This Privacy Policy explains how [Legal entity name] (“De-Johnsons Hair Studio”, “we”, “us”), operating from 110 Koshova st, Sofiivska Borshchahivka, Kyiv region, Ukraine, collects, uses and protects your personal data when you use our website and services. We are the data controller responsible for your personal data.
We process personal data in accordance with the Law of Ukraine “On Protection of Personal Data” and, where it applies to visitors in the European Union, the General Data Protection Regulation (GDPR).
1. Data we collect
Depending on how you use our services, we may collect:
- Account data — your name, email address and a securely hashed password when you create an account.
- Booking data — the service, barber, date/time and location (in-studio or home-service address) of your appointments.
- Order data — products ordered, delivery address and order history. Payment is taken on delivery, so we do not store card details on our systems.
- Communications — messages you send us through the contact form or by email.
- Technical data — cookies and similar technologies strictly necessary to keep you signed in, remember your cart and language, and keep the site secure (see Cookies below).
2. How we use your data and our legal basis
- To provide our services — managing your account, bookings and orders. Legal basis: performance of a contract.
- To communicate with you — booking and order confirmations, and responses to your enquiries. Legal basis: performance of a contract / legitimate interests.
- To secure our services — preventing fraud and abuse, including rate-limiting sign-in attempts. Legal basis: legitimate interests.
- To comply with the law — meeting our legal and accounting obligations. Legal basis: legal obligation.
We do not sell your personal data, and we do not use it for automated decision-making that produces legal effects.
3. Cookies
We use only strictly necessary cookies required for the website to function — for example to keep you signed in, remember the contents of your cart, and store your language preference. These do not require consent under GDPR. If we introduce analytics or marketing cookies in the future, we will ask for your consent first through our cookie banner.
4. Sharing your data
We share personal data only with service providers who help us operate the website and deliver our services, and only as needed. These include:
- Hosting and database providers (website and data storage);
- Our email delivery provider (for confirmations and notices);
- Our image hosting provider (for product and gallery images);
- Where applicable, a translation provider used to display content in Ukrainian.
These providers process data on our behalf under appropriate agreements. We may also disclose data where required by law.
5. International transfers
Some of our service providers may process data outside Ukraine or the EU. Where this happens, we take steps to ensure your data receives an adequate level of protection, such as relying on providers that offer appropriate safeguards.
6. How long we keep your data
We keep your personal data for as long as your account is active or as needed to provide our services, and thereafter only as required to meet legal, accounting or reporting obligations. When data is no longer needed, we delete or anonymise it. Password-reset links expire after one hour and are single-use.
7. Your rights
Subject to applicable law, you have the right to access, correct, delete or restrict the processing of your personal data, to object to processing, to data portability, and to withdraw consent where processing is based on consent. To exercise any of these rights, contact us at [contact email].
If you are in the EU, you also have the right to lodge a complaint with your local data protection authority. In Ukraine, you may contact the Ukrainian Parliament Commissioner for Human Rights (Ombudsman).
8. Security
We use appropriate technical and organisational measures to protect your data, including password hashing, encrypted connections (HTTPS) and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident.
9. Children
Our website is not directed at children, and you must be at least 16 years old (or the age of digital consent in your country) to create an account. If you believe a child has provided us personal data, please contact us and we will delete it.
10. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you.
11. Contact us
For any questions about this policy or your personal data, contact us at [contact email] or by post at 110 Koshova st, Sofiivska Borshchahivka, Kyiv region, Ukraine, 08131. See also our Terms of Service.