Legal

Privacy policy on the processing and protection of personal data

01.11.2023

This privacy policy concerning the processing and protection of personal data (the “Privacy Policy”) applies in the limited liability company MB Alvaline LT (the “Company” or “we”). Personal data is processed by MB Alvaline LT, registration No. 306110517, address: Giruliu g. 10-201, LT-12112, Vilnius, Lithuania; tel. +37064575736, e-mail: info@alvaline.lt. We collect, use and store the personal data you provide to us when using our website and mobile applications (the “Website”) from any device and when contacting us in any form, in accordance with this privacy policy. By using our website and providing us with your personal data, you agree that your personal data will be processed in accordance with this privacy policy.

Basic definitions

“Personal data” – any information relating to a specific person (the personal data subject). “Processing of personal data” – any operation or set of operations performed on personal data, with or without automated means, including collection, storage, systematisation, accumulation, recording, refinement (updating, alteration), retrieval, transfer (dissemination, provision, access), anonymisation, blocking and destruction of data.

Data we collect

We process: – personal data you provide to us by filling in information fields, including filling in the contact form, consenting to receive the newsletter, registering for conferences or other events; – personal data you provide to purchase the Company’s services or to conclude a contract; – personal data necessary to provide safe and high-quality cosmetology services, i.e. information about your state of health, illnesses, pregnancy, allergies and other information the specialist will ask for to decide whether the procedure can be performed or must be declined. – technical data transmitted automatically by the device you use to visit our website, including the technical characteristics of the device and the IP address; – information stored in cookies. Which cookies the Website actually sets, and what they are for, is listed in the Cookie policy; – personal data obtained through video surveillance when you visit our cosmetology services centre.

Purposes of personal data processing

We process your personal data only for the purposes for which it was provided, including: – providing you with information about the company, services and offers, and sending you informational messages. E-mails are sent only after receiving your voluntary consent. Every e-mail from us contains a link you can use to unsubscribe from the newsletter. If you choose it, your e-mail address will be deleted from the mailing database and you will no longer receive information; – communication takes place only when you contact us yourself; – we provide services to you under a service contract. We carry out video surveillance for your personal safety as well as for the safety of our employees, clients and property. Video surveillance is carried out in public areas under strict security and privacy rules, using modern technologies and equipment. Information signs are placed in areas under video surveillance. If we process personal data of which you were not informed in this Policy, we will separately inform you of the individual conditions of processing such data. We do not take decisions that produce legal consequences for you or may otherwise affect your legitimate interests based solely on automated processing of personal data.

Legal basis of personal data processing

We process your personal data if one of the following conditions is met: – you have consented to the processing of your personal data; – the processing of personal data is necessary for the performance or conclusion of a contract; – the processing of personal data is necessary to comply with a legal obligation imposed on us by regulations (e.g. providing information to the State Tax Inspectorate); – the processing of personal data is necessary to protect our legitimate interests (e.g. we make video recordings to ensure the safety of property, and we may also go to court to recover debts, etc.); – the processing of personal data is necessary to protect your interests or those of another natural person.

General principles of personal data processing

The Company processes personal data in accordance with the following principles: – purpose limitation – personal data is processed only for the processing and use purposes set out here, or for the operations to which the data subject has consented; – data quality and proportionality – personal data is processed as accurately as possible and updated where necessary. Personal data is relevant, proportionate and does not exceed the scope necessary for the purpose of processing; – transparency – the data subject understands the purposes for which the data is processed; – security – when processing data we apply technical and organisational security measures appropriate to the possible risk factors, for example measures against accidental or unlawful destruction of data, alteration, unlawful disclosure or access; – minimisation – personal data is regularly reviewed in order to remove data no longer needed to achieve the purpose of processing.

Security of personal data

To ensure the security of your personal data during processing, we take the necessary and sufficient legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision or dissemination, as well as other unlawful actions involving personal data.

Confidentiality / transfer of personal data

Information about your personal data will not be published in publicly available sources and will not be disclosed to third parties unless the Company obtains your explicit consent or the information is required under legal acts. Where necessary, we may disclose your personal data to government and law-enforcement authorities to protect our legitimate interests. In addition, in order to fulfil our obligations to you, we may transfer your personal data to cooperation partners: data processors who carry out the necessary data processing on our behalf, for example IT infrastructure service specialists, marketing agencies, leasing companies, courier services, etc. Under the regulations of the Republic of Latvia currently in force and our cooperation agreement, these companies are obliged to protect your personal data and process it only for the purposes we specify. Some of the recipients are located outside the European Union: Anthropic PBC processes data in the United States of America. Who these recipients are, what data is transferred to them, for what purpose and on what basis is set out in the section “Data recipients and transfers outside the European Union”.

Rights of the personal data subject

The Company respects your rights to review, correct, update, object to or otherwise change or delete the information provided to the Company. For this purpose you can contact us by sending a request with the subject line “Personal data request” or “Withdrawal of consent to the processing of personal data” (where consent to the processing of personal data is withdrawn) to info@alvaline.lt. Upon your request to delete information relating to you, we will delete your personal data without delay, as respect for your rights is our priority. Unfortunately, we will not be able to delete your personal data where legal acts oblige us to keep it.

