Privacy policy

Data protection

The data controller is SC Îndrea Sofia SRL, company number 38412190, 74 Mărășești Street, Bucharest. We process data in accordance with Regulation (EU) 2016/679 (GDPR). Discretion is not a marketing promise here; it is how the system is built. This is a translation provided for convenience; the Romanian text is the binding one.

What we collect

To make a booking we ask for the bare minimum:

a name or an alias — we do not check whether it is your real name
a phone number, so that we can confirm the booking
optionally, a note with preferences or relevant medical information
the service, the date and the time you chose

What we do NOT collect

We do not ask for your home address, your national identification number, card details or identity documents in order to book online.

We do not process online payments at present; we neither hold nor store banking data. Payment is made on site, or by transfer directly between you and your bank.

Why we process it

The legal basis is the performance of a service contract at your request: without a phone number we cannot confirm an appointment.

The optional note may contain health data. You fill it in only if you wish, the basis is your explicit consent, and we use it solely to adapt the session.

Protection against false bookings

The booking form is public and does not require you to create an account. So that it cannot be used to block out the salon calendar with invented bookings, we record against each booking a cryptographic fingerprint of the internet address it was sent from.

We do not keep the address itself, only a hash computed with a secret key. The address cannot be reconstructed from it, and we do not use it to identify you, to follow you between visits, or for marketing — it serves only to count requests coming from the same direction. The basis is our legitimate interest in keeping the service working.

Who has access

Contact details are accessible only to the salon administrator, through a panel behind a login. They are not visible publicly on the site and cannot be read by visitors.

We do not sell or rent data. We do not pass it to third parties for marketing.

We use infrastructure providers that host the data within the European Union: Supabase for the database (Frankfurt, Germany) and Vercel for hosting the site.

How long we keep it

Booking data is kept for as long as it is needed to provide the service and to meet the accounting obligations that apply. After that it is deleted or anonymised.

You may ask for deletion sooner, where no legal obligation prevents it.

Your rights

Under the GDPR you have the right:

of access — to find out what data we hold about you
to rectification — to correct inaccurate data
to erasure — the right to be forgotten
to restriction of processing
to data portability
to object
to withdraw your consent at any time, wherever consent is the basis

How to exercise your rights

You can reach us by phone or on WhatsApp, at the number shown on the site. We reply within 30 days at the latest.

If you are not satisfied with our answer, you may contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest.