Privacy Policy

Last updated: 20.10.2026

This Privacy Policy describes the rules for processing personal data of persons using the TABU Ritual SPA website, contact forms and available communication channels.

1. Data Controller

The controller of personal data is: Alla Yatskovska, conducting business activity under the brand TABU Ritual SPA Tax ID (NIP): 5273111729 REGON: 528589580 Correspondence address as in CEIDG: ul. Henryka Sienkiewicza 9, lok. 11 30-033 Kraków Poland Place of provision of TABU Ritual SPA services: ul. Henryka Sienkiewicza 9/11 30-033 Kraków Poland Contact for personal-data matters: email: tabu.ritual.spa@gmail.com phone: +48 881 335 941

2. What Personal Data We May Process

The scope of processed data depends on how you contact TABU Ritual SPA. For the website contact form, this may include:

• name — optional field;
• email address — required field;
• message content — optional field;
• basic technical data related to form submission, in particular submission date/time, IP address, browser information and the page from which the form was sent;
• advertising click identifiers and campaign parameters (for example gclid, gbraid, wbraid and UTM / ValueTrack parameters), only if Advertising consent is active at submission time and such parameters are available; they are not always present;
• information about the user’s current Advertising-category choice regarding optional Google Ads advertising technologies (consent snapshot), stored with the enquiry to respect that choice for later advertising measurement.

For contact by phone, email or via WhatsApp, Telegram or Messenger, this may in particular include:

• phone number;
• email address;
• messenger account identifier;
• message content;
• information about the service of interest, appointment timing or booking;
• other information you voluntarily provide during the contact.

After a WhatsApp click, the website may store a minimal technical contact-intent record. A WhatsApp click is not the conversation content; the website does not automatically retrieve WhatsApp messages.

After Analytics consent, the website may also run first-party behavioural measurement, including among other things the behavioural funnel and an aggregate click/tap heatmap visualisation (see section 9). Advertising consent is not required for the heatmap and does not automatically mean Analytics consent.

The website contact form is not intended for health data or other special categories of personal data. Please do not send such information via the form unless necessary.

Where a Meta Instant Form on Facebook or Instagram is used, processed data may also include contact details selected in the form and answers voluntarily given to qualifying questions.

3. Purposes and Legal Bases for Processing Personal Data

Personal data may be processed for the following purposes:

• a) responding to an enquiry, arranging an appointment, making a booking or providing a service — Article 6(1)(b) GDPR, where processing is necessary to take steps at your request before entering into a contract or to perform an agreed service;
• b) handling other customer correspondence and communication — Article 6(1)(f) GDPR (legitimate interest in conducting communication and handling received enquiries);
• c) ensuring the security of the website and systems used, preventing abuse and diagnosing technical issues — Article 6(1)(f) GDPR;
• d) establishing, exercising or defending legal claims — Article 6(1)(f) GDPR;
• e) compliance with legal obligations incumbent on the Controller — Article 6(1)(c) GDPR, where such an obligation arises under applicable law;
• f) use of optional Google Ads advertising technologies (advertising cookies / similar technologies and fuller measurement, including Consent Mode states ad_storage, ad_user_data, ad_personalization), first-party advertising first-touch attribution and related sessionStorage — only after Advertising consent — based on consent, Article 6(1)(a) GDPR and applicable rules on storing or accessing information on the user’s device (including Article 399 of the Polish Electronic Communications Law where applicable);
• g) limited advertising measurement under Google Consent Mode where Advertising consent has not been given or has been refused, including consent-state signals and limited measurement requests without using advertising cookies — Article 6(1)(f) GDPR (legitimate interest in limited measurement and accounting for marketing activities without storing advertising identifiers in cookies on the user’s device). The scope of such signals depends on Google’s configuration and does not include custom first-touch attribution or first-party Analytics measurement (behavioural funnel / heatmap). In the current Google Consent Mode configuration, analytics_storage remains denied; the Analytics category concerns the first-party behavioural funnel and first-party heatmap and is not Google Analytics;
• h) attributing the source of an enquiry/contact to an advertising campaign using click identifiers and campaign parameters stored or transmitted under first-party attribution — only after Advertising consent — Article 6(1)(a) GDPR and applicable terminal storage/access rules;
• i) measuring that an enquiry or contact originating from a Google Ads advertisement resulted in a confirmed booking (offline conversion / Booked Appointment), including sending Google Ads a limited dataset (click identifier and booking-event data, confirmation date/time and any value) — only if the system has a relevant Google click identifier and the Advertising-category consent snapshot stored for that lead/contact allows such measurement under the live implementation logic. Not every BOOKED/PAID event is uploaded. This mechanism does not transmit email or phone numbers. Legal basis: Article 6(1)(a) GDPR (together with applicable terminal storage/access rules for earlier storage of the identifier based on Advertising consent);
• j) storing, together with a submitted enquiry or contact intent, information about the user’s current Advertising-category choice regarding optional Google Ads measurement — Article 6(1)(f) GDPR (minimal record of settings needed to respect the user’s choice);
• k) storing a minimal technical contact-intent record (e.g. after a WhatsApp click) without advertising identifiers where Advertising consent has not been granted — Article 6(1)(f) GDPR (technical continuity of the contact channel and later booking handling);
• l) operating the functional 18+ age gate (tabu_age_gate) and technically remembering the consent choice to the extent necessary for those functions — Article 6(1)(f) GDPR and applicable rules on device storage/access required for those functions; this does not mean that every device storage is automatically exempt from a consent requirement;
• m) operating the first-party behavioural funnel (scroll, sections, technical interaction events), the first-party click/tap heatmap and related sessionStorage — only after Analytics consent — based on consent, Article 6(1)(a) GDPR and applicable rules on storing or accessing information on the user’s device;
• n) maintaining aggregate counters for barrier operation (age / cookie / consent choices) without user or session identifiers in the counters table — Article 6(1)(f) GDPR (diagnostics and reporting of website functions at aggregate level).

