Privacy policy
- Version:
- SH-POL-v2
- Version date:
This policy describes how we process the personal data of people who visit sainthair.eu and use the forms on this website. The online shop and customer accounts will be covered in the next version of this policy, before they go live.
Who is the controller
The controller of your personal data is Saint Hair Europe Sp. z o.o., ul. Karola Marcinkowskiego 8a/1, 85-056 Bydgoszcz, Poland, NIP (tax ID) 9671483384, REGON 540589167, KRS 0001147669.
We have not appointed a data protection officer, as we are not required to (Art. 37 GDPR). For any matter concerning personal data, contact us directly — as described below.
How to contact us
For any matter concerning personal data, write to kontakt@sainthair.eu or send a letter to the registered office address above.
What data we process, why and on what legal basis
Forms on the website
We process only the data a given form asks for. Fields the form does not contain are discarded.
| Form | Data | Purpose | Legal basis |
|---|---|---|---|
| Wholesale enquiry | full name, company, country, e-mail, phone or WhatsApp, intended use, quantity and, if you provide them: website, lengths, colours, texture, order frequency, message, files | preparing a quote and an offer | Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract |
| Atelier consultation | full name, e-mail, message | arranging and preparing a consultation | Art. 6(1)(b) GDPR |
| Hair matching | full name, e-mail and, if you provide them: message, photos | matching a product before purchase | Art. 6(1)(b) GDPR |
| Training registration | full name, e-mail, selected training | handling the training registration | Art. 6(1)(b) GDPR |
| Contact | full name, e-mail, message | replying to your message | Art. 6(1)(f) GDPR — our legitimate interest in replying to correspondence |
Sending a form does not require consent to data processing. Below each form we show a short notice about data processing, and the submission records which version of that notice you saw.
Consent to marketing emails
Next to a form you can tick a separate, voluntary consent to receive emails about Saint Hair news, offers and events. The box is not ticked by default, and not giving consent does not affect how we handle your enquiry.
The basis for sending is your consent (Art. 6(1)(a) GDPR and the rules on electronic commercial communications). You can withdraw consent at any time — using the link in the footer of any email or by writing to kontakt@sainthair.eu. Withdrawal does not affect the lawfulness of emails sent before.
To be able to demonstrate that consent was given, we record with it the date and time, the version of the consent text, the page address, your IP address and browser information (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
Protecting forms against abuse
To limit automated form submissions, we keep for one hour a hash created from your IP address and e-mail address together with the number of submission attempts. The basis is our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR).
Email and WhatsApp correspondence
If you write to us directly, by email or WhatsApp, we process the data in that correspondence to reply (Art. 6(1)(f) GDPR) and, where the message concerns a purchase, a service or training, to take steps before entering into a contract (Art. 6(1)(b) GDPR).
Establishing and defending legal claims
Where necessary, we may process data to establish, pursue or defend legal claims (Art. 6(1)(f) GDPR).
Health data
We do not need information about your health to match hair or run a consultation. Please do not include it in a form or in correspondence, and if you attach a photo, a photo of the hair alone, without your face, is enough. If such information reaches us anyway, we delete it promptly, unless the law requires otherwise.
Where your data comes from
The data comes from you — from a form, an email or a WhatsApp conversation. If a wholesale enquiry is sent by a company employee, that person's data comes from them.
Who we share data with
We do not sell data. We share it only with providers who perform services for us and process data on our instructions under a data processing agreement (Art. 28 GDPR). With one of them the agreement is still being concluded — we say so plainly in the table:
| Provider | Service | Where data is processed |
|---|---|---|
| HOSTINGER INTERNATIONAL LIMITED, 61 Lordou Vironos str., 6023 Larnaca, Cyprus | hosting of the website back end (forms and uploaded files) and of the server running our customer relationship system (Twenty) and enquiry inbox (Chatwoot) | Lithuania (EU) |
| UW-TEAM.org Jakub Mrugalski (Mikrus services), NIP (tax ID) 6821639338 | mail server for the sainthair.eu domain and automation server (n8n) | Finland (Helsinki; Hetzner Online GmbH as a further processor); the data processing agreement is being concluded (as at 2026-09-17) |
| Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA | delivering the website and routing traffic to our customer service systems | a worldwide server network, including the USA — see “Transfers outside the European Economic Area” |
| Brevo SAS | sending marketing emails — only to people who have consented | France (EU) |
We run the customer relationship system and the enquiry inbox ourselves, on the Hostinger server listed in the table above — their vendors have no access to the data.
