Privacy policy

1. Appointment booking

For an online booking or an appointment arranged by phone we process your name, email address, phone number, note (if you add one), the chosen services, hairdresser and time. This data is needed to book and confirm the appointment and, if necessary, to inform you about changes.

Legal basis: performance of a contract or steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). We keep appointment data for as long as it is needed for these purposes and the salon's records, or as long as the law requires.

To view and cancel a booking (“My booking”) we send a one-time code to your email address.

2. Email notifications

With a booking we send you a confirmation, notices about changes and a reminder the day before the appointment (performance of a contract, Art. 6(1)(b) GDPR).

After the appointment we may send you up to three short requests for a Google review. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Sending stops as soon as you click the review link or confirm that you have already left a review, and every email lets you unsubscribe from further requests.

3. Loyalty card, client profile and treatment history

When you first book, we create a client profile with the SMART Loyalty card: name, email, phone, language, home branch, visits and amounts paid, points and rewards redeemed and, if you came through a referral, who referred you. The profile is used to manage your visits, award points and rewards and provide a better service (performance of a contract and legitimate interest, Art. 6(1)(b) and (f) GDPR).

With each treatment we keep a treatment history: services, products used, colour formula and the stylist’s note, so that we can repeat or adjust the result (legitimate interest). Before and after photos of your hair are stored only with your consent (Art. 6(1)(a) GDPR). You can withdraw consent on your loyalty card or in the salon – all your photos are then deleted. Photos are stored securely and seen only by salon staff; we use them in the gallery only if you have expressly allowed it.

We keep the profile and history while you are our client and as long as they are needed for these purposes. On request we delete them, except data we must keep by law (e.g. accounting).

4. Online payment, deposit and waiting list

Card payments are processed by Stripe Payments Europe Ltd. (Dublin, Ireland) and PayPal payments by PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg). You enter card or PayPal details directly with them – we neither see nor store them; we only receive the payment confirmation, amount and a reference. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Payment records are kept as long as accounting rules require.

For some online bookings we ask for a deposit. To apply the cancellation rules we record missed appointments (by email and phone) – legitimate interest in protecting against no-shows (Art. 6(1)(f) GDPR). After several missed appointments online booking may be restricted; you can still book by phone.

If you join the waiting list, we use your name, email, phone and preferred time only to let you know when a time becomes free. The entry is deleted after that day, and you can leave the list via the link in the email.

5. Purchases: webshop, gift cards and memberships

For webshop orders and purchases of gift cards or memberships we process your name, email, phone, delivery address (for postal delivery), order contents and payment details, and for gift cards also the recipient’s name and email that you enter. The data is used to complete the purchase, delivery and order notifications (Art. 6(1)(b) GDPR); for delivery we pass it to the delivery service. Invoices and order records are kept as long as the law requires.

If you enter your email in the cart but do not place the order, we store the cart contents and email and send you one reminder with a link back to your cart (legitimate interest, Art. 6(1)(f) GDPR). No reminder is sent if you have unsubscribed from offers; saved carts are deleted after 90 days. Your wishlist is stored only in a cookie in your browser. Product questions are used to reply by email; the question and answer may be published with your first name and initial.

6. Job applications

If you apply for a job, we use your name, email, phone, message and CV only for the recruitment process (Art. 6(1)(b) GDPR - steps prior to a contract). Your CV is stored securely and visible only to the salon management. We delete the data at the latest 12 months after the decision. The same applies to franchise inquiries: the data is used only to reply and for negotiations.

7. Recommendations, offers and birthday gift

After a visit we may email you a home-care product recommendation and, when the time comes, a suggestion for your next appointment, and occasionally salon offers tailored to your visits (e.g. by branch, services or time since your last visit). The legal basis is our legitimate interest in direct marketing to existing clients for similar services (Art. 6(1)(f) GDPR). You can unsubscribe with one click in every such email; you will still receive booking notifications.

In these emails we measure whether they were opened and whether a link was clicked (a small image and a link with a unique code), so we know which offers are useful. We do not share this data with third parties.

If you enter the day and month of your birth on your loyalty card (we do not ask for the year), we send you a gift before your birthday – points or a gift card. The legal basis is your consent (Art. 6(1)(a) GDPR); we delete the date on request.

8. Virtual assistant (chat)

The chat on the website answers with the help of Google Gemini artificial intelligence (Google Ireland Ltd., Dublin, Ireland). When you write to it, the text of your messages and the page language are sent to Google to generate a reply; we do not send any data about you from our database. Please do not enter sensitive data (e.g. about health) in the chat. We keep conversations to improve the answers and delete them after 12 months at the latest.