We do not use data provided in an ordinary enquiry for newsletters, mass promotional messages or independently initiating marketing communication after the matter is closed. Submitting an ordinary enquiry or booking request does not require marketing consent.

4. Is Providing Personal Data Mandatory?

Providing data is generally voluntary. In the contact form, providing an email address is necessary to submit the form and enable a reply. For bookings or arranging service details, certain data may be necessary to handle the request. Failure to provide data necessary for contact or booking may mean we cannot respond or complete the relevant action.

5. Contact Forms

The website operates contact forms in Polish and English. After a valid submission:

• the submission is stored in the website administration system;
• its content is sent to tabu.ritual.spa@gmail.com;
• the user is redirected to the relevant confirmation page.

A short notice on data processing and a link to this Privacy Policy are available next to the form.

6. Contact by Phone, Email and Messengers

TABU Ritual SPA enables contact via, among others:

• phone;
• email;
• WhatsApp;
• Telegram;
• Messenger.

When an external messenger is chosen, the user enters that provider’s environment. The provider may process data under its own privacy rules and legal bases. The TABU Ritual SPA website does not automatically retrieve conversation content from WhatsApp, Telegram or Messenger. We receive message content when the user chooses to send it to TABU Ritual SPA via the selected channel.

Contact intent (WhatsApp)

After a WhatsApp click, the website may store a minimal server-side technical record, including in particular: a technical contact reference, channel, intent status, landing path, timestamp and an Advertising-category consent-state snapshot.

• If Advertising consent has not been given or has been refused: advertising identifiers (gclid/gbraid/wbraid) and UTM/ValueTrack parameters are not sent in the contact-intent payload and are not stored in that record; offline Ads measurement is not eligible under that state.
• If Advertising consent has been given: available attribution data may be added (source/medium/campaign, ValueTrack, gclid/gbraid/wbraid, etc.).

7. Google Ads and Google Tag Manager

The website uses Google Tag Manager (GTM) for technical tag management and Google Ads to measure selected actions related to campaign effectiveness. Measurement may include, among other things:

• successful form submission;
• phone-number click;
• email click;
• opening WhatsApp;
• opening Telegram;
• opening Messenger.

Google Ads advertising-measurement technologies are optional and depend on Advertising consent (not on Analytics consent).

If the user does not give Advertising consent or rejects it:

• advertising cookies and similar advertising storage technologies are not enabled;
• Google Consent Mode states ad_storage, ad_user_data and ad_personalization remain denied;
• custom first-touch advertising attribution does not store campaign identifiers in sessionStorage;
• contact-intent does not send raw gclid/UTM to the server;
• offline Ads measurement is not eligible;
• Google tags may still send limited measurement signals and consent-state information without using advertising cookies, in accordance with Google Consent Mode.

After Advertising consent, the relevant technologies may operate more fully, including through advertising cookies and ad_storage, ad_user_data and ad_personalization = granted. Click or campaign parameters may be stored and used by first-party attribution only after Advertising consent.

The custom behavioural funnel and the first-party heatmap are enabled only after Analytics consent and are independent of Advertising consent. Advertising-only consent does not enable the heatmap. Refusing Analytics does not automatically disable advertising technologies if the user separately granted Advertising consent, and vice versa.

