POLITICA DE CONFIDENȚIALITATE (GDPR)

Last update date: October 14, 2026

1. Introduction

This Privacy Policy explains how Russian Hair Design SRL, conducting business under the name BeautyPlay, collects, uses, stores, and protects the personal data of individuals who access the website www.beautyplay.ro, purchase products from the online store, request information, subscribe to the newsletter, or make appointments for salon services.

The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 on the protection of personal data (GDPR), applicable Romanian legislation, and other relevant standards regarding privacy protection and electronic communications.

"Personal data" means any information relating to an identified or identifiable natural person.

This policy applies both to the use of the online store and to interactions with BeautyPlay in relation to salon services. It should be read in conjunction with the Terms and Conditions, the Cookie Policy, and the information presented in order, appointment, and newsletter subscription forms.

2. Who is the personal data controller?

The personal data controller is:

Russian Hair Design SRL, trade name BeautyPlay.

Unique fiscal identification code (CUI): 34237096.

Trade Register registration number: J2015003172409.

Registered office: Strada Câmpia Libertății no. 39A, Bucharest, postal code 030366, Romania.

Salon address: Strada Câmpia Libertății no. 39A, Bucharest, postal code 030366, Romania.

Website: www.beautyplay.ro.

E-mail for personal data requests: contact@beautyplay.ro.

Phone: 0768 694 063.

Throughout this policy, Russian Hair Design SRL will be referred to as "BeautyPlay", "we" or "the controller".

For questions regarding personal data or to exercise the rights provided by the GDPR, you can contact us at contact@beautyplay.ro.

BeautyPlay has not appointed a Data Protection Officer (DPO). In the event that appointing a DPO becomes mandatory or is decided voluntarily in the future, their contact details will be duly published.

3. What categories of data do we collect?

Depending on how you interact with us, we may process the following categories of data.

Identification and contact data. This may include your full name, phone number, email address, billing address, delivery address, and other information you provide to us in order to process an order, appointment, or request.

Order and purchase data. This may include ordered products, quantities, order value, applied discounts, delivery method, delivery address, order history, invoices, and information necessary for managing returns, refunds, warranties, and complaints.

Payment data. The online store accepts card payment via the payment solution available at checkout. Information regarding the amount, currency, payment status, transaction identifier, and the result of authorization or refund may be processed.

Full card details are handled by the payment service provider, in accordance with their own security procedures and obligations. BeautyPlay does not intend to collect or store the full card number or its security code. Information effectively visible to BeautyPlay depends on the functionalities and reports provided by the payment processor.

Salon appointment data. The appointment form requests your name, phone number, email address, desired service, and requested time slot. The separate appointment application may process other information necessary for organizing appointments, depending on its functionalities.

Salon service and health information. For certain services, we may request relevant information to identify allergies, contraindications, or other factors that may influence the safe performance of the service. This information may constitute health data, a special category of personal data protected by the GDPR.

We only request information relevant to the respective service and you should not transmit to us medical information that is not necessary for its safe performance.

Communication data. If you contact us via email, phone, or other channels made available by BeautyPlay, we may process the content of messages, contact details, requests, and the responses necessary for managing the communication.

Newsletter and commercial communication data. If you subscribe to the newsletter, we may process your email address and, if provided, your name, as well as the information necessary for managing the subscription, demonstrating consent, and recording unsubscribes.

Technical and website usage data. Depending on website, browser, and analytics tool settings, your IP address, online identifiers, device and browser type, pages visited, interactions with the site, access source, and information about the use of the online store may be collected.

This data may be collected through cookies and similar technologies, under the conditions described in the Cookie Policy and the consent settings displayed on the site.

Advertising and campaign measurement data. Because marketing and tracking tools are used, certain technical and interaction information may be processed for measuring advertising campaigns, evaluating ad effectiveness, and, if configured, displaying personalized ads.

Not all categories of data are collected in all situations. The data actually processed depends on the service used, the information you provide to us, and the consents expressed.

