Privacy Policy

OUR COMMITMENT TO PRIVACY AND SECURITY

Wink Laser Studio respects your privacy and we take your data security seriously.

  • We pledge to hold all information provided to us in absolute privacy.

  • We will NEVER sell or rent your name or personal information to any third party without your permission.

  • We NEVER sell or rent our email subscriber list.

  • Only authorized Wink Laser Studio employees may access your information.

I.       PERSONAL DATA WE PROCESS

We process only personal information that is adequate, relevant, suitable, necessary, and not excessive in relation to the purposes for which it is collected.

Depending on the services you avail of, we may process the following categories of personal data:

A.      Personal Information

  • Full name

  • Mobile number

  • Email address

  • Date of birth and age

  • City or municipality of residence

B.      Sensitive Personal Information

  • Gender

  • Pregnancy status

  • Treatment records, consultation notes, and treatment assessments prepared by our physicians or medical-allied professionals (if applicable)

II.     PURPOSES AND LEGAL BASES FOR PROCESSING

A.      Primary Uses of Personal Data

 We process your personal data primarily to:

  • create and maintain your client profile;

  • schedule and manage appointments;

  • deliver laser treatment services;

  • assess treatment suitability and medical safety;

  • maintain treatment history;

  • process payments;

  • issue receipts and invoices;

  • respond to inquiries and customer support requests; and

  • comply with applicable laws and regulatory requirements.

B.      Secondary Uses of Personal Data

Subject to applicable legal bases and, where required, your consent, we may also use your personal data to:

  • send promotional offers;

  • distribute newsletters and marketing materials;

  • conduct customer satisfaction surveys;

  • improve our products and services;

  • perform statistical analysis using anonymized or aggregated information; and

  • conduct internal research, business planning, and quality assurance activities.

You may withdraw your consent for secondary uses at any time without affecting the lawfulness of prior processing.

C.      Legal Bases for Processing

Under the Data Privacy Act, we process your data using the following legal frameworks:

  • Contractual Necessity: To create your client account, manage bookings, and accurately track your treatment history.

  • Consent: To send updates, personalized marketing, and promotional offers via our newsletters or messaging channels.

  • Legitimate Interest: To secure daily operations, business improvements, and internal research.

  • Legal Obligation: To comply with regulatory mandates from the Bureau of Internal Revenue (BIR) and relevant Local Government Units (LGUs) regarding payment whenever we provide you with our official receipts.

  • Vital Interests: To ensure your physical health and medical safety during specialized laser treatments.

D.      Protection of Children's Personal Information

We never knowingly collect personal information from children. No information should be submitted to Wink Laser Studio by customers under 18 years of age without the consent of their parent or guardian.

E.     Why We Ask for Gender Information

Gender plays a vital role in determining and assessing the number of sessions required for our treatments to deliver the best results. Our team of doctors and medical-allied specialists considers this information to create customized treatment plans and determine the most effective laser settings. This ensures that every session is optimized for your specific skin and hair characteristics, helping you achieve your desired outcomes safely and efficiently.

F.      Why We Ask About Pregnancy Status

Your safety is our top priority. Certain treatments are not recommended for pregnant clients due to potential risks. However, in some cases, clients may proceed with treatments if they present a doctor’s note confirming approval. By understanding your pregnancy status, we can guide you toward the safest and most appropriate options for your situation.

Rest assured, all personal information collected is handled with the utmost care and confidentiality, in compliance with data privacy laws. If you have any questions or concerns, our team is here to assist you.

G.      Mobile Messaging

 By inputting your mobile number to book an appointment, you will receive a text reminder regarding your upcoming appointment. You may opt-out from receiving these SMS messages by emailing us at hello@winkstudio.ph.

III.    HOW WE COLLECT YOUR INFORMATION

Wink Laser Studio primarily collects your information through online forms. We store this data on our secure cloud server within our operations platform. We use the data collected so that every time you visit us, regardless of which Wink location you’re in, our staff can easily access your data and history.

A.      Automated Processing Methods

We utilize rule-based systems, such as our booking platform, to manage client records efficiently. No automated decision-making is used that produces legal or similarly significant effects without human review and approval.

IV.    DATA SHARING

We share personal information only with third parties that require such information to perform services on our behalf and only to the extent necessary to accomplish the identified processing purpose, such as secure payment processing, efficient scheduling, and personalized communication. These service providers are bound by contractual obligations requiring them to implement appropriate organizational, physical, and technical security measures and to process personal information only in accordance with our documented instructions and applicable data protection laws.

  • Online Booking & Platform Management: We share your registration, account details, and treatment logs with Zenoti, our platform provider, to manage your appointments across all locations.

  • E-Commerce and Digital Shop Management: For purchases made online through our digital storefront, your order data, name, and contact details are processed via Shopify.

  • Marketing and Email Newsletters: When you opt-in to receive updates or promotional materials, your email and name are securely processed through Mailchimp to run our newsletter segments.

  • Payment Processing Partners: To fulfill transactions safely, financial details are securely processed directly by our partner payment gateways (Maya and Paymongo), our corporate benefits and rewards partner (Pluxee), and our accredited acquiring banking partners (including BDO, BPI / Global Payments, Security Bank, UnionBank, RCBC, and Metrobank).