If an enquiry or contact intent includes a Google click identifier and the Advertising-category consent snapshot allows measurement, and a booking confirmation later meets the live conditions, the Controller may send that identifier with booking-event data (including confirmation date/time and any value) to Google Ads for offline conversion measurement. This does not include sending email or phone numbers under this mechanism.

Refusing optional categories does not restrict use of the website, form submission or available communication channels.

As of the date of the latest update of this Privacy Policy, the website does not use Google Analytics 4. The website does not use Microsoft Clarity or Hotjar. The first-party heatmap is the Controller’s own implementation and does not send heatmap events to Google Analytics, Hotjar or Microsoft Clarity. The Analytics category does not mean Google Analytics; in the current Google Consent Mode configuration, analytics_storage remains denied.

8. Facebook, Instagram and Meta

TABU Ritual SPA may conduct advertising on Facebook and Instagram and use Messenger and WhatsApp for communication.

TABU Ritual SPA may also use Meta Instant Forms made available directly within Facebook or Instagram ads. If a user submits such a form, voluntarily provided information may include contact details and answers about the enquiry, preferred experience type or preferred appointment timing.

Data submitted through a Meta Instant Form is used to respond to the enquiry, provide information about available appointments and services and, where requested, arrange a booking.

Meta Platforms may process information connected with ad display and form submission under Meta’s own privacy terms. TABU Ritual SPA receives the information submitted by the user for the purposes described in this Privacy Policy.

Personal data obtained through Meta Instant Forms is not used by TABU Ritual SPA for newsletters or independently initiated mass promotional communication unless a separate legal basis or consent applies.

As of the date of the latest update of this Privacy Policy, the TABU Ritual SPA website does not use Meta Pixel as an active website measurement tool.

9. Cookies and Similar Technologies

The website may use cookies and similar technologies for certain website functions and — with the user’s consent — for first-party analytics measurement and/or Google Ads advertising measurement, depending on the selected consent categories.

The website software may use local browser mechanisms (such as localStorage or sessionStorage) for the technical operation of the interface and its functions. They are not used for custom behavioural analytics before Analytics consent or for custom first-touch attribution before Advertising consent.

Consent categories

The website distinguishes the following categories:

• Necessary — always active to the extent needed for the website to function: the functional 18+ gate, remembering the consent choice, and basic technical functions (e.g. language version). This does not mean that every device storage is automatically exempt from a consent requirement.
• Analytics — first-party behavioural measurement, including among other things the behavioural funnel, scroll depth, viewed sections, interactions with page elements and an aggregate click/tap heatmap visualisation; only after consent to this category. This is not Google Analytics. The heatmap does not operate without Analytics consent; Advertising consent is not required for it.
• Advertising — Google Ads and fuller advertising measurement (including ad_storage, ad_user_data, ad_personalization), first-touch advertising attribution, gclid / gbraid / wbraid / UTM / ValueTrack, and eligibility for offline conversion measurement under the existing conditions; only after consent to this category.

An earlier choice limited to Google Ads advertising technologies is not treated as automatic Analytics consent. The user may enable or disable Analytics and Advertising separately.

Cookie banner and settings

If no decision has yet been stored, the user may, among other things:

• accept all optional categories (Accept all);
• reject all optional categories (Reject all);
• open Settings and separately choose Analytics and Advertising, then save preferences.

The user may at any time open “Cookie settings” available on the website and change the Analytics and Advertising choices. The Analytics toggle controls the first-party behavioural funnel and the first-party heatmap. The Advertising toggle controls Google Ads, advertising first-touch attribution and offline Ads measurement. Necessary remains active for technically necessary functions. Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal. Refusal of optional categories does not block the contact form, phone number, email address or messenger links.

Remembering the selected language

The website uses Polylang, which may use the pll_language cookie to remember the selected language version.

Remembering the user’s consent decision (tabu_consent)

The website uses the tabu_consent cookie to remember the user’s choice for the Analytics and Advertising categories. This cookie does not itself measure advertising effectiveness or profile the user. The decision may be stored for up to 180 days (Path=/, Secure, SameSite=Lax).

If the user submits a contact form or creates a contact intent, the current Advertising-category decision state may be stored server-side with the record (consent snapshot). Storing that information alone does not upload an offline conversion to Google and does not change Consent Mode beyond the user’s already made choice. Where the user has not previously made a choice, this is treated for this purpose as a state corresponding to no Advertising consent.