4. For what purposes and based on what legal grounds do we process the data?

We process personal data only for specified purposes and to the extent that an applicable legal basis exists.

Order processing and contract execution. We use the necessary data for receiving and confirming orders, preparing products, organizing delivery or pickup from the salon, communicating regarding the order, managing returns and refunds, and resolving issues that arise.

The legal basis is, as a rule, the execution of the contract concluded with you or the taking of steps requested by you before entering into a contract.

Payment processing. Data necessary for confirming and administering payment is processed for the execution of the contract, the prevention and investigation of unauthorized transactions, and compliance with applicable legal obligations.

Invoicing and legal obligations. We use the data necessary for issuing fiscal documents, accounting records, compliance with tax obligations, and responding to requests from competent authorities.

The legal basis is the fulfillment of the legal obligations incumbent upon the company.

Appointments and provision of salon services. Contact data and appointment details are used for managing the request, confirming or modifying the appointment, communicating regarding the service, and organizing salon activities.

The legal basis is the execution of the contract or the taking of steps requested before entering into one. Depending on the situation, certain administrative processing may also be based on the legitimate interest of the company, while respecting the rights of the data subject.

Managing health information. If collecting health information is necessary for a particular service, it will be processed only to the extent that there is both a legal basis according to Article 6 of the GDPR and an applicable exception to the prohibition on processing special data provided by Article 9 of the GDPR.

Insofar as the applicable basis is explicit consent, it will be requested separately, clearly, and before processing the respective information. Refusal to provide information strictly necessary for assessing the safety of a service may mean that the service cannot be performed safely and, therefore, cannot be rendered.

Responding to requests and complaints. We use the data to answer questions, analyze complaints, and defend our rights when necessary. The basis may be the execution of the contract, the fulfillment of legal obligations, or the legitimate interest in managing requests and resolving disputes.

Newsletter and email marketing. We use the data for sending news, offers, promotions, and information about products and services, under the conditions of the legislation applicable to commercial communications. When necessary, the basis is your consent, expressed through a clear action separate from simply placing an order or making an appointment.

Website usage analysis. We use Shopify Analytics and Google Analytics to understand how the online store is used, to evaluate its performance, and to identify improvements. Tools that are not strictly necessary for the site's operation will be activated under the conditions of the law and applicable consent options.

Advertising and campaign tracking. We use marketing and tracking tools to measure the effectiveness of advertising campaigns and, if configured, for personalizing ads or measuring conversions. Insofar as these technologies involve accessing or storing information on your device or other processing for which consent is mandatory, they will be used only after obtaining valid consent.

Security and abuse prevention. Technical data and order information may be used, to the extent necessary, to protect the site, identify fraudulent activities, prevent abusive use, and defend the company's rights. The basis may be legitimate interest, legal obligation, or another basis applicable to the concrete situation.

5. Cookies, Google Analytics and tracking technologies

The BeautyPlay website uses a banner for managing cookie consent. Through it, visitors can manage available options for categories of cookies and similar technologies.

Strictly necessary cookies are used for the site's operation, security, session management, and functionalities required by the online store, including those related to the shopping cart and the checkout process.

Analytics cookies may be used to understand how visitors use the site and to evaluate its performance. BeautyPlay uses Shopify Analytics and Google Analytics.

Marketing cookies and technologies may be used for measuring campaigns, attributing conversions, and, if this function is enabled, personalizing advertising.

Non-essential cookies and tracking technologies for which the law requires consent must not be activated before expressing consent. Refusing non-essential cookies must not prevent access to the basic functions of the site that do not depend on them.

You can modify or withdraw your cookie consent through the management mechanism available on the site, if it allows reopening preferences. You can also manage cookies from your browser settings, but blocking strictly necessary cookies may affect the operation of certain functions.

Cookies may involve transmitting data to the providers of the respective technologies. Exact information about cookies, their duration, providers, and specific purposes should be consulted in the Cookie Policy and the site's consent interface.

6. Newsletter and commercial communications

If you choose to subscribe to the BeautyPlay newsletter, your email address and any additional data provided in the form will be used for sending commercial communications via Shopify Email.

Newsletter subscription is optional and is not a condition for purchasing products or making an appointment.

We will not consider simply placing an order, completing the appointment form, or accepting this policy as automatic consent for the newsletter.

If applicable legislation requires prior consent, registration will only be carried out after it is expressed. We will keep the information necessary to demonstrate the existence and date of consent, insofar as it is available through the used system.

You can unsubscribe at any time via the unsubscribe link included in commercial messages or through a request sent to contact@beautyplay.ro.

After unsubscribing, you will no longer receive newsletters, except for communications strictly necessary for executing an order, managing an appointment, complying with a legal obligation, or resolving a request.

Unsubscribing does not affect the legality of processing carried out before the withdrawal of consent.

7. Salon appointments and health data

To organize appointments, BeautyPlay uses a separate appointment application. The data entered into this application may be processed by the application provider on behalf of BeautyPlay or according to its actual legal role, which must be determined based on the contracted service.

The data requested for an appointment includes your name, phone number, email address, desired service, and requested time slot. These are used for managing the appointment and communicating with the person who made the request.

For certain services, limited information regarding allergies, contraindications, or other aspects relevant to the procedure's safety may be necessary. Information of this type will not be requested for services where it is not necessary.

Health data benefits from special protection. When processing is based on explicit consent, it must be obtained separately from the acceptance of commercial terms and consent for marketing. The person must be informed about the concrete purpose of the processing and the possibility of withdrawing consent.

Withdrawing consent does not affect the legality of processing carried out before the withdrawal. If certain information is indispensable for the safe performance of the service, BeautyPlay may refuse to provide the respective service when it cannot reasonably determine that it can be performed safely.

BeautyPlay will limit access to such information to those who need it for the relevant purpose and will avoid including it in messages or documents that do not require such details.

8. Minors' data

BeautyPlay may provide certain services to minors as well. Minors' data requires special attention and will be collected only to the extent necessary for managing the appointment, providing the service, and complying with legal obligations.

Depending on the minor's age, the nature of the service, and the concrete circumstances, BeautyPlay may request the involvement of a parent or legal representative, including for expressing relevant consent or confirming the appointment.

In the case of online processing based on consent, legal requirements applicable to children and information society services will be respected, including rules regarding the consent of the parent or legal representative when they are applicable.

A minor's health data will not be requested unless it is relevant and necessary for the respective service and there is a corresponding legal basis. In case explicit consent or authorization from a legal representative is required, it will be obtained before processing.

BeautyPlay does not intend to collect personal data from children for advertising purposes without a legal basis and without respecting applicable requirements.

9. To whom may we disclose data?

Personal data may be communicated only to the extent necessary for the purposes described in this policy and in accordance with the law.

Shopify. The Shopify platform ensures the operation of the online store and may process the data necessary for managing orders, accounts, the shopping cart, and other activated functionalities.

Payment service provider. Data necessary for processing card payments is transmitted to the payment provider used at checkout.

Courier companies and delivery services. Data necessary for delivery may be communicated to the chosen transport operator, including the recipient's name, delivery address, phone number, and information necessary for identifying the package.

Appointment application provider. Data necessary for managing appointments may be processed through the separate application used by the salon.

Shopify Email. Data necessary for managing subscriptions and sending the newsletter is processed through Shopify Email.

Google Analytics. Technical and usage data collected through the analysis tool may be processed by Google according to the functionalities and settings effectively activated.

Marketing and tracking providers. Data may be processed by the providers of advertising and tracking tools activated on the site. Their identity and the categories of data transmitted must correspond to the tools effectively installed and the Cookie Policy.

Accountants, consultants, and technical providers. To the extent necessary, data may be accessed by persons or companies that provide accounting, legal consulting, security, maintenance, or other services necessary for the operation of the business.

