Privacy policy

This is a translation, provided for convenience. The legally binding version of this document is the Slovenian one — Politika zasebnosti. If the two differ, the Slovenian text applies.

This policy explains what personal data we collect through the dior.si website and in the studio, why we collect it, and what rights you have in relation to it. It is drawn up in accordance with the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

Who the controller is

The controller of your personal data is ATA SISTEMI, d. o. o., Kajuhova ulica 12, 3310 Žalec, Slovenia, which provides the services in the studio at Dunajska c. 13, Ljubljana, under the Dior Nail Studio brand. For any privacy question, email info@dior.si or call 064 277 047. We are not required to appoint a data protection officer and have not done so; we handle questions ourselves at the address above. Full company details are in the imprint.

What data we collect

When you book an appointment. Your name and surname, email address, phone number, the service and time slot you chose, and any note you add yourself. To book we need your phone number and email address, so we can send you the confirmation and a reminder before your appointment; without them a booking cannot be made.

When you create an account. The same data plus a password, stored in encrypted form that we cannot read. To confirm your phone number we send you a one-time code by SMS. Codes go by SMS only to Slovenian numbers (+386); for a foreign number, or when the studio’s phone cannot send texts, we send the code to your email address — a number confirmed that way is used for reminders, not for SMS sign-in.

When you pay online. Payment data: amount, time, status and transaction reference. We never receive or store your card details — you enter them directly with Stripe, which is certified under PCI DSS.

Saved cards in the app. To pay in the app we create a customer profile for you at Stripe (name, email). If you choose to save your card when paying, Stripe stores it and offers it at your next payment with us; you can remove it in the payment form. We never receive the card number — only the card type and last four digits.

When you pay and we issue an invoice. The data an invoice must contain by law.

When you contact us by email or phone. Whatever you tell us in your message.

Health information. Before a treatment we ask about allergies, skin or nail conditions and injuries, so that we do not carry out a treatment that could harm you. We do not enter this into the online system. If a record is needed (for example an allergy to a particular material), we keep it only with your explicit consent (Article 9(2)(a) GDPR), which you can withdraw at any time.

Automatically when you visit. Data logged by the web server (IP address, time of visit, page viewed, browser type) and, only with your consent, visit data through Google Analytics. Details are in the cookie policy.

Why we process data and on what legal basis

Providing the service — booking, confirmation and reminders by email and SMS, managing your account and carrying out the treatment. If the studio has to cancel an appointment (for example through illness or a closed day), we tell you in the app, by SMS and by email, and refund any online payment in full. Legal basis: performance of a contract and steps prior to entering into it (Article 6(1)(b) GDPR).

Running and securing the website — preventing abuse, spam sign-ups and attacks. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

Measuring visits — visit statistics through Google Analytics. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

Legal obligations — issuing and keeping invoices and accounting records. Legal basis: legal obligation (Article 6(1)(c) GDPR).

Automated decisions

Some booking decisions are made automatically, by fixed rules:

• Deposit for a first visit. If you have not yet had a completed appointment with us, an online booking needs a deposit, which is deducted from the price.
• Confirming your visit. For appointments booked from 30 Oct 2026 we ask you 48 hours before (in the app, by SMS or by email) to confirm that you are coming. If you have not confirmed 24 hours before, the studio decides: it may call you or cancel the appointment; the system does not release it by itself. The only automatic release is for an appointment the studio booked by phone for a new client when the required deposit (20 €) has not been paid by the deadline given in the message with the payment link; we tell you by SMS and email. An appointment with any payment on it is never released automatically.
• No-show. If the studio marks an appointment as a no-show, 50 % of the price is owed under our terms (anything paid counts). Until it is settled, new bookings in the app and on the website are not possible (for at most 12 months).
• New clients. Until your first completed visit you can have one appointment booked at a time.

These decisions can release an appointment or pause online booking; we do no other profiling. If you disagree with a decision, write to info@dior.si or call 064 277 047 — a person at the studio will review it, and you can give your point of view (GDPR Art. 22(3)).

