Privacy

Privacy & Cookie Policy

Last updated: 27 September 2026. This is a courtesy translation; in case of any discrepancy the Serbian version prevails.

This policy explains how BioSkinLab processes the personal data of website visitors and clients, in accordance with the Serbian Personal Data Protection Act (“Official Gazette of the RS”, No. 87/2018) and the regulations on electronic communications.

• 1. Controller
• 2. What data we process
• 3. Purpose and legal basis
• 4. How requests are sent
• 5. Recipients and international transfers
• 6. Retention period
• 7. Your rights
• 8. Cookies
• 9. Security
• 10. Changes to this policy

01Controller

For any questions about data processing, or to exercise your rights, write to us at the e-mail address above.

02What data we process

Appointment booking form

Full name, phone number, e-mail address (optional), chosen treatment, date and time, and any note you enter yourself.

Free delivery form

Full name, phone number, delivery address and city, e-mail address (optional), chosen products and quantities, preferred delivery date and note.

Contact form

Name, e-mail address, phone number (optional) and the content of your message.

Skin health data

In the note or during a consultation you may mention allergies, skin sensitivity, therapies or skin conditions. These are special categories of personal data. We process them only with your explicit consent, solely for the safe and appropriate performance of the treatment. You may withdraw your consent at any time.

Technical data

The site does not use analytics, advertising cookies or behavioural tracking. When a page loads, your browser necessarily sends your IP address to the server hosting the site and to the services that deliver libraries (see section 5).

03Purpose and legal basis

• Booking appointments and delivering products — taking steps at your request prior to entering into a contract, and performance of the contract (Art. 12(1)(2) of the Act).
• Replying to your message — our legitimate interest in answering the enquiry you sent us (Art. 12(1)(6)).
• Skin health data — your explicit consent (Art. 17(2)(1)).
• Invoicing and tax obligations — compliance with legal obligations (Art. 12(1)(3)).
• Google map — your consent, given on the cookie banner or by clicking “Show map” (Art. 12(1)(1)).

We do not use your data for marketing, we do not sell it, and we do not carry out automated decision-making or profiling.

04How requests are sent

The forms on this site do not store data on our server. When you send a request, the site opens your e-mail app or WhatsApp with a pre-filled message, which you then send yourself. The message travels through the service you choose (your e-mail provider or WhatsApp), and we receive it at labbioskin@gmail.com (Google Gmail) or on the salon’s WhatsApp number. The privacy policies of those services also apply to the processing of your data there.

05Recipients and international transfers

We do not share your data with third parties, except:

• Communication service providers — Google (Gmail) and Meta (WhatsApp), as processors or independent controllers within their own services.
• Courier services — name, address and phone number only, for delivering the products you ordered.
• Public authorities — where required by law.
• Content delivery services — the site’s icons and scripts are loaded from cdnjs.cloudflare.com (Cloudflare) and cdn.jsdelivr.net, which technically receive your IP address. These services do not set cookies. Fonts are served from our own server.

Some of these providers (Google, Meta, Cloudflare) may process data outside the Republic of Serbia, including in the USA. Transfers take place with the appropriate safeguards applied by those providers, in accordance with Art. 64–65 of the Act.

06Retention period

• Appointment requests and orders: up to 12 months from the last contact.
• Client record with skin data: for the duration of our relationship, and no longer than 2 years from the last treatment, or until consent is withdrawn.
• Messages from the contact form: up to 12 months.
• Invoices and accounting records: for the periods prescribed by law.

07Your rights

At any time you have the right to:

• request information about the processing and a copy of your data;
• request the correction of inaccurate data or the completion of incomplete data;
• request the erasure of your data and the restriction of processing;
• receive your data in a structured format (portability);
• object to processing based on legitimate interest;
• withdraw consent, without affecting the lawfulness of earlier processing.

Send your request to labbioskin@gmail.com. We respond without delay, and within 30 days at the latest.

If you believe the processing is unlawful, you may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11000 Belgrade, www.poverenik.rs.

08Cookies

Cookies are small files that a website stores in your browser. BioSkinLab does not use cookies for analytics or advertising. We use only technically necessary browser storage, and third-party cookies are set solely by the Google map, and only if you allow it.

Necessary storage does not require consent, because the site cannot work as intended without it. The Google map is not loaded until you click “Accept all” or “Show map”. More about Google’s cookies: policies.google.com.

Your choice

You can change your choice here. You can also delete cookies in your browser settings.

09Security

We apply appropriate technical and organisational measures to protect data from unauthorised access, loss, alteration or misuse. Only the people who need the data to provide the service have access to it.

10Changes to this policy

We may update this policy from time to time. The current version is always published on this page, with the date of the last change.