Privacy Policy

1. Data Controller

The Data Controller is Hairforce di Scollo Giuseppe, Gianneschi Andrea e Nanni Francesco SNC, with registered office at Via Ghibellina 74/R, 50122 Florence, Italy. VAT IT05147040488. Email: [email protected] · Phone: +39 055 241736.

2.1 Browsing data

This website does not use profiling cookies, analytics cookies or third-party cookies. Hairforce does not directly collect or store IP addresses, access logs or browser fingerprints in its own systems. For technical operation and network security only, the IP address and technical connection data are processed by Cloudflare (Cloudflare, Inc.), the website's hosting and security provider, which also serves all website photos from its own servers (no external CDN). For technical performance measurement only, the website uses Cloudflare Pages Analytics (Cloudflare, Inc.), which collects aggregated performance metrics and traffic data without cookies and without storing visitors' IP addresses.

2.2 Data provided voluntarily by the user

The website contains no contact forms or registration: no personal data is collected directly through the site. Users can contact Hairforce by phone, email, WhatsApp, Instagram, Facebook or in person: data shared through these channels (e.g. name and contact details) is processed exclusively to answer the request and manage the appointment.

Providing data is necessary to answer requests and manage bookings and appointments; providing health-related data or photographs is optional (see sections 2.5 and 2.6). For the purchase of gift vouchers, the buyer's and recipient's data are processed and kept for the voucher's validity period and for 10 years where relevant for tax purposes. Hairforce does not send promotional communications; should it intend to do so in the future, it will collect specific and separate consent.

2.3 Booking via Treatwell

The "Book" button on the website redirects to the Treatwell platform (Treatwell IT S.r.l., Treatwell Group). By clicking the link, the user leaves hairforce.it and enters their data on Treatwell's website, which processes it as an independent data controller under its own privacy policy. Hairforce receives from Treatwell the data required to manage the appointment (name, contact, service, date and time) and processes it exclusively to provide the booked service.

2.4 Contact via WhatsApp

If the user contacts Hairforce via the WhatsApp button on the website, the conversation is handled through WhatsApp Ireland Ltd. (Meta Group), which processes the data as an independent controller under its own privacy policy. Hairforce will process data shared through this channel (phone number, name, message content and any images) exclusively to answer the request and manage the appointment. Such data may be transferred by WhatsApp to third countries under the safeguards set out in its privacy policy.

2.5 Health-related data provided at the salon

During the consultation, users may provide staff with information about allergies, sensitivities or scalp conditions. This information may constitute health data within the meaning of Art. 9 GDPR and is processed solely to provide the service safely. Providing it is optional, but failure to do so may prevent the service from being provided. Legal basis: explicit consent of the data subject (Art. 9.2.a GDPR), collected in writing or electronically and recorded in the client file. The data is kept for the duration of the relationship and for no longer than 5 years from the last treatment, unless consent is withdrawn.

2.6 Client photographs

Photographs taken at the salon may be published on the website, on the salon's social channels or used for promotional activities only with the data subject's specific, separate and revocable consent (Art. 6.1.a GDPR). Consent is collected before publication and is not conditional on the provision of the service. Images are not used for purposes other than those indicated at the time of collection. Consent may be withdrawn at any time by writing to [email protected]; withdrawal does not affect the lawfulness of processing carried out before withdrawal. For minors, consent is given by the person exercising parental responsibility.

3. Purposes of processing and legal basis

4. Processing methods

Data is processed using IT and electronic tools, as well as on paper in the salon, by authorised and trained staff. Processing is limited to the time necessary for the stated purposes. The website is static and has no database or private areas.

5. Recipients of data

Personal data is not disseminated. It is communicated, to the extent necessary for the purposes indicated, to the following recipients: Cloudflare, Inc. (website hosting, security and image delivery), appointed processor under Art. 28 GDPR; Treatwell IT S.r.l. (Treatwell Group), which processes booking data as an independent controller under its own privacy policy; WhatsApp Ireland Ltd. (Meta Group), for conversations started via WhatsApp, as an independent controller; the salon's tax and accounting adviser, for legal obligations; banks or payment providers, for payments made at the salon; technical service providers (hosting and website maintenance), appointed processors under Art. 28 GDPR; judicial or administrative authorities, where required by law. Data is accessible only to authorised salon staff.

6. International data transfers

Browsing data may be processed by Cloudflare in countries outside the European Economic Area, including the United States. Such processing takes place with the safeguards required by the GDPR, on the basis of the EU-US Data Privacy Framework, where applicable, and the Standard Contractual Clauses adopted by the European Commission.

7. Retention period

• Contact requests and WhatsApp conversations: until the request is fulfilled and in any case no longer than 12 months after the last communication.
• Appointment operational data (name, contact details, service, date and time): 24 months from service delivery, save where needed for defence in disputes.
• Tax and accounting documents (invoices, receipts, registers): 10 years, under Art. 2220 of the Italian Civil Code and tax law.
• Technical logs and connection data processed by Cloudflare: for the time strictly necessary for security and operational purposes and in accordance with their respective retention policies; Hairforce does not keep a copy in its own systems.
• Published images: until consent is withdrawn.
• Allergy and sensitivity data: no longer than 5 years from the last treatment, unless consent is withdrawn.

8. Data subject rights

• obtain confirmation of the existence of personal data concerning them and its communication (right of access);
• obtain rectification of inaccurate data or completion of incomplete data;
• obtain erasure of data, where provided by law (right to be forgotten);
• obtain restriction of processing;
• receive data in a structured format and transmit it to another controller (right to portability);
• object at any time to processing based on legitimate interest, on grounds relating to their particular situation (Art. 21 GDPR);
• withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3) GDPR).

To exercise these rights, data subjects can write to [email protected]. The Controller replies within one month of the request, subject to a reasoned extension of two months. They also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).

9. Automated decision-making and profiling

The Controller does not use automated decision-making, including profiling within the meaning of Art. 22 GDPR, that produces legal effects concerning the data subject or similarly significantly affects them. Website performance metrics are used only in aggregate form and are not used to profile users.

10. Changes to this notice

This notice may be updated at any time. The latest version is always published on this page.