Privacy Policy

Data controller

This site is operated by SORA MĂDĂLINA-ADRIANA PERSOANĂ FIZICĂ AUTORIZATĂ (authorized sole trader, tax ID/CUI 52536835), referred to as “we”, with its registered office in Târgoviște, Dâmbovița county, and its place of business in Bucharest, Sector 2.

For any question about your personal data, you can reach us at contact@madalinasora.com or +40 729 821 918.

What data we collect

We only collect the data you provide directly when you book an appointment or contact us by phone, email, or social media.

Specifically: your name, phone number, email address, booking details (chosen service, date and time), and any other information you choose to share with us.

Separately, the server hosting this site automatically records, for each request, the IP address, the date and time, the page requested and the browser type. These are technical logs, needed to run and secure the site (legitimate interest, Art. 6(1)(f) GDPR). We do not use them to identify you and we do not combine them with booking data.

How we use your data

We use your data solely to: manage and confirm appointments; communicate with you about the requested service; prepare your makeup according to your preferences; and comply with legal obligations where applicable.

We do not use your data for marketing without your consent, and we never sell it to third parties.

Legal basis (GDPR)

We process data based on: the performance of the service contract, i.e. your booking (Art. 6(1)(b) GDPR); your consent, when you contact us voluntarily (Art. 6(1)(a) GDPR); and our legitimate interest in running our business (Art. 6(1)(f) GDPR).

Who we share data with

The site is hosted on Google Cloud Run in the europe-west4 region (Netherlands), and online booking runs on Cal.com. In those two cases the providers act as our processors: they handle data only on our instructions. We do not pass your data to other third parties for marketing purposes.

The map is an exception, and we say so plainly. Under Google's own Google Maps Platform terms, Google is not our processor there but an independent controller: it decides for itself the purposes and means of the data the map collects, and we can neither instruct it nor control what it does with that data. This is why the map loads only after you press the button, and Google's own policy applies from that moment on.

Cal.com is a US company and processes data there. Google LLC is also a US company: although the application runs in a European region, some operational data such as technical logs may be stored or accessed outside the European Economic Area. Those transfers rely on the European Commission's standard contractual clauses, and Google LLC is additionally certified under the EU-US Data Privacy Framework.

How long we keep data

We keep booking data for as long as needed to provide the service and afterwards for the period required by legal obligations (e.g. accounting).

Contact messages are kept for as long as needed to respond to you and manage our relationship. On request, we delete data that we are not legally required to retain.

Cookies and local storage

The site does not use tracking or advertising cookies, and it runs no analytics.

The only thing we save in your browser is your theme preference (light or dark), held in local storage (localStorage). It stays on your device and is never sent to us. Because it is a setting you chose yourself, we do not ask for consent for it and there is no cookie banner.

The map and the booking calendar are outside services (Google Maps and Cal.com). The map loads only after you press its button, and so does the calendar embedded on the home, services and course pages. On the contact, FAQ, gallery and individual service pages the calendar loads with the page, so that the booking button works straight away.

From the moment one of those services loads, it may set cookies or local data of its own, under its own policy: policies.google.com/privacy for Google and cal.com/privacy for Cal.com. Until then, no request is made to either.

Your rights

Under GDPR, you have the right to: access your data, rectification, erasure (the “right to be forgotten”), restriction of processing, data portability, and objection to processing.

You can exercise any of these rights by writing to contact@madalinasora.com. You also have the right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP, www.dataprotection.ro).

Changes to this policy

We may update this policy from time to time. The current version is always available on this page, with the last-updated date shown above.