Certain third-party service providers maintain their own independent privacy policies regarding the financial transaction information we are required to provide to them for your purchases. We highly recommend reading their privacy policies to understand how your personal information will be handled.

 Once you leave our website or are redirected to a third-party application, you are no longer governed by this Privacy Policy or our website’s Terms of Service.

V.      RETENTION PERIOD AND BASIS

 We keep your information only as long as needed to provide our services and comply with legal or operational requirements. Your personal data are retained for 3 years from your last client interaction, visit, or transaction to ensure continuity of care, safety, and accurate historical records. Since our treatment packages do not expire, the base retention period restarts on your most recent visit or interaction with us. You may also inform us if you intend to delete the information collected from you unless we need to retain it for a legitimate purpose.

Certain records, including invoices, accounting records, and documents required by applicable laws, may be retained for longer periods where mandated by law or where necessary for the establishment, exercise, or defense of legal claims.

VI.    SECURE DISPOSAL OF DATA

Upon expiration of the applicable retention period, or when personal information is no longer required for legitimate business or legal purposes, Wink Laser Studio securely disposes of personal data through:

  • permanent deletion from production databases;

  • secure deletion from cloud storage systems;

  • secure software wiping of electronic storage media;

  • destruction of backup copies where technically feasible; and

  • anonymization where information is retained solely for statistical or research purposes. 

Disposal procedures are documented and performed in accordance with our internal information security and records management policies.

VII.   RISKS ASSOCIATED WITH THE PROCESSING OF PERSONAL DATA

 The processing of personal data involves inherent risks at every stage of the information lifecycle. During the collection stage, clients may inadvertently provide inaccurate or incomplete information, or an unauthorized individual may submit another person's personal information without proper authority. During the transmission of data via electronic means, personal information may be exposed to risks such as interception, phishing, malware, and other cybersecurity threats. While personal data is stored, risks include unauthorized access, accidental deletion, insider misuse, ransomware attacks, or other incidents that could compromise the confidentiality, integrity, or availability of the information.

During the use and disclosure of personal data, there is a risk of human error, unauthorized disclosure, or improper modification of records. Likewise, during the disposal stage, there remains a risk of incomplete deletion or the unauthorized recovery of personal information if appropriate disposal methods are not implemented. To address these risks, Wink Laser Studio continuously reviews and enhances its organizational, physical, and technical safeguards to protect the confidentiality, integrity, and availability of personal data throughout its entire processing lifecycle.

VIII.  PROTECTION MEASURES

To address the foregoing risks, Wink Laser Studio implements organizational, physical, and technical safeguards appropriate to the nature of the personal information processed.

A.      Organizational Measures

  • Privacy governance policies;

  • Confidentiality agreements;

  • Regular employee privacy and cybersecurity training;

  • Role-based access controls;

  • Incident response and breach management procedures.

B.      Physical Measures

  • Restricted office access;

  • Visitor monitoring;

  • Secure workstations and equipment;

  • Controlled access to facilities where personal information may be accessed.

C.      Technical Measures

  • Encryption of sensitive information;

  • Multi-factor authentication;

  • Firewalls;

  • Anti-malware protection;

  • Secure cloud infrastructure;

  • Activity logging and monitoring;

  • Password management policies;

  • Regular vulnerability assessments and software updates.

These safeguards are periodically reviewed and updated to address evolving security risks.

IX.    YOUR RIGHTS AS A DATA SUBJECT

A.      RIGHTS OF A DATA SUBJECT

Providing your data is optional, and you can visit our website pages without giving us any personal information. Under the Data Privacy Act of 2012 (RA 10173), you possess the following rights, which you can exercise at any time:

1.      Right to be Informed: You have the right to know how your data is collected, processed, and stored.

2.      Right to Access: You may request a detailed report of the personal information we have for you on file.

3.      Right to Data Portability: You have the right to obtain a copy of your data and securely move, copy, or transfer it in an electronic format for your own use.

4.      Right to Rectification: In the My Account section of our Booking System, you can instantly verify, update, and correct your profile details.

5.      Right to Erasure or Blocking: You have the right to request that we suspend, withdraw, or permanently delete your data and information from our active systems at any time.

6.      Right to Object: You have the right to object to the processing of your personal data, including processing for direct marketing or automated processing.

7.      Right to Damages: You have the right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.

8.      Right to File a Complaint: If you feel your data privacy rights have been violated, you have the right to file a formal complaint with the National Privacy Commission (NPC).

B.      How to Exercise Your Rights

To exercise any of your rights under the Data Privacy Act, you may submit a written request to our Data Protection Officer through the contact details below.

Your request should include:

  • your complete name;

  • contact information;

  • proof of identity sufficient to verify your identity;

  • the specific right you wish to exercise; and

  • supporting documents, where applicable.

We may request additional information solely for identity verification before acting on your request.

We will acknowledge receipt of your request promptly and endeavor to respond immediately. However, requesting a copy of your personal information will take within 30 days depending on the documents or information you provided

X.      DATA PROTECTION OFFICER CONTACT DETAILS

For any questions or concerns, you may contact our Data Protection Officer anytime:

Data Protection Officer: Cecilia D. Fernandez

Compliance Officer for Privacy: Jewel Mae B. Dela Cruz

Email Address: dpo@twofutures.ph