processing, the right to data portability, and the right to object to processing based on legitimate interest.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise any of these rights, write to adam@musito.pl. I respond within one month of receiving the request.

Deleting your data

Instructions for deleting data — including data obtained by connecting a Facebook or Instagram account — are on a separate page: Data deletion.

Changes to this policy

This policy is updated whenever the scope of the service or the list of sub-processors changes. The date of the last update is at the top of this page.