Data Protection (GDPR)

Last updated: 16 July 2026

The General Data Protection Regulation gives you control over your own personal data. This page explains what those rights are, how to exercise them with us, and how MetaBlink approaches data protection in everyday work.

Your rights

AccessYou can find out whether we process your data and get a copy of it.

CorrectionWe correct inaccurate or incomplete data without delay.

DeletionWe delete data once there is no longer a basis to keep it.

RestrictionYou can temporarily pause processing while something is being resolved.

ObjectionYou can object to processing based on legitimate interest.

PortabilityYou receive your data in a format that is easy to transfer elsewhere.

Withdrawing consentYou can withdraw consent at any time, with no effect on future use.

Complaint to a supervisory authorityYou can always contact the Personal Data Protection Agency.

How to exercise a right

Send your request to or by post to Utinjska ulica 19, 10000 Zagreb, Croatia. To protect your data, we may ask you to confirm your identity. We respond within one month at the latest, and this period can be extended by a further two months for complex requests, of which we will inform you. Exercising your rights is free, unless a request is clearly unfounded or excessive.

MetaBlink as a data processor

When a salon or practice uses MetaBlink to book its clients, they are the data controller and MetaBlink is the data processor. This means we process their clients' data only on their instructions and within the scope of a data processing agreement. If you are a client of such a salon and want to exercise one of your rights, please contact that salon directly, and we assist them in the process.

We sign a data processing agreement (DPA) with our users, which covers, among other things:

processing only on the controller's documented instructions,
a confidentiality obligation for everyone who accesses the data,
appropriate technical and organizational security measures,
conditions for engaging sub-processors,
assistance to the controller with data subject requests and breach notifications,
deletion or return of data at the end of the cooperation.

Security measures

We protect data with encryption in transit, role-based access control, regular backups and system monitoring. We adapt this list of measures to the nature of the data and the risks involved, and we review it continuously.

Data breach notification

If a breach occurs that could endanger people's rights and freedoms, we notify the supervisory authority within 72 hours, and the affected individuals when required. If you notice anything suspicious relating to your data, let us know at .

Have a question about your data?

Write to us at . We try to answer clearly and quickly.

You will find further detail on processing in our Privacy Policy.