Technical advertising state (tabu_gcm_consent)

The website may additionally store a technical state corresponding to the decision on Google Ads advertising technologies in the tabu_gcm_consent cookie (granted / denied), to keep existing measurement mechanisms working consistently. This cookie reflects the Advertising category: Advertising consent → granted; no Advertising consent → denied. It is not a standalone decision covering all optional technologies (in particular it does not control the Analytics category). Retention: up to 180 days (Path=/, Secure, SameSite=Lax).

Functional 18+ age gate (tabu_age_gate)

The website uses the tabu_age_gate cookie/state to remember the functional age-gate state and to avoid treating subsequent page views as a new decision. Possible states: pending, accepted, rejected. It is set when the gate is handled (including pending when a decision is first required) and updated after the user’s choice. Retention: up to 180 days (Path=/, Secure, SameSite=Lax).

The mechanism supports the access-restriction function and remembering that function’s state. The cookie does not identify a person, does not legally confirm age and is not proof of age.

sessionStorage (similar technology)

sessionStorage operates within a browser/tab session and is generally removed when that session ends.

• After Analytics consent, the following may be used: tabu_funnel_sid, tabu_funnel_fired, tabu_funnel_state — technical first-party behavioural-funnel state; the same random technical session identifier (tabu_funnel_sid) may also be used by the first-party heatmap.
• After Advertising consent, the following may be used: tabu_first_touch_attribution — first-touch attribution (may include gclid, gbraid, wbraid, UTM, ValueTrack, first landing path, referrer host — only if available).

Without the relevant consent, these custom keys are not created or are cleared under the current implementation.

First-party behavioural funnel (Analytics category)

Only after Analytics consent may the website collect first-party behavioural events needed to build the funnel report. Server-side storage may include, among other things: a random technical session identifier; event time; general device category (mobile/tablet/desktop); language version; page path; scroll depth reached; viewed sections; form start; contact-channel choice (e.g. WhatsApp / phone); other technical events needed for the funnel report.

The funnel is not intended to store: name, email, phone number, message contents, IP as a funnel identifier, or gclid/UTM in the funnel events table. Users without Analytics consent are not represented in this funnel.

Funnel event retention: 30 days, then automatic deletion of older events. The funnel is not Google Analytics.

First-party click/tap heatmap (Analytics category)

Only after Analytics consent may the website operate its own first-party click/tap heatmap. The heatmap does not operate if all optional categories are refused or if only Advertising consent is given. It operates with Analytics-only consent and with acceptance of all optional categories. Advertising consent is not required for the heatmap and does not affect its operation.

Click/tap position is stored in a normalised form relative to page dimensions in order to build an aggregate visualisation of interaction areas. Measurement may also cover the scroll depth reached on the page. The heatmap does not perform user session recordings, does not record continuous mouse trajectories and does not create DOM replay or screenshots of the user’s session.

In connection with the heatmap, the following categories of data may be stored, among others: a random technical session identifier also used by the behavioural funnel; event date/time; page path without the query string; language version; general device category; viewport / document size; normalised click or tap position; click/tap event type; general element category (link / button / image / generic).

This session identifier is created or used only with Analytics consent. It is not a name, email address or phone number and is not a persistent advertising identifier.

The heatmap does not collect: content typed into forms; input / textarea / select values; passwords; keys / keystrokes; message contents; phone numbers; email addresses as the content of a clicked element; full href addresses; referrer; gclid / gbraid / wbraid / UTM; IP address in heatmap data; raw user-agent in heatmap data; session recordings; screen recordings. Clicks inside form controls and contenteditable elements are excluded from coordinate collection.

After Analytics consent is withdrawn, new heatmap collection stops. Previously collected raw heatmap events are retained according to the retention period stated below, unless earlier deletion applies under data-subject rights or another applicable process.

Raw heatmap event retention: 30 days, then automatic deletion of older events. The heatmap is a first-party implementation and does not use Google Analytics 4, Hotjar or Microsoft Clarity.

Aggregate barrier counters

The server maintains aggregate daily counters only for barrier operation and consent choices, including in particular:

• age-gate issuance / requirement;
• age-gate “yes” / “no” choices;
• cookie-decision opportunity (no prior decision);
• acceptance of all optional categories;
• rejection of all optional categories;
• Analytics-only choice;
• Advertising-only choice;
• saving custom preferences in settings.

These counters do not contain user or session identifiers, do not contain IP in the counters table, do not contain gclid/UTM or browsing history, and are not joined to the behavioural funnel or the heatmap. They are stored only as aggregate daily values. Earlier aggregate statistics based on a simple accept/reject model are not the same as later aggregate statistics for split consent categories.

