GDPR — Regulation (EU) 2016/679
This policy describes how Hair Luxury collects, uses and protects your personal data. Last updated: 18 April 2026.
The controller of the personal data collected through the hairluxury.fr website and the client portal is:
INDI HAIR — a French SARL with share capital of €30,000, trading under the brand name Hair Luxury, 29 Boulevard de Courcelles, 75008 Paris, France
SIRET: 788 571 248 00046 — Paris trade register 788 571 248
EU VAT: FR59 788 571 248
Contact for data-related questions: contact@hairluxury.fr
Data protection contact: Henintsoa Rakotoarisoa — managing director, responsible for GDPR compliance. Hair Luxury is not required to appoint a Data Protection Officer within the meaning of article 37 GDPR (fewer than 250 employees, no large-scale systematic processing of sensitive data).
Hair Luxury collects the following categories of data as part of its business:
Professional identification data — company registration number, salon trading name, first and last name of the manager or contact, salon address, EU VAT number.
Contact data — professional email address, phone number, delivery and billing postal address.
Commercial and transactional data — order history, invoiced amounts, payment statuses, credit notes, delivery notes, communications with client services.
Payment data — Hair Luxury does not store banking data. Card payments are processed directly by Stripe. SEPA mandates are managed by GoCardless. Only transaction identifiers are retained.
Technical and browsing data — IP address, browser type, pages visited, session data, client portal access logs.
Data from use of the Luxia chatbot — conversation history with Luxia, the Hair Luxury AI assistant, within the limits of the session. This data is used to improve the relevance of answers and to resolve the Client's requests.
| Purpose | Legal basis (art. 6 GDPR) | Retention |
|---|---|---|
| Managing orders and the commercial relationship | Performance of the contract (art. 6.1.b) | Duration of the relationship + 5 years (commercial limitation period) |
| Invoicing and accounting | Legal obligation (art. 6.1.c) — French Commercial Code L.123-22 | 10 years from the close of the financial year |
| Company ID verification / fraud prevention | Legitimate interest (art. 6.1.f) | Duration of the commercial relationship |
| Payment handling and debt recovery | Performance of the contract (art. 6.1.b) / Legal obligation (art. 6.1.c) | 5 years after settlement |
| Aftersales service and client support | Performance of the contract (art. 6.1.b) | 2 years after the last interaction |
| B2B marketing and professional newsletter | Legitimate interest (art. 6.1.f) — art. L.34-5 CPCE for B2B | 3 years with no active contact |
| Portal security and prevention of unauthorised access | Legitimate interest (art. 6.1.f) | 12 months (technical logs) |
| Statistical analysis and service improvement (CRM) | Legitimate interest (art. 6.1.f) | Aggregated and anonymised beyond 3 years |
| Interactions with the Luxia chatbot | Performance of the contract / Legitimate interest (art. 6.1.b/f) | Rolling 90 days |
Hair Luxury uses the following processors and partners to deliver its services. Each is bound by contractual data protection obligations (DPA / GDPR addendum):
| Processor | Role | Country | Transfer safeguard |
|---|---|---|---|
| Stripe | Card payments | USA | Data Privacy Framework (DPF) |
| PayPal | Online payments | Luxembourg | EU — no transfer |
| GoCardless | SEPA direct debit | United Kingdom | UK adequacy decision (art. 45 GDPR) + standard contractual clauses |
| Resend | Transactional email delivery | USA | Standard contractual clauses (SCC) |
| Vercel Inc. | Website and portal hosting | USA | SCC |
| Neon (Neon Inc.) | PostgreSQL database (CRM, portal) | USA | SCC |
| Axonaut | CRM, invoicing, sales management | France | EU — GDPR directly applicable |
| Anthropic PBC | Claude AI — engine behind the Luxia chatbot | USA | SCC |
| SendCloud | Shipping management and parcel tracking | Netherlands (EU) | EU — GDPR directly applicable |
For transfers outside the European Union, Hair Luxury ensures that appropriate safeguards are in place in accordance with Chapter V of the GDPR (standard contractual clauses adopted by the European Commission, an adequacy decision, or membership of the EU–US Data Privacy Framework).
Under Regulation (EU) 2016/679, you have the following rights over your personal data:
Right of access (art. 15): obtain confirmation that data concerning you is being processed and obtain a copy of it.
Right to rectification (art. 16): have inaccurate or incomplete data corrected.
Right to erasure (art. 17): request deletion of your data, within the limits of statutory retention obligations.
Right to restriction of processing (art. 18): request that processing of your data be temporarily frozen.
Right to data portability (art. 20): receive your data in a structured, machine-readable format where processing is based on the contract or on consent.
Right to object (art. 21): object at any time to processing based on legitimate interest, in particular to commercial prospecting.
Right not to be subject to automated decision-making (art. 22): not to be subject to a decision based solely on automated processing producing significant legal effects.
How to exercise your rights — send your request by email to contact@hairluxury.fr stating your first and last name, professional email address and the right you wish to exercise. Hair Luxury undertakes to reply within one month of receiving your request (art. 12 GDPR).
Proof of identity may be requested in order to verify your identity, in accordance with article 12.6 GDPR.
The hairluxury.fr website uses cookies and trackers to operate correctly, measure audience and improve the user experience.
In accordance with the recommendations of the French data protection authority (CNIL deliberation no. 2020-091 of 17 September 2020), your consent is obtained before any non-essential cookie is set. You can change your preferences at any time via the cookie management banner available at the bottom of the page.
Cookies strictly necessary for the site to function (session, security) are set without prior consent on the basis of legitimate interest.
Hair Luxury implements appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction, in accordance with article 32 GDPR. Communications between your browser and our servers are encrypted using TLS. Passwords are stored in hashed form (bcrypt). Access to data is restricted to authorised staff only. In the event of a data breach likely to result in a risk to your rights and freedoms, Hair Luxury will notify the CNIL within 72 hours in accordance with article 33 GDPR.
If you consider that the processing of your personal data does not comply with the GDPR, you have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the competent French supervisory authority: www.cnil.fr — 3, place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. You may also lodge a complaint with the supervisory authority of your own country of residence.
Hair Luxury reserves the right to update this privacy policy at any time, in particular to include new processing activities or processors. The date of the last update is shown at the top of the document. Active portal users will be informed of any substantial change by email.
Last updated: 18 April 2026 — Hair Luxury, data controller. Data contact: Henintsoa Rakotoarisoa — contact@hairluxury.fr. This English version is provided for convenience only; the French version is the legally binding text.
