Privacy Policy

Effective from: 11 October 2026. This is a translation; in case of discrepancies, the Polish version prevails.

1. Data controller

The controller of personal data collected through the look-factory.com website is Inna Khorkhol, who runs the Look Factory eyelash extension school in Warsaw; correspondence address: ul. Kolorowa 19, 02-495 Warszawa, Poland.

For any matters concerning personal data, write to us at: inna.khorkhol2020@gmail.com.

2. What data we collect, why and for how long

Course enquiries and contact form

When you send an enrolment form, the contact form or the form on our ad campaign page, we receive your name, phone number, chosen course and your message, if you write one. We also automatically record the language and address of the page from which the form was sent, campaign parameters contained in the page address (e.g. utm_source, utm_campaign, campaign and ad IDs) and whether you arrived on the site from a Meta ad — without the click ID. We store the enquiry in our enquiry database and receive it by e-mail.

We reply to your enquiry and agree course details at your request (Art. 6(1)(b) GDPR). We use campaign parameters to measure the effectiveness of our ads (Art. 6(1)(f) GDPR — our legitimate interest). We keep the enquiry for as long as it is needed to handle your request; if you enrol on a course, the rules under “Course participants” apply.

Course participants

If you enrol on a course, we keep your contact details, class dates and information about payments and deposits in order to conclude and perform the contract (Art. 6(1)(b) GDPR). We also process payment data to comply with tax obligations (Art. 6(1)(c) GDPR). We keep the data until the course and settlements are completed, and then for the period required by tax law or until any claims become time-barred — whichever is longer.

Shop

When ordering, you provide your name, e-mail address, phone number and an optional comment, and for orders with delivery also the delivery address. Orders from the cart reach us by e-mail only; orders placed on the order page are additionally stored in our database. We send a confirmation to your e-mail address. We process the data to fulfil the order (Art. 6(1)(b) GDPR) and to comply with tax obligations (Art. 6(1)(c) GDPR) — until the order is fulfilled, and then for the period required by tax law or until any claims become time-barred, if longer.

User account

If you create an account, we process your e-mail address, first and last name and — if you provide them — your phone number, Instagram, city and preferred language (Art. 6(1)(b) GDPR). We keep the data until the account is deleted — you can delete it yourself in your profile or ask us to do so by e-mail. Data of placed orders is kept as described under “Shop”. On the registration, sign-in, password recovery and profile pages we use Google reCAPTCHA to protect the site against bots (Art. 6(1)(f) GDPR).

Contact by e-mail, phone and messaging apps

If you write to or call us directly, we process the data needed to reply (Art. 6(1)(f) GDPR). We keep correspondence, including copies of enquiries and orders received by e-mail, for as long as needed to handle the matter, and if it concerns a course or an order — for the periods described above. When using Instagram or Telegram, their own rules also apply to you.

Website security

The server keeps technical event logs: IP address, time, page address and browser data, without form contents. They are used to protect the site against abuse and to fix errors (Art. 6(1)(f) GDPR). Logs are deleted automatically when they are rotated or when the space reserved for them fills up. We create database backups only to be able to restore data after a failure; deleted data may remain in them until the backup in question is deleted.

3. Cookies, statistics and advertising

Necessary cookies always work: they remember your cookie choice (cookie_consent and lf_mkt — confirmation of marketing consent, both up to 12 months), the site language (up to 1 year), sign-in, form protection and the message shown after sending a form (for the session; sign-in with “Remember me” — up to 14 days). On the registration, sign-in, password recovery and profile pages, Google reCAPTCHA may set its own cookies needed for bot protection. Your cart contents are stored in your browser’s storage.

Statistics — only with your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law, Prawo komunikacji elektronicznej). We use Google Analytics 4 (_ga cookies, up to 2 years; Google keeps user-level data for no longer than 14 months) and our own visit statistics: the lf_vid cookie (up to 2 years) with a random browser ID, and in our database we store the visited page without parameters, the language and the time of the visit. We keep our statistics data for as long as it is needed to analyse site traffic.

Meta advertising (Facebook, Instagram). With your marketing consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law), we use Meta advertising tools — Meta Pixel and Meta Conversions API — to measure the effectiveness of our ads on Facebook and Instagram. Without this consent we do not load the Meta script and do not send any data to Meta.

How it works:

  • Meta Pixel runs in your browser. The script connects directly to Meta’s servers, which receive, among other things, your IP address, browser data, the addresses of pages you visit and the fact that a form was sent (without its content), and it sets the _fbp and _fbc cookies (up to 90 days). Meta processes this data under its own rules.
  • After a form is sent, our server (Meta Conversions API) sends Meta only: the event name and time, a random event ID, the page address without parameters, browser data (User-Agent) and the values of the _fbp and _fbc cookies, if present. Our server does not send your name, phone number, e-mail address or IP address. Data needed to send the event is deleted within 24 hours at the latest, and the record that it was sent — after 30 days.
  • For the collection and transmission of this data to Meta, we are joint controllers with Meta Platforms Ireland Limited. More information is available in the Meta Privacy Policy.

You can change or withdraw your consent to statistics and advertising at any time in “Cookie settings” in the site footer. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. We store your choice in the cookie_consent cookie in your browser and — so that we can demonstrate that consent was given (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR) — in a consent register on our server: a random ID, the selected categories, the version of the banner text, and the time of the choice and of its withdrawal or change, without your IP address or any other data about you. A choice is valid for 12 months; we keep register entries for as long as we may be required to demonstrate that consent was given. Giving and withdrawing marketing consent is also recorded in the server logs.

External services. The Google map on the “Contacts” page loads right away if you have consented to marketing; without that consent it loads only after you click “Show Google map” (Art. 6(1)(a) GDPR). Google then receives your IP address and may set its own cookies. The site icons are loaded from a Cloudflare server (cdnjs), which receives your browser’s IP address.

4. Who we share data with

  • Hetzner Online GmbH (Germany) — website server and database.
  • Google — e-mail (Gmail), Google Analytics, reCAPTCHA and Google Maps, to the extent described above.
  • Meta Platforms Ireland Limited — only with your marketing consent.
  • Cloudflare — delivery of the site icons.
  • Competent public authorities, including tax authorities — where required by law.

Google, Meta and Cloudflare may also process data in the USA, based on the EU-US Data Privacy Framework or standard contractual clauses. We do not sell your data.

5. Your rights

You have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on our legitimate interest. You can withdraw consent at any time. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). To exercise your rights, write to inna.khorkhol2020@gmail.com.

Providing data is voluntary, but without your name and phone number we cannot reply to your enquiry, and without order details we cannot fulfil your order. We do not make decisions about you based solely on automated processing.

6. Changes to this policy

We may update this policy when our services or the law change. The current version is always available on this page together with the date from which it applies.