Privacy policy

In force from 6 November 2026.

This policy explains how Melinda - Lindas Skaistuma Studija processes your personal data when you book a procedure online, come for a visit or receive messages from us.

1. Who processes your data

The controller is SIA "LH" (registration no. 40203713237, registered address: Rīga, Latgales iela 190 - 82, LV-1019), which trades under the name Melinda - Lindas Skaistuma Studija.

For questions about your data, contact us:

Telephone: +371 29 916 130
Email: melinda@melinda.lv

2. What data we process

When you book online:

your name, telephone number and - if you give it - email address;
the language you booked in;
the procedures chosen, and the date, time and price of the visit;
your answer to a question before the procedure, if one is asked (for example, whether your brows have already had permanent makeup). If the answer means that you must first contact the master, no booking is made and no client card is created;
whether you agree to receive offers, and when and how that consent was given.

During and after the visit the master may record:

notes about the procedure - technique, pigment, colour, needle, mix and the like;
information that may concern your health, where it is needed for a safe procedure - for example, allergies, the anaesthetic used, how the skin healed;
photographs before the procedure, after it and after healing.

Messages we send you: to whom, when and by which channel (SMS or email) a message was sent, its text, and whether it could be sent.

No-shows: if you do not come to your visit, we note it, and online booking is closed to you until we open it again.

Technical data:

your IP address - while the time you chose is being held for you, and in counters of requests and bookings from one IP address - to protect the booking system from misuse;
session data - IP address, browser name and what was entered in the booking steps, until the booking is complete;
server logs, into which, in case of an error, a name, telephone number or email may also find their way;
server access logs - IP address, time and the address opened.

3. Why, and on what basis

Booking and the procedure. To book you, send a confirmation, remind you of the visit, let you know of a cancellation or a change of time, and carry out the procedure. Basis: the contract for the service (GDPR Article 6(1)(b)).
Notes and photographs. To carry out the procedure safely, and so that at a correction or renewal the master knows what was done before and how. Basis: the contract; for information about your health - your explicit consent (GDPR Article 9(2)(a)), which you give by agreeing to personal data processing. Photographs are not published and are not shown to others without your separate permission.
A reminder of the next procedure, for example a correction or renewal. Basis: our legitimate interest in providing the service in full. You can opt out of these reminders at any time by contacting us.
Offers and news. Only with your consent, which you give by ticking a separate box when booking or by telling us. You can withdraw your consent at any time by contacting us.
Recording no-shows and protecting the system. Basis: our legitimate interests - protecting appointment times and the booking system.

4. Who else sees your data

We do not sell your data. It is processed only by these service providers, all of them working on our behalf except Google Maps:

OVH SAS - the server that holds the booking system and its backups (France, European Union).
Twilio - sending text messages (SMS): the telephone number and the message text.
Mailgun - sending emails from servers in the European Union: the email address and the message text, including the booking notifications sent to the master. Our emails do not track whether or when they are opened.
Google - the master's Google calendar: the procedure, the time, your name and telephone number.
Google - the Google Maps map of the salon's address on the booking page: your IP address and the page address, when your browser loads the map. Google provides the map under its own privacy policy, not on our behalf (see section 6).
Telegram - a notification to the master of a new or cancelled booking (the same notification may also go to the master's email): the procedure, the time and your name; if the name or email given when booking differ from those on our client card, those too. The telephone number is not sent.
The push notification service (Apple, Google, Mozilla or Microsoft, depending on the master's device) - the same notification to the master's phone or computer. It is sent encrypted, and the service cannot read its content.

Twilio, Mailgun and Google are US companies, and Telegram operates outside the European Union, so data may also be processed outside the EU. Twilio, Mailgun and Google do so under the safeguards the GDPR provides for - the EU-US Data Privacy Framework or standard contractual clauses. Telegram offers no such agreement, so we send it only what the notification to the master needs.

We may pass data to public authorities where the law requires it.

5. How long we keep it

Client data - for as long as you keep coming to us. If there has been no booking for 3 years, the system automatically erases all your data: your name, telephone number, email, notes, photographs, bookings, and the texts and addresses of the messages sent. This erasure does not reach copies of messages already sent, which are kept in the SMS and email providers' logs and in the master's Telegram and email, and in the notifications on the master's devices; they are kept under those services' own terms.
IP address - up to 15 minutes, while the time you chose is being held, and up to 2 days in the counters.
Session data - up to 15 days.
Error logs - 14 days.
Server access logs - no longer than 2 months.
Backups - erased data remain in them for up to 40 more days.
Consent to offers - until you withdraw it or your data is erased. We keep the record of your consent, or of its withdrawal, together with your data, as proof.

6. Cookies

The booking page itself sets only two necessary cookies of its own (for the Google map's cookies, see below):

pieraksts-session - remembers the booking steps so that, for example, what you have already chosen is not lost when you refresh the page. Kept for up to 14 days.
XSRF-TOKEN - protects the form against forged requests. Kept for the same length of time.

We ourselves do not use analytics or advertising cookies, and the booking page's own fonts are loaded from our own server.

The booking page shows a Google Maps map of the salon's address. When the page opens, your browser loads the map from Google. Google receives your IP address and the page address, may load its own fonts and may set its own cookies. How Google processes this data is explained in Google's privacy policy (policies.google.com/privacy).

7. Your rights

You have the right to:

find out what data we hold about you, and receive a copy of it;
ask for inaccurate data to be corrected;
ask for your data to be erased - if you have an upcoming booking, we cancel it first;
ask for processing to be restricted, or object to processing based on our legitimate interests;
receive your data in a format that can be passed on to someone else;
withdraw consent at any time - to offers, or to the processing of information about your health. This does not affect what was done before the withdrawal.

Write to us or call us (see section 1), and we will answer within a month. If you believe your data has been processed wrongly, you can lodge a complaint with the Datu valsts inspekcija (Data State Inspectorate) (www.dvi.gov.lv).

8. Automated decisions

We do not carry out profiling. Only two things happen automatically: when the master marks a no-show, online booking is closed to you; and only a limited number of bookings can be made online in one day from one telephone number, email address or IP address. In both cases you can book by contacting us.

9. Changes

If this policy changes, the new version is published on this page with a new date of entry into force.