1. Data Controller
D'Beauty Helsinki Oy (Business ID: 3412345-6) acts as the data controller pursuant to the EU General Data Protection Regulation (GDPR). We are committed to protecting the privacy of our clients and complying with Finnish regulatory standards and official supervision guidelines across our nurse-led aesthetic sanctuary.
D'Beauty Helsinki Oy
Freesenkatu 5 / Dagmarinkatu 12, 00100 Helsinki
Email: [email protected]
Phone: +358 45 617 4122
2. Personal Data We Collect
We only collect personal data that is essential for providing safe, high-quality, personalized services and aesthetic treatments:
- Contact Details: Name, email address, phone number, address, and date of birth.
- Appointment & Treatment History: Past bookings, scheduled rituals, and gift card purchases stored in the Phorest management system.
- Health & Aesthetic Consultation Notes: Pre-treatment screening notes (such as skin type, allergies, medications, contraindications) administered by our registered nurses to ensure utmost treatment safety.
- Skincare Quiz Responses: Answers submitted through our skincare analysis quiz used to compile customized treatment recommendations.
3. Purpose & Legal Basis of Processing
Personal data is processed to manage client appointments, fulfill treatment contracts, ensure treatment safety compliance, and meet legal recording requirements. Processing is based on contractual necessity, legal compliance under health authorities, and explicit client consent.
4. Data Storage & Security Standards
All personal data is stored in secured, encrypted databases and ISO-certified Phorest cloud servers. We apply strict SSL/TLS encryption, firewall safeguards, and role-based access control (RBAC). Data is retained only as long as required by regulations or active client relationships.
5. Your Rights Under GDPR
Under the GDPR framework, you have the following rights regarding your personal data:
- Right of Access: You may request a complete copy of all personal records we hold about you.
- Right to Rectification: You can update inaccurate information via your client portal or by contacting us.
- Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data, provided legal retention requirements do not mandate preservation.
6. Contact Our Privacy Officer
If you have any questions regarding our privacy practices or wish to exercise your rights under GDPR, please reach out to us at [email protected].