Privacy policy

1. Who is responsible for the data

The controller is BEAUTY HUB SRL, company ID (CUI) 37547814, J40/6761/2017, registered office at Str. Ing. Zablovschi nr. 10, Biroul 1, Sector 1, București. For any question or request about your data write to [email protected]. We have not appointed a data protection officer, as the law does not require one for us; we handle requests directly.

2. What data we use, why and on what basis

• Account: name, e-mail, password (stored only as an irreversible hash), preferred language; when you sign in with Google, the name, e-mail address and Google account identifier. Basis: the contract (art. 6(1)(b) GDPR).
• Orders and invoicing: name, e-mail, phone (optional), address and, for companies, the company name, company ID and registration number; products, amounts, discount codes and payment history. Basis: the contract and the legal obligations of invoicing, RO e-Factura reporting and archiving (art. 6(1)(b) and (c)).
• Payments: processed by Stripe; we receive only the payment confirmation, transaction identifiers and possibly the card type and last digits. Full card data never reaches us.
• Memberships and learning: plan, period, payment status, lessons opened and completed, to give you access and show your progress. Basis: the contract.
• Proof of the consents given at checkout: when you accepted the terms and the consent to start digital content at once, the IP address and browser. Basis: legal obligation and our legitimate interest in being able to prove the consents (art. 6(1)(c) and (f)).
• Messages from the contact form and waiting lists: name, e-mail, phone (optional) and message. Basis: steps you asked for before a contract and our legitimate interest in replying.
• Newsletter: e-mail, first name (optional), when you signed up and confirmed. Basis: your consent (art. 6(1)(a)), confirmed by e-mail (double opt-in). Unsubscribe at any time from any e-mail.
• E-mails about your account and orders (confirmations, invoices, failed payments, sign-in) are sent to perform the contract; they are not marketing.
• News for customers: if you bought a course, a membership or a workshop seat, or have an account with courses, we e-mail you (through Brevo) news about Tania's courses, workshops and offers, similar to what you bought. Basis: art. 12(2) of Romanian Law no. 506/2004 and our legitimate interest (art. 6(1)(f) GDPR). Unsubscribe at any time, free of charge, from the link in every e-mail or by writing to us; invoices and account e-mails keep reaching you.
• Security: IP address, browser and server logs, the Cloudflare Turnstile anti-bot check on forms and the limiting of repeated attempts. Basis: our legitimate interest in protecting the site and the accounts.
• Statistics and marketing: visit data (pages, device, source of the visit) through Google Analytics 4 and the Meta Pixel (when you are signed in, the pixel also sends your e-mail, name, phone and town, irreversibly hashed, so Meta can match the visit to your account), and with marketing consent the Meta Conversions API (the purchase or message, with identifiers irreversibly hashed), only with your consent in the cookie banner. Details in the Cookie policy.
• The customer list for ads: if you bought a course, a membership or a workshop seat, your e-mail, phone, name, town and country, irreversibly hashed, are sent to Meta, so we stop showing you ads for what you already bought and Meta can find people with similar interests (Custom Audiences and Lookalike). Meta uses them only for matching. Basis: our legitimate interest (art. 6(1)(f)); you can object at any time by writing to us, and your data leaves the list at the next daily update.
• The payment reminder: if you started a payment on the site and it did not go through, we send you a single e-mail reminder with the link back to the payment. Basis: legitimate interest; you stop it from the unsubscribe link in the e-mail.
• Clicks on product recommendations: which product you opened, the page you came from and the browser, with no identifying data, to know which recommendations are useful. Basis: legitimate interest.

We take no decisions based solely on automated processing that produce legal effects for you, and we never sell data.

3. Who receives the data

We use providers that process data on our behalf, under contract and only for the purposes above:

• Stripe (payments and Link; Ireland and USA)
• MailerSend (account and order e-mails; EU)
• Brevo (newsletter and news for customers; France)
• Google (Google sign-in, Google Analytics, the [email protected] mailbox; EU and USA)
• Cloudflare (secure delivery of the site, protection, Turnstile, storage of images and video lessons; EU and USA)
• Oblio (issuing invoices and submitting them to RO e-Factura; Romania)
• Meta (Meta Pixel and Conversions API, only with your marketing consent, and the customer list for ads; Ireland and USA)

We disclose data to authorities only where the law requires it (for example ANAF, through invoices). Our accountant has access to invoicing data under a duty of confidentiality.

4. Transfers outside the European Economic Area

Some providers (Stripe, Google, Cloudflare, Meta) may process data in the USA. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (for certified providers) or on the standard contractual clauses approved by the Commission, with the providers' supplementary measures.

5. Where and how long we keep data

The site's database is on a server in Romania, with encrypted backups kept for 30 days.

• Account and learning data: while you have the account; accounts with no activity and no orders for 3 years are deleted after notice by e-mail.
• Invoices and accounting records: as long as tax and accounting law requires (currently up to 10 years).
• Proof of checkout consents: as long as a dispute about the order may arise (the 3-year limitation period from the contract) and as long as the invoice is kept.
• Contact form messages: up to 3 years from the last exchange.
• Newsletter: until you unsubscribe.
• News for customers: until you unsubscribe or the account is deleted.
• Server security logs: 90 days at most.
• Google Analytics statistics: 14 months at most.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection (including, at any time, to direct marketing), and the right to withdraw consent without affecting earlier processing. Write to [email protected]; we reply within one month.

You may also lodge a complaint with the Romanian supervisory authority, ANSPDCP, B-dul G-ral Gheorghe Magheru nr. 28-30, sector 1, Bucharest, dataprotection.ro.

7. Minors

The site is not aimed at children. Accounts and orders are for people aged 18 or over, and the newsletter for people aged 16 or over. If you learn that a child has sent us data, write to us and we will delete it.

8. Security

The site uses encrypted connections only (HTTPS). Passwords are stored only as irreversible hashes, video lessons are delivered only to signed-in members and access to data is limited to the people who need it. If a personal data breach may affect you, we tell you as the law requires.

9. Changes

We update this policy when the way we use data changes. The date of the last change is shown at the top; important changes are also announced by e-mail.