Where data is processed and who receives it

The website, the booking system (Amelia) and email run on a server we operate ourselves, in Slovenia. We do not sell personal data. We share it only as far as needed to provide the service:

• Stripe Payments Europe, Limited (Ireland) — processing online payments by card or digital wallet (Apple Pay, Google Pay, Link, Revolut Pay);
• Google Ireland Limited — a Google calendar in which every appointment is recorded (service, time, name, phone number, price and your note), so the studio has an overview of its appointments;
• Google Ireland Limited — Google Analytics, only with your consent;
• the mobile network operator — SMS reminders and confirmation codes are sent from the studio’s phone over the mobile network.
• push notification services — Google (Firebase Cloud Messaging for the Android app and Chrome), Apple (iPhone) and Mozilla (Firefox) — only if you turn notifications on. For the Android app Google keeps an installation identifier to deliver them; notification content in browsers is encrypted. When you sign out of the app we delete that device’s notification address.
• Flik banks — only if you pay by Flik; they receive your name, number and amount.

Stripe Link. When paying online you may choose Link, where Stripe saves your card and email address so you need not enter them again next time — including at other businesses that use Stripe. Using Link is your decision and the relationship is with Stripe directly; we have no access to the stored card details. You can review or delete what is stored at any time at link.com.

We may also disclose data to the competent authorities where the law requires it.

Transfers outside the EU

Our server is in Slovenia. Stripe and Google may also process data in the United States; such transfers rely on the European Commission’s adequacy decision (EU-US Data Privacy Framework) or on the Commission’s standard contractual clauses.

Newsletter sign-up

If you sign up for the newsletter we store your email address, the wording of the consent you agreed to, your IP address and the time of sign-up. We keep the last three because we must be able to demonstrate that consent was given — for no other purpose.

You must confirm the sign-up by clicking the link we send you by email (double opt-in). When you confirm we also record the time of confirmation and the IP address it came from. Until the sign-up is confirmed we send you nothing, and unconfirmed sign-ups are deleted after 7 days.

The legal basis is your consent (Article 6(1)(a) GDPR). Signing up is voluntary and is not a condition of booking. You may withdraw consent at any time using the unsubscribe link in every message, or by writing to us at info@dior.si; withdrawal does not affect the lawfulness of processing before it.

We keep sign-up data until you unsubscribe. After that we keep a record that you unsubscribed for as long as is necessary to avoid sending you messages again.

The app and notifications

The Dior app (at dior.si/app, on your phone’s Home Screen or as an Android app) uses the same account and the same appointment data as the website. In addition we process:

• Sign-in with a code: we send a one-time code by SMS or e-mail and keep only an encrypted fingerprint of it for up to 10 minutes.
• Sign-in with Face ID or a fingerprint (passkey): if you turn it on, we store only the public key your phone creates and when it was last used. Your face or fingerprint never leaves the phone and never reaches us. We keep the key until you turn this sign-in off (Profile → Settings) or delete your account.
• Push notifications: if you allow them on your phone, we store the subscription address your browser creates and your notification settings (confirmations and changes, reminders and attendance confirmation, freed times from your waitlist, care tips, a suggestion for your next visit and free times when someone cancels). Notifications are delivered through your phone’s or browser’s push service (Google, Apple or Mozilla), which forwards an encrypted message. For each notification sent we keep a record (type, time) so the same message is never sent twice.
• Waitlist: the service, date range and time of day you chose, so we can tell you when a time opens up. The offer is sent as a push notification or, if you have none switched on, by email.
• Attendance confirmation: 48 hours before your appointment we ask you in the app, by SMS or by email to confirm your visit, and remind you once more if needed; what happens if you do not confirm is described under “Automated decisions”. The confirmation is kept until two days after the appointment.
• A free time when someone cancels: when an appointment is cancelled we may offer the time for 5 minutes to clients on the waitlist and to clients whose next visit is due; the first to confirm gets it. Turn these offers off in the app (Profile → Notifications → Free times when someone cancels) or with “Stop these” on the notification.
• A note for Luna and the chosen look: if you add them when booking, they are attached to your appointment.
• Profile: if you add them, we keep your profile photo (reduced, with no location data), date of birth and Instagram username. The studio sees them, including in the booking system; we use the date of birth to wish you a happy birthday and Instagram to tag you when we post your nails. You can change or delete them at any time under Profile → My profile. A new phone number or e-mail address only counts once you type in the code we send to it.
• Photos of your nails: after a visit the studio may photograph your finished nails for your own diary in the app (Profile → My nails). They are stored outside the website, are shown only to you through private, expiring links and are not published; you can delete any of them in the app, and they are deleted with your account.
• Inspiration photo: if you add your own picture (e.g. a screenshot) when booking in the app, it is stored the same private way, without location data, and only the studio sees it with your appointment. It is deleted after 200 days or with your account.
• Requests for a Google review: we note when we asked you for a review and whether you confirmed you posted one, so we do not ask you needlessly. You post the review itself on Google, under Google’s terms.
• Running-late message: if you send one, the studio receives it.
• Problem reports: if you report a problem in the app (Help / report a problem), we keep the text, your email address, any screenshot (outside the website, without location data), your IP address and the details the app shows you before sending (app version, device and browser type, language, screen, last error, notification status). The studio receives it by email so it can reply to you.