Competent authorities and institutions. We may communicate data when we have a legal obligation to do so or when communication is necessary for the establishment, exercise, or defense of a right under the law.

Providers that process data on behalf of BeautyPlay must be subject to contractual obligations and protective measures applicable to their role. The exact identity of the providers, the activated functions, and the responsibilities of each must correspond to the actual configuration of the site and the salon.

10. Data transfers outside the European Economic Area

Some digital service providers may process data or allow access to it from outside the European Economic Area.

If data is transferred to a third country or an international organization, the transfer must comply with GDPR requirements. Depending on the situation, this may be carried out based on an adequacy decision of the European Commission, appropriate safeguards, such as standard contractual clauses, or another mechanism permitted by law.

When necessary, the risks of the transfer and additional protection measures will be assessed.

We do not assume that all data is stored exclusively in Romania or the European Union. Storage locations, providers involved, and applicable transfer mechanisms must be verified in the documentation of the services actually used.

11. How long do we keep the data?

BeautyPlay keeps personal data only for as long as it is necessary for the purposes for which it was collected, in compliance with legal retention obligations and the periods required for the establishment, exercise, or defense of legal claims.

For the consistent application of this principle, retention periods must be established and applied by data categories, as follows:

Data regarding orders and the commercial relationship. These are kept for the duration necessary for the execution of the order and the management of subsequent requests. Financial-accounting documents are kept for the periods provided by the applicable legislation, and additional data is deleted or anonymized when it is no longer necessary, except in situations where there is a legal basis for their retention.

Data regarding invoicing and accounting. These are kept for the mandatory period established by the financial-accounting and tax legislation applicable to the respective document.

Data regarding appointments. Administrative data regarding appointments is kept as long as necessary for the organization of the service, the management of changes and complaints, and the defense of legal rights. As a proposed internal rule, standard administrative data for appointments may be kept for up to 3 years from the last relevant interaction, unless there is a legal obligation or a dispute justifying a longer period.

Health data. This must be kept separately, with limited access, and only for the period strictly necessary for the purpose for which it was collected. As a proposed internal rule, temporary information used for the evaluation of a service is deleted after the purpose has been fulfilled, except in situations where retention is justified by an incident, a legal obligation, or the need to defend a right. A fixed period must be established in the salon's internal procedure according to the services actually provided and the relevant risks.

Newsletter data. This is kept until unsubscription or the withdrawal of consent, if the processing is based on it. Some minimal information regarding consent and unsubscription may be kept for as long as necessary to demonstrate compliance with legal obligations and to avoid sending further messages to unsubscribed persons.

Analysis data and cookies. These are kept according to the durations configured in Shopify Analytics, Google Analytics, and the cookie or marketing tools actually used.

Requests and complaints. Relevant data is kept for the period necessary to resolve the request and, if applicable, for the duration of the legal periods applicable for the defense of rights.

The 3-year periods and the proposed internal rules for appointment and health data are indicative and must be effectively adopted in BeautyPlay's procedures before this policy is published as a definitive description of current practice. In all cases, data that is no longer necessary will be securely deleted or anonymized, in compliance with legal retention obligations.

12. How do we protect the data?

BeautyPlay takes appropriate technical and organizational measures to protect data against unauthorized access, loss, modification, disclosure, or accidental destruction.

These measures must be proportional to the nature of the data and the risks of processing and may include access control to accounts and applications, the use of secure passwords, system updates, limiting staff access to data necessary for their activity, maintaining confidentiality, and evaluating providers who have access to data.

Health data must be protected through appropriate additional measures, including limiting access to persons who need information for the respective service and avoiding storing it in insecure channels or in communications that are not necessary.

No IT system or data transmission channel can guarantee absolute security. In the event of a data security breach, BeautyPlay will assess the situation and fulfill the obligations to notify the supervisory authority and, as the case may be, to inform the data subjects, under the conditions of the GDPR.

13. Your rights

Under the conditions and limits provided by the GDPR, you have the following rights:

Right of access. You can request confirmation that we process your data and you can obtain access to it and to relevant information about the processing.

