This page details how we comply with Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018 and the other applicable Romanian and European rules. It complements the Privacy policy: here you find the legal bases, rights, time limits and who holds which role. It is not personal legal advice, but it is the rule we work by.
Updated: 6 September 2026
Beauty Manager is the controller for: creating and administering platform accounts, sign-in, confirmations, password reset, subscription, interface language, technical logs and requests sent to us.
The salon is the controller for the client and team data it enters: bookings, services performed, notes, messages to its clients, companies, photos, prices. If you want to know why a salon saved an allergy or a phone number, the right to information is exercised first towards the salon.
For the technical storage of data the salon writes in the application, Beauty Manager may be a processor: we act on the salon’s instructions (keep records, show the calendar, send a reminder the salon configured). We do not use that data to sell you something else.
Art. 6(1)(b) — contract: account, booking, subscription, delivering the features you asked for.
Art. 6(1)(c) — legal obligation: answering authorities, fiscal retention of subscription payments, minimum security.
Art. 6(1)(f) — legitimate interest: fraud prevention, access logs, aggregated traffic statistics, defending our rights in a dispute. We balance this interest with yours: we do not hide marketing and we do not sell the data.
Art. 6(1)(a) — consent: only where we ask for it explicitly and you can withdraw it just as easily. Refusing marketing consent does not close your right to a working account.
Health data (art. 9) is not the purpose of the platform. If a salon writes such information in notes, the salon must have its own basis (for example explicit consent or another legal ground). We do not ask for such data at registration.
Access (art. 15): you may ask for confirmation that we process you and a copy of your platform data, plus the information on this page applied to your case.
Rectification (art. 16): you may ask us to correct your name, email, phone or other inaccurate data. Many of these you can change yourself in the application.
Erasure (art. 17): you may ask for deletion when the data is no longer needed, you withdrew consent and no other basis remains, you object and no overriding legitimate grounds exist, or the processing was unlawful. We do not delete what the law requires us to keep (for example payment traces) and we cannot delete from a salon’s records what the salon is obliged or entitled to keep.
Restriction (art. 18): you may ask us to “freeze” processing while a dispute is pending (accuracy, objection, data needed for a claim).
Portability (art. 20): for data you gave us and that we process by automated means on a contract or consent basis, you may ask for an export in a structured, commonly used format.
Objection (art. 21): you may object to processing based on legitimate interest, including statistics that would target you individually. For direct marketing, objection is absolute.
Complaint (art. 77): you may complain to the National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 Gheorghe Magheru Blvd, District 1, Bucharest, www.dataprotection.ro.
Write to one of the addresses on the Contact page, with the subject “GDPR” and a clear description: which right you exercise, which data you mean, the email or phone of the account. We may ask for extra information so we do not give your data to someone else.
We reply within one month of receiving a valid request. If the request is complex or you have sent several, we may extend by two months, and we tell you in the first month. If we cannot act, we say why and how you can challenge that, including before ANSPDCP.
The request is, in principle, free. If it is manifestly unfounded or excessive (repeated without reason), we may charge a reasonable fee or refuse, explaining why.
If we learn of a security breach that risks your rights and freedoms, we notify ANSPDCP within 72 hours of becoming aware, if the law requires it, and we also inform you when the risk is high: what happened, which data is involved, what we did and what you can do (for example change the password).
Please tell us at once if you see a leak, someone else’s screen or a suspicious email that claims to come from us.
We work only with processors who give sufficient guarantees (confidentiality, security, deletion or return at the end). We do not authorise a sub-processor to use the data as its own.
We keep a record of processing activities for our role as controller, under art. 30, in proportion to the volume and risk of the platform. As of the date of this page we do not have a separately appointed DPO; GDPR requests go to the same contact address and are treated with priority.
We do not take decisions with legal effect about you based solely on automated processing such as credit scoring or advertising profiling. The internal “any employee” assignment of a booking is an operational salon rule (who had fewer recent bookings), not profiling of your private life.
The Privacy policy says what data and why. The Terms say the contractual rules. This page says the legal bases and rights. Suggestions and complaints says how you complain if something goes wrong. If there is a tension, for data protection the GDPR and this page prevail.