Meaning limits:

• “age-gate issued” does not guarantee that the user actually saw the popup;
• “cookie opportunity” does not mean unique visitor (reloads may overcount);
• “unresolved” figures are estimates.

Retention: 365 days, then automatic deletion of older daily counters.

10. Recipients of Personal Data and Service Providers

To the extent necessary to run the website, communicate with customers and pursue the purposes above, data may be processed using external providers, including in particular:

• Hostinger — website hosting infrastructure;
• Google — Gmail, Google Ads and Google Tag Manager;
• Meta — WhatsApp, Messenger, Facebook and Instagram, to the extent the user uses those services;
• Telegram — communication via Telegram;
• providers of technical, IT, accounting or legal services to the Controller — where access to specific data is necessary to perform entrusted tasks.

The website also uses WordPress and Elementor for content management and forms. Access to data is limited to persons and entities who need it for specific tasks. We do not sell personal data.

11. Transfers of Personal Data Outside the European Economic Area

Some providers used by TABU Ritual SPA operate globally. Using such services may involve processing certain technical or communication data outside the EEA. Where data are transferred to a third country, the transfer is made in accordance with Chapter V GDPR, in particular on the basis of:

• an adequacy decision of the European Commission;
• standard contractual clauses approved by the European Commission;
• or another mechanism provided by applicable law.

The applicable mechanism depends on the specific provider, service and place of processing. Information on safeguards can be obtained by contacting the Controller or reviewing the privacy and transfer information published by the relevant provider.

12. How Long We Retain Personal Data

Data related to an ordinary enquiry that did not lead to further service provision are generally retained for no longer than 6 months from the last contact. After that period, data relating solely to a closed or obsolete enquiry are deleted or further processing is appropriately restricted. If contact leads to a booking or performance of a service, relevant data may be retained longer — for as long as necessary to:

• perform the service;
• comply with legal obligations;
• maintain required documentation;
• establish, exercise or defend claims.

If a complaint, dispute, refund request, claim or proceedings arise regarding a specific matter, related data may be retained until the matter is closed and for the period needed to pursue or defend related claims.

Additionally (technical periods applied on the website):

• first-party behavioural funnel (Analytics category): 30 days, then automatic deletion of older events;
• raw first-party heatmap events (Analytics category): 30 days, then automatic deletion of older events;
• sessionStorage (funnel / first-touch): until the browser/tab session ends; without the relevant consent, custom keys are cleared;
• tabu_consent: up to 180 days;
• tabu_gcm_consent: up to 180 days;
• tabu_age_gate: up to 180 days;
• aggregate daily barrier counters: 365 days, then automatic deletion; they contain only aggregate daily values and do not contain user or session identifiers in the counters table;
• ordinary technical contact-intent records that are not linked to a booking, sale or offline conversion measurement are automatically deleted after a maximum of 180 days. Records linked to a booking, sale, claim or required measurement / documentation may be retained longer in line with the relevant purpose and period for that matter.

13. Your Rights

Depending on the legal basis and nature of processing, you may have the right to:

• access your data and receive a copy;
• rectify inaccurate data;
• request erasure;
• request restriction of processing;
• object to processing based on the Controller’s legitimate interest;
• data portability — in cases provided by the GDPR;
• withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. To exercise your rights, contact the Controller: tabu.ritual.spa@gmail.com

14. Right to Lodge a Complaint

If you believe your personal data are processed contrary to applicable law, you have the right to lodge a complaint with: the President of the Personal Data Protection Office (UODO). Current contact details are available at uodo.gov.pl.

15. Automated Decision-Making

The Controller does not make decisions producing legal effects concerning users, or similarly significantly affecting them, solely by automated means within the meaning of Article 22 GDPR. Advertising-effectiveness measurement and recording of certain campaign-related events are not used by the Controller to make such decisions about a specific person.

16. Data Security

The Controller applies technical and organisational measures appropriate to the nature of the data processed and the way the website operates, including in particular:

• encrypted HTTPS connection;
• restricted access to the administration panel;
• access control for systems used for the website and communication;
• technical safeguards of the hosting environment;
• updating software within the Controller’s control.

No IT system guarantees absolute security. The safeguards aim to reduce the risk of unauthorised access, loss, destruction or unauthorised alteration of data.

17. Changes to This Privacy Policy

This Privacy Policy may be updated if the operation of the website, forms, advertising systems, services used, communication channels or the manner of processing personal data changes. In particular, the Policy will be updated appropriately before or upon launching new tools that materially change the scope or purposes of processing. The current version will be published on this page with the date of the latest update.