GDPR PRIVACY POLICY
PRIVACY POLICY AND PERSONAL DATA PROCESSING POLICY
Last updated: October 1, 2026
We appreciate your trust and are committed to fully protecting your personal data. This policy explains what information we collect, how we use it, to whom we may disclose it, and what rights you have under Regulation (EU) 2016/679 (GDPR).
1. Who We Are (The Operator)
The website www.leblanc-spa.ro is operated by the company SC MAYASPA SRL, with its registered office in Scornicești, 107 Muncii Blvd., Olt County, registered with the Trade Registry under No. J2022000124210, with Tax Identification Number (CUI) RO 45721325, acting as the Personal Data Controller.
Contact information:
Spa Address: 12 Ceasornicului Street, Sector 1, Bucharest
Email: [email protected]
Phone: 0733 474 360
2. What data do we collect
We process the following categories of personal data:
Identification and Contact Information: Last name, first name, phone number, email address.
Appointment Information: Requested date and time, type of treatment selected, history of services used.
Financial and Billing Information: Payment details, transaction history, billing information (for issuing tax invoices to individuals). Note: Credit card information is entered directly into the encrypted Stripe system; the spa operator does not have access to this information.
Special Categories of Data (Sensitive – Health): Information regarding medical contraindications, allergies, skin conditions, or pregnancy. This data is collected only on-site, via a form voluntarily completed by the client, exclusively for the safety of the procedures.
3. How we collect data
Your data is collected directly in the following situations:
When filling out the appointment or voucher order forms on the website.
When you contact us via email, phone, or social media.
At the spa reception desk, by filling out the initial information form before beginning your treatment.
Automatically, through session or analytics cookies while browsing the site.
4. Purposes and Legal Bases for Processing
Service Provision and Appointment Management: We use your contact information to confirm and organize your reservations. Legal basis: Performance of a contract (Art. 6(1)(b) of the GDPR).
Protecting Your Health: The assessment of medical contraindications is conducted solely to avoid physical risks during treatments. Legal basis: Your explicit consent (Art. 9(2)(a) of the GDPR).
Tax Obligations and Accounting: Collection of data for issuing invoices and tax receipts. Legal basis: Compliance with a legal obligation (Art. 6(1)(c) of the GDPR).
Customer Support: Resolving requests, questions, or complaints. Legal basis: The controller’s legitimate interest in providing high-quality services (Art. 6(1)(f) of the GDPR).
Direct Marketing (Newsletter): Sending offers, discounts, and news. Legal basis: Your express consent (Art. 6(1)(a) of the GDPR).
5. Recipients of Personal Data
Your data is not sold or rented. To ensure the smooth operation of our business, we may share certain strictly necessary data with:
Providers of IT services and web hosting services.
Secure online payment processor (Stripe).
Authorized accounting service provider (for invoice processing).
State bodies or public authorities, solely on the basis of an express legal obligation.
6. Data Retention Period
We retain your data only for as long as necessary to fulfill the following purposes:
Data related to appointments and initial records: Retained for a period of 3 years from the date of the last interaction (the general statute of limitations for protection in the event of disputes).
Financial data (invoices): Are stored for 10 years, in accordance with Romanian financial and accounting laws.
Marketing data (newsletter): This data is retained until you choose to withdraw your consent (by clicking the unsubscribe button).
7. Your Rights Under the GDPR
As a data subject, you have the following rights:
Right of access: Request a copy of the data we hold about you.
Right to rectification: Request the correction of inaccurate or incomplete data.
The right to erasure (“the right to be forgotten”): You may request the erasure of your data, unless processing is required by a legal or tax obligation.
Right to restrict processing: To limit how we use your data under certain conditions.
Right to data portability: Request that your data be transferred to another provider.
Right to Object: To object to the processing of your data based on our legitimate interest or for direct marketing purposes.
The right to withdraw your consent: At any time, without affecting the lawfulness of processing prior to the withdrawal.
The right to file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), located at 28-30 General Gheorghe Magheru Blvd., Sector 1, Bucharest, email: [email protected].
To exercise any of your rights, you may send us a written request by email to: [email protected].
8. Data Security
We implement rigorous technical and organizational measures to ensure data security: we use SSL encryption for data transmission on the website, staff access is secured by individual passwords and limited only to those who provide the services, and our storage servers are properly secured.