The legal basis is performance of the contract (Art. 6(1)(b) GDPR) for sign-in, appointments, repeat appointments, reminders, attendance confirmation, changes and the waitlist; your consent (Art. 6(1)(a) GDPR), given on your phone, for your phone to receive push notifications at all; and the studio’s legitimate interest in offering its own services to existing clients (Art. 6(1)(f) GDPR and Art. 226 of the Slovenian Electronic Communications Act, ZEKom-2) for the next-visit suggestion and a free time after a cancellation when your visit is due; and for problem reports, our legitimate interest in fixing faults in the app (Art. 6(1)(f) GDPR).

We send these suggestions only to clients who have already had an appointment with us. Together we send at most one a week and three a month, each has a “Stop these” option, and you can object to them at any time (Art. 21 GDPR): switch them off in the app (Me → Notifications), in your phone settings, or write to info@dior.si.

How long we keep data

• Appointment data: for as long as you have an account with us, and at most five years after your last appointment.
• User account: until you delete it or ask us to.
• Invoices: ten years after the end of the year they relate to, as required by the Slovenian VAT Act.
• Health record (if you consented to one): until you withdraw consent, and at most five years after your last appointment.
• Email correspondence: at most two years after the last message.
• Web server logs: at most 52 weeks.
• Network security logs: 365 days.
• Push notification subscription: until you switch it off or your browser revokes it.
• Records of notifications sent by the app: twelve months.
• Waitlist requests: up to 30 days after the end of the chosen range or after removal.
• Record of an SMS reminder sent (number, time, outcome): 90 days after the appointment.
• Content of the booking system’s email and SMS notifications: 12 months; after that only the record that a notification was sent remains.
• Problem reports from the app and their screenshots: 12 months.
• Clients the studio has blocked: their account and appointments are deleted; their email address and phone number are kept only as an irreversible fingerprint (hash), so that no new account can be created with them – indefinitely.
• Backups: deleted data may remain in backups for at most 6 more months, after which it is overwritten.

Your rights

You may at any time request access to your data, its correction or erasure, restriction of processing, transfer of your data to another controller, and object to processing based on legitimate interest. You may withdraw any consent at any time, without affecting the lawfulness of processing before the withdrawal.

You must be 15 or older to open an account yourself; under 15, a parent or guardian consents. The app also keeps your recent appointments and settings on your phone (local storage) so it works without a signal; signing out or removing the app deletes them. You can ask for your account to be deleted by emailing info@dior.si; we complete it within one month. Deletion also removes your notification addresses, waitlist, records of notifications sent and your photos; data about services provided and invoices is kept as far as the law requires.

Send your request to info@dior.si. We reply within one month at the latest. If you believe we process your data unlawfully, you may complain to the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.

Security

The website runs exclusively over an encrypted HTTPS connection. Passwords are stored in encrypted form, access to the booking system is restricted and protected, and the server is protected by a firewall and intrusion detection systems.

Changes

We may update this policy from time to time. The version published on this page, with the date of the last update at the top, always applies.

Back to the home page