If you choose to contact us on WhatsApp, you write to our business number +48 730 959 118. Your message passes through the WhatsApp service (Meta group, in Europe WhatsApp Ireland Limited). WhatsApp does not process data on our instructions but as a separate entity, under its own terms and privacy policy, which you accept when creating an account. We hold the conversation in the WhatsApp Business app linked to our business number — that is where we keep the conversation, your phone number and your WhatsApp profile name. Conversations on this number do not reach our enquiry inbox (Chatwoot).
We may also disclose data to public authorities where the law requires it.
Transfers outside the European Economic Area
Cloudflare, Inc. is based in the USA, and its servers may process data outside the European Economic Area. Cloudflare, Inc. participates in the EU-U.S. Data Privacy Framework, so such transfers rely on the European Commission's adequacy decision. The data processing agreement with Cloudflare also includes standard contractual clauses approved by the Commission.
WhatsApp may transfer data outside the European Economic Area under the rules set out in its own privacy policy — this is not a transfer made by us.
You can obtain a copy of the safeguards used for transfers by Cloudflare by writing to kontakt@sainthair.eu.
How long we keep data
| Data | Retention period |
|---|---|
| form submission and correspondence, if no contract follows | up to 12 months after our last contact |
| files attached to a form (photos, specifications) | 90 days after upload |
| data related to a concluded contract | for the duration of the contract, then for the period required by tax and accounting law and until the limitation period for claims expires |
| e-mail address for marketing emails | until consent is withdrawn |
| record of consent being given and withdrawn (date, version of the consent text, IP address, browser information) | 6 years from the end of the year in which consent was withdrawn — to demonstrate compliance and defend against claims (Art. 6(1)(f) GDPR); the address is no longer used for sending by then |
| hash of IP address and e-mail used to protect forms | 1 hour |
| data passed through our automation (n8n) | up to 31 days |
| server access logs (IP address, time and address of the request) | Cloudflare: 7 days; Hostinger: up to 7 days |
| back-end error logs (may contain the IP address and request data) | deleted periodically, at least every 30 days |
Your rights
You have the right to:
- access your data and receive a copy (Art. 15 GDPR),
- rectify your data (Art. 16 GDPR),
- erase your data (Art. 17 GDPR),
- restrict processing (Art. 18 GDPR),
- data portability for data we process on the basis of a contract or consent (Art. 20 GDPR),
- object to processing based on our legitimate interest (Art. 21 GDPR),
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3) GDPR).
To exercise these rights, write to kontakt@sainthair.eu. We reply without undue delay and within one month at the latest. In exceptional cases this may be extended by two further months — we will then tell you within the first month.
Complaint to the supervisory authority
If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.
Do you have to provide data
Providing data is voluntary. Without the data marked as required in a form we cannot reply to your enquiry or prepare an offer, a consultation or a training registration. Consent to marketing emails is entirely voluntary and not giving it has no consequences.
Automated decisions and profiling
We do not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.
Cookies and similar technologies
Cookies are small files stored on your device by your browser. The sainthair.eu website does not store cookies and does not use browser storage (localStorage, sessionStorage) to recognise visitors. We do not use advertising tools, pixels or third-party analytics. That is why we do not show a cookie consent banner.
The website's fonts and images are loaded from our own servers, not from third-party providers. The link to our Instagram profile is a plain link — once you follow it, Instagram's own rules apply.
Cloudflare, which delivers the website, does not store any cookies today. When protecting against abuse (such as automated traffic), technical Cloudflare cookies such as __cf_bm or cf_clearance may be set. They are strictly necessary for the website's security, are not used for tracking and do not require consent.
You can change cookie settings in your browser, including blocking or deleting cookies. If we ever add tools that require cookies, we will first update this policy and ask for your consent.
Changes to this policy
We update this policy when the law or the way the website works changes — in particular before the online shop launches. Each version has an identifier and date shown at the top of this page, and we keep previous versions.