Right to rectification. You can request the correction of inaccurate data or the completion of incomplete data.

Right to erasure. You can request the deletion of data when legal conditions are met. This right is not absolute and may be limited, for example, when retention is necessary for compliance with a legal obligation or for the defense of a right.

Right to restriction of processing. You can request the limitation of data use in situations provided by the GDPR.

Right to portability. When processing is based on consent or contract and is carried out by automated means, you can request the data you have provided to us in a structured, commonly used, and machine-readable format, under the conditions of the law.

Right to object. You can object, under the conditions of the GDPR, to processing based on legitimate interest. You can object at any time to the processing of data for direct marketing, including profiling related to this marketing. After a valid objection to direct marketing, the data will no longer be processed for this purpose.

Right to withdraw consent. When processing is based on consent, you can withdraw it at any time. The withdrawal does not affect the legality of the processing carried out before the withdrawal.

Right not to be subject to an exclusively automated decision. You have the rights provided by the GDPR in the case of decisions based exclusively on automated processing, including profiling, which produce legal effects or similarly significantly affect you. We do not claim that BeautyPlay uses such decisions; if such processing is implemented, the necessary information will be provided under the conditions of the law.

To exercise your rights, you can write to us at contact@beautyplay.ro. To protect data, we may request additional information strictly necessary to verify your identity when there are reasonable doubts regarding the identity of the requester.

We will respond to requests within the period provided by the GDPR, generally within one month of receiving the request. In situations permitted by law, the period may be extended by two more months, taking into account the complexity and number of requests. In this case, we will inform you about the extension and its reasons within the initial period.

The exercise of rights is free of charge, except in cases where the GDPR allows the charging of a reasonable fee or the refusal of a manifestly unfounded or excessive request.

14. Right to file a complaint

If you have questions or complaints regarding how your data is processed, we encourage you to contact us at contact@beautyplay.ro, so that we can analyze the situation.

You also have the right to file a complaint with the competent supervisory authority.

In Romania, the competent authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Official website: https://www.dataprotection.ro/

Address: Bulevardul General Gheorghe Magheru no. 28–30, Sector 1, Bucharest, postal code 010336, Romania.

E-mail: anspdcp@dataprotection.ro.

You can report to the authority under the conditions of the applicable legal procedures and requirements.

15. Provision of data and consequences of refusal

The provision of certain data is necessary for processing orders, delivering products, issuing fiscal documents, managing appointments, or providing requested services.

If you do not provide the strictly necessary data, it is possible that we may not be able to accept or process an order, deliver a product, confirm an appointment, or safely provide a certain service.

The provision of data for the newsletter and data used for non-essential cookies or marketing is optional, and the refusal of this should not prevent the purchase of products or access to the basic functions of the site.

16. Links to other sites

The BeautyPlay site may contain links to sites, platforms, or services operated by third parties. Accessing these may result in the collection and processing of data according to their own privacy policies.

BeautyPlay does not control the policies and practices of the independent operators of these sites. We recommend that you consult the privacy policies of the respective services before providing them with personal data.

17. Changes to the privacy policy

BeautyPlay may update this policy when legislation, services offered, site functionalities, providers used, or data processing practices change.

The current version will be published on www.beautyplay.ro. The date of the last update will be changed when the content of the policy is reviewed.

If a change requires further informing the data subjects or obtaining new consent, we will take the measures imposed by the applicable legislation.

18. Contact

For any question regarding this policy, the processing of personal data, or the exercise of rights provided by the GDPR, you can contact us:

Russian Hair Design SRL – BeautyPlay

Address: Strada Câmpia Libertății no. 39A, Bucharest, postal code 030366, Romania.

E-mail: contact@beautyplay.ro.

Phone: 0768 694 063.

Site: www.beautyplay.ro.

This policy is written on October 14, 2026, and applies insofar as it correctly describes the actual data processing operations carried out by BeautyPlay.