Data storage period

All personal data received from you is stored for as long as you use our services or, where your personal data is processed on the basis of your consent, until you withdraw your consent. A longer personal data storage period is permitted in order to comply with legal requirements on the minimum storage period of documents or information, or to protect our legitimate interests (for example, but not limited to, accounting or court proceedings). CCTV recordings are stored for no longer than one month. At the end of the personal data storage period, we will securely delete your personal data or make it inaccessible (archived) or unidentifiable so that it can no longer be linked to you.

Cookies

We use cookies. The Website sets only the cookies it needs in order to work: they remember the language and the city you have chosen. The Website sets no analytics and no advertising cookies. The list of the cookies used — by name, with their purpose and lifetime — is set out in the Cookie policy.

Changes to the privacy policy

The Policy may be amended without prior notice. The amended version of the Policy published on the Website replaces all previous versions of the Policy. Any amendments do not affect the Company’s general policy of respecting the rights of the personal data subject.

Data recipients and transfers outside the European Union

This section lists in one place every recipient to which the Website transfers personal data, and the grounds for such transfers. It was added to the Policy on 08.09.2026 and describes processing that did not exist in the version of 01.11.2023. Altegio — the online booking system on which booking into the salons of the network runs. What is transferred: what you enter when booking — name, telephone number, the treatment chosen, the branch and the time of the visit. Purpose: making and confirming your booking. Legal basis: performance of the contract for the provision of services and steps taken at your request prior to entering into it (Article 6(1)(b) of the General Data Protection Regulation). Anthropic PBC (United States of America) — processing of text and images by an artificial-intelligence model. The Website turns to it in two places: the assistant that answers questions about treatments, prices and available times, and the optional text summary in the skin analysis. What is transferred: the text of your message to the assistant together with information about the page you are viewing and the basket you have assembled, and, in the skin analysis, a downscaled copy of the photo — and only if you have ticked the corresponding box yourself. Purpose: composing an answer to your question and a short description of the visible condition of the skin. Legal basis: your consent (Article 6(1)(a)); the exchange with the assistant and the transfer of the photo begin only on your initiative. More about the photo in the next section. Google — the map inset. On pages that show where a salon is located there is an inset of a Google map. When such an inset loads in your browser, Google receives your IP address, information about your device and browser, and the address of the page on which the inset is open. The inset contacts Google only when it appears on the screen. Purpose: showing where the salon is and helping you get there. Legal basis: our legitimate interest in showing the location of the salon on a map (Article 6(1)(f)). The Website has no audience-measurement or advertising systems: we connect no counters and no advertising pixels, we build no profiles for showing advertisements, and the Website sets no analytics and no advertising cookies. The only contact with Google services is the map inset described above. Legal basis for transfers outside the European Union. Personal data is transferred to the United States of America only on the grounds provided for in Chapter V of the General Data Protection Regulation — on the basis of a European Commission adequacy decision or on the basis of standard contractual clauses approved by the European Commission. The data-processing terms applied by each recipient are published in that recipient’s own documents. How to withdraw consent. The consent on which the assistant and the text summary in the skin analysis rely is withdrawn by ceasing to use them: the exchange with the assistant starts only from your message, and the photo is transferred only while the box is ticked — untick it and there will be nothing to transfer. Withdrawal takes effect for the future and does not affect processing carried out before it. To withdraw consent already given and to exercise the data subject rights, write to info@alvaline.lt.

Face photo and analysis with artificial intelligence

This section applies only to the skin scanner on the Website (the “Skin analysis” page). It was added to the Policy on 07.09.2026 and describes processing that did not exist in the version of 01.11.2023. How the scanner works without transferring data. By default the photo never leaves your device: it is drawn onto a canvas in your browser, the skin readings are calculated there, and the treatment plan is assembled there as well. In this mode the photo is not sent to our server or anywhere else, and we do not receive it. What is transferred if you give consent. The analysis page has a separate tick box, “text summary by the AI”. It is unticked by default. If you tick it, a downscaled copy of your photo (no larger than 768 pixels on the long side) is transferred through our server to Anthropic PBC (United States of America) for the sole purpose of composing a short text sentence about the visible condition of the skin. Purpose of processing: composing a text description of the visible condition of the skin from a photo. This is not medical diagnostics and not the making of a diagnosis. Legal basis: your consent (Article 6(1)(a) of the General Data Protection Regulation). Consent is voluntary: without it the scanner works in full — the readings, the priority areas, the treatment plan and the booking all remain available. Recipient and transfer outside the EU: Anthropic PBC, United States of America. This is a transfer of personal data to a third country; its legal basis is described together with the other recipients in the section “Data recipients and transfers outside the European Union”. Storage period: the photo is not stored. It exists only in the memory of the request — it is processed and disappears together with it. The photo is not written to our database, to the files of the Website or to server logs; no backup copies of the photo are made. We do not store the result of the analysis either: the text stays in your browser tab and disappears when the tab is closed. How to withdraw consent: untick the box — with the next photo nothing will be transferred. To withdraw consent already given and to exercise the data subject rights listed above, write to info@alvaline.lt.

Home