If you ask us to contact you, the assistant forwards your name, email and message to the salon as an enquiry (Art. 6(1)(b) and (f) GDPR). The assistant can make mistakes: answers are not a binding offer, and you always complete the booking on the booking page. Google may also process data in the USA (see the section on transfers outside the EU).

9. Visiting the website and hosting

The website is hosted by STRATO GmbH, Berlin, Germany, which is also our email provider. On every visit the server technically processes your IP address, time of access, the page address and browser data in order to deliver the website and protect it from abuse (legitimate interest, Art. 6(1)(f) GDPR).

Fonts are loaded from our own server, not from external providers. We do not use visitor tracking or advertising tools.

10. Cookies

We use necessary cookies: the session (e.g. during booking), protection of forms against abuse, remembering your cookie choice and the appearance and salon city you selected. They are required for the website to work or for a function you requested, so they do not require consent. Other cookies (statistics, marketing) are set only with your consent (next sections).

The list of all cookies and their duration is in the cookie settings: Cookie settings

11. Visit statistics (Google Analytics)

If you switch on “Statistics” in the cookie notice, we use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to see how many visitors the website has, which pages they open, which device they use and where they come from, and how many bookings and messages are sent. This helps us adapt the website and our offer to visitors.

This involves data about your device and browser, approximate location (country, city), the pages you opened and the time of your visit. Google Analytics 4 does not store IP addresses. We have switched off Google signals and ad personalisation, we never send your name, email or phone number, and pages containing a booking code or review link are not measured at all. The _ga and _ga_* cookies last up to 2 years; Google Analytics keeps the data for at most 14 months.

The legal basis is your consent (Art. 6(1)(a) GDPR). Without consent, Google Analytics is not loaded. You can withdraw consent at any time; the Google Analytics cookies are then deleted from your browser. Google may also process data in the USA (see the section on transfers outside the EU).

You can switch statistics on or off in the cookie settings: Cookie settings

12. Facebook and Instagram ads (Meta Pixel)

If you switch on “Marketing” in the cookie notice, we use the Meta Pixel (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland). This shows us whether our Facebook and Instagram ads brought visitors, bookings and messages, and lets us show our ads to people who visited our website.

Meta receives data about your browser and device, your IP address, the pages you opened and the events “booking sent” and “message sent”. We never send your name, email, phone number or booking details, and pages containing a booking code or review link are not measured. If you have a Facebook or Instagram account, Meta may link this data to your account under its own privacy policy (facebook.com/privacy/policy). The _fbp and _fbc cookies last up to 3 months.

We are jointly responsible with Meta Platforms Ireland Ltd. for collecting the data and transmitting it to Meta (Art. 26 GDPR); Meta carries out any further processing on its own responsibility. The legal basis is your consent (Art. 6(1)(a) GDPR); without it, the Meta Pixel is not loaded. You can withdraw consent at any time; the Meta Pixel cookies are then deleted from your browser. Meta may also process data in the USA (EU–US Data Privacy Framework).

You can switch marketing on or off in the cookie settings: Cookie settings

13. YouTube videos

YouTube videos (Google Ireland Ltd., Dublin) in the gallery only load when you click them, in privacy-enhanced mode (youtube-nocookie.com). Only then does Google receive your IP address and browser data. Legal basis: your action or consent (Art. 6(1)(a) GDPR).

14. Social networks and reviews

The Instagram and Facebook icons are plain links: no data is sent to these networks until you click the link. Reviews shown on the website are public reviews from our Google profile.

15. Recipients and transfers outside the EU

We do not sell your data. Only authorised salon staff and the service providers named above have access, to the extent needed for their service.

Google may also process data in the USA; such transfers are based on the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses.

16. Your rights

You have the right to access your data, have it corrected or erased, restrict processing, data portability and the right to object to processing based on legitimate interest. You can withdraw consent at any time without affecting the lawfulness of processing before the withdrawal. Send us your request by email or call us; we will reply within one month.

You also have the right to lodge a complaint with a supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, www.azop.hr, or the authority in the country where you live.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. We may tailor offers to your branch, services or time since your last visit (see the section on recommendations and offers).

17. Security and changes

The website is only transmitted encrypted (HTTPS), and access to the administration is protected by a password and an additional code sent by email. We may update this policy when our services or regulations change; the version published on this page always applies.