1. GENERAL PROVISIONS AND SCOPE
1.1. This Privacy Policy (hereinafter the ‘Policy’) sets out the procedure for the collection, processing, storage, protection and use of personal data when using the yemisce.com digital SaaS software service (hereinafter the ‘Service’).
1.2. The Policy has been developed in accordance with the European Union General Data Protection Regulation (GDPR / Regulation EU 2016/679), the Polish data protection law (RODO), and the Law of Ukraine ‘On Personal Data Protection’.
1.3. This Policy is an information and notification document. During registration and payment, the User confirms that they have read this Privacy Policy and understand how their data is processed.
2. DISTINCTION OF ROLES UNDER THE GDPR
2.1. Individual Entrepreneur Marchenko A.V. as Data Controller: The Provider acts as the Data Controller in respect of its own B2B users (specialists, salon owners, administrators) who create an Account in the Service, pay for a subscription and interact with support.
2.2. Individual Entrepreneur Marchenko A.V. as Data Processor: In respect of the personal data of End Clients (names, telephone numbers, booking histories) entered by the User into the Service’s databases, the User (salon/specialist) is the Data Controller. The Provider acts solely as a Data Processor and processes this data on behalf of the User in accordance with Article 28 GDPR and the concluded Data Processing Agreement (DPA).
3. CATEGORIES OF DATA PROCESSED
3.1. B2B user data: Full name, business/studio name, email address (hello@yemisce.com, etc.), contact telephone number, individual entrepreneur/company registration data, IP address, selected subscription parameters.
3.2. End Client data (in Processor mode): Name, telephone number, email address, booking history, notes on treatments/services created by the User.
3.3. Technical, analytical and marketing data: Cookies, server request logs, device type, operating system and browser language settings. Only with your separate consent to marketing cookies may OpenAI advertising attribution identifiers be processed on the marketing site. The list of cookies, their purpose and duration is given on the “Cookies” page (yemisce.com/cookies).
4. LEGAL BASES FOR PROCESSING (ART. 6 GDPR)
4.1. Performance of the Agreement — Art. 6(1)(b) GDPR: The main legal basis for processing the User’s personal data is the necessity to perform the Public Offer (providing access to SaaS functionality, Account support, settlements).
4.2. Legal obligation — Art. 6(1)(c) GDPR: Processing transaction data for fiscalisation in UAH, tax accounting of the individual entrepreneur and issuance of settlement documents.
4.3. Legitimate interest — Art. 6(1)(f) GDPR: Ensuring the Service’s cybersecurity, preventing fraud and optimising database performance.
5. SERVER INFRASTRUCTURE AND CROSS-BORDER TRANSFERS
5.1. Physical location of servers: The Service’s databases are hosted on secure servers in the Federal Republic of Germany (EU) and are not stored in the territory of Ukraine. Marketing measurement data shared with consent is sent to OpenAI separately from the Service’s databases; see clause 6.3 and the Cookies page.
5.2. Remote technical administration from Ukraine: Administration and technical support of the Service are performed by the Provider (Individual Entrepreneur Marchenko A.V.) from the territory of Ukraine. Under Chapter V GDPR and Article 29 of the Law of Ukraine ‘On Personal Data Protection’, such remote administration is protected by EU Standard Contractual Clauses (SCCs) and end-to-end encryption.
6. SUB-PROCESSORS AND DISCLOSURE OF DATA TO THIRD PARTIES
6.1. Payment partner (Monobank): Transaction data is transferred to JSC UNIVERSAL BANK (monobank acquiring) for processing online payments and subscriptions. The bank acts as an independent financial operator in compliance with PCI-DSS standards.
6.2. Other technical subcontractors: Cloud infrastructure providers in Germany and services for sending system SMS and Push notifications. All subcontractors sign commitments to comply with the GDPR.
6.3. OpenAI advertising measurement: Only after consent to marketing cookies on the marketing site is the OpenAI Measurement Pixel loaded. It may store advertising identifiers in first-party cookies and send campaign measurement data to OpenAI. When consent is withdrawn, event delivery stops and these cookies are deleted. See the Cookies page for details.
7. DATA SUBJECT RIGHTS AND HOW TO EXERCISE THEM
- Right of access (Art. 15 GDPR): to obtain confirmation of processing and a copy of one’s data.
- Right to rectification (Art. 16 GDPR): to request correction of inaccurate personal data.
- Right to erasure / ‘Right to be forgotten’ (Art. 17 GDPR): to request deletion of the Account and related data.
- Right to restriction of processing (Art. 18 GDPR): to suspend data processing in specified cases.
- Right to data portability (Art. 20 GDPR): to download one’s database in a structured JSON format.
- Right to lodge a complaint (Art. 77 GDPR): to contact an EU regulatory authority (for example, PUODO in Poland, BfDI in Germany) or the Ukrainian Parliament Commissioner for Human Rights in Ukraine.
To exercise any of these rights, the User may send a request to: hello@yemisce.com. The request will be considered within 30 calendar days, free of charge.
8. DATA RETENTION AND SECURITY
8.1. Data is retained for the entire duration of the User’s Account. If the Account is deleted or the subscription is cancelled, data is retained for a reserve period of 3 (three) months (to allow restoration or export), after which it is subject to irreversible deletion or anonymisation. The data of a business whose deletion request has been approved is deleted or anonymised automatically when this period ends, except for the documentation referred to in clause 8.2. The data of a business whose access to the Service (trial, paid subscription or free access) ended and was not renewed for 3 (three) months is likewise deleted or anonymised automatically; no later than 14 (fourteen) days before the deletion the Provider sends the business owner a warning to the Account email, and the deletion does not take place earlier than 14 days after that warning. Client and team member accounts are deleted immediately upon request.
8.2. Financial and accounting documentation relating to settlements in hryvnias is retained for 3 years in accordance with the requirements of Ukrainian tax legislation.
9. DATA CONTROLLER’S DETAILS
Individual Entrepreneur Marchenko A.V. (ФОП Марченко А.В.)
Taxpayer registration number (RNOKPP): 3142116891
Legal address: Ukraine, 08324, Kyiv Region, Boryspil District, Hora village, 60 Kyivska Street
Email for privacy enquiries: hello@yemisce.com