Privacy Policy

1. Privacy at a Glance

The following notes give you an overview of what happens to your personal data when you visit this website, order from us or contact us. Personal data is any data that can be used to identify you personally. We process your data only as far as the law allows and do not pass it on to third parties for advertising purposes.

2. Controller

The controller responsible for data processing on this website is:
Hunger Halt UG (haftungsbeschränkt) (brand “Prominente Haare”)
Falkenseer Chaussee 32, 13583 Berlin, Germany
Managing Director: Shivam Sethi
Email: hello@prominentehaare.com

3. Hosting and Server Log Files

When you visit our website, data transmitted by your browser is collected automatically (server log files): browser type and version, operating system, referrer URL, hostname of the accessing computer, time of the server request and IP address. This data is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation of the website). Log files are stored only as long as necessary for operation and security.

Our website consists of two parts: the display of the pages (frontend) is delivered via Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA); the server application (backend for order and account functions) is operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany; server location: Germany). When you call up the pages, your IP address is also transmitted to these providers. Data processing agreements under Art. 28 GDPR are in place with both providers. Transfers to Vercel in the USA are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses (see section 11). We load fonts from our own website rather than from third parties such as Google Fonts. Data is transmitted in encrypted form (SSL/TLS).

Requests to our server application are also routed through the security and content delivery network of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). In doing so, your IP address is processed to protect against attacks and abuse (Art. 6(1)(f) GDPR). A data processing agreement under Art. 28 GDPR is in place with Cloudflare; transfers to the USA are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses (see section 11).

4. Orders and Contract Performance

When you place an order we process your name, billing and delivery address, email address, telephone number (optional), order data and payment information in order to perform the contract (Art. 6(1)(b) GDPR), for example for payment, shipping, invoicing, customer service, withdrawal and warranty. We do not store card data; it is processed directly by our payment provider.

To comply with commercial and tax law obligations we retain order and invoice data for the statutory periods of 6 to 10 years (Art. 6(1)(c) GDPR). To prevent payment fraud and abuse (e.g. of discount codes or returns), we process order and usage data on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

5. Customer Account

If you create a customer account, we store your login data (email address and an encrypted password), your address data and your order history to provide the account (Art. 6(1)(b) GDPR). You can delete your account and personal data yourself at any time under “My Account → Privacy”; statutory retention obligations remain unaffected.

6. Contacting Us

If you contact us via the contact form or email, we process your name, email address and message to handle your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the data once your enquiry has been dealt with and no retention obligations prevent this. With the contact form, your consent to the processing is required to send it.

7. Colour Advice (Color Match)

If you use our colour service, we process your details and the photos you upload to give you a suitable colour recommendation (Art. 6(1)(b) or (a) GDPR). Please only upload photos in which no third parties are recognisable. We delete the photos once the purpose of the consultation is fulfilled.

8. Product Reviews

If you submit a review, we process your review text, your rating and the account data required for attribution. Reviews are only possible after a purchase. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in authentic reviews).

9. Service Providers Used (Processors and Recipients)

We only pass data on to service providers where this is necessary to perform the contract or another legal basis exists. Processing agreements under Art. 28 GDPR are in place with processors.

Payment processing: Stripe Payments Europe, Ltd. (Dublin, Ireland), PCI-DSS certified. Depending on the payment method you choose (credit card, PayPal, Klarna, Apple Pay, Google Pay, iDEAL, etc.), payment data is also passed to the respective payment providers; with Apple Pay or Google Pay your IP address is technically transmitted to Apple or Google Ireland Limited. Privacy policy: stripe.com/privacy
Shipping: DHL (Deutsche Post AG) and DPD receive your name, delivery address and, where applicable, contact details for delivery. For parcel tracking we query the status from DHL using the tracking number. DHL privacy policy: dhl.de/de/privatkunden/datenschutz.html
Email delivery: ZeptoMail (Zoho Corporation) sends order and account confirmations, invoices and password reset emails on our behalf. Privacy policy: zoho.com/privacy.html
Database: We store order, account and product data in a MongoDB database that we operate ourselves on the Hetzner server in Germany (see section 3); no separate database provider is involved.
Invoicing and accounting system: For invoicing, stock management and accounting we use our own shop application, which runs on our server at Hetzner in Germany; tax advisers and accounting service providers receive data where legally required.
Web analytics: Google Analytics (Google Ireland Limited), only with your consent (see section 10). Privacy policy: policies.google.com/privacy

10. Cookies and Web Analytics

The following cookies or local storage items are technically necessary and are always set on the basis of Section 25(2) TDDDG and Art. 6(1)(f) GDPR:

NEXT_LOCALE / PH_COUNTRY: stores your language and country selection (1 year) so that prices and content are shown in your language and currency.
userInfo: keeps you logged in if you have an account (12 hours).
ph_cookie_notice_ack and ph_consent: store your cookie choice (1 year).

Analytics cookies (only with your consent): If you click “Accept all” in the cookie notice, we use Google Analytics (cookies such as _ga and _ga_*, up to 2 years) and transmit usage data to Google. The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. If you click “Necessary only”, these cookies are not set and no data is transmitted for analytics purposes. You can change your choice at any time via the cookie notice; you can withdraw your consent with effect for the future.

11. Transfers to Third Countries

Some of our service providers (e.g. Stripe, Google, Zoho, Vercel, Cloudflare) may transfer data to countries outside the EU/EEA, in particular the USA. Transfers are based on an adequacy decision of the EU Commission (EU-US Data Privacy Framework) or EU Standard Contractual Clauses (Art. 44 et seq. GDPR).

12. Storage Periods

We store personal data only as long as necessary for the respective purpose. We retain order, invoice and booking data for the statutory periods of 6 to 10 years. Account data is stored until you delete your account, enquiries until they are dealt with. After that the data is deleted unless statutory retention obligations prevent this.

13. Your Rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Registered customers can request a copy of their order data and delete their account themselves under “My Account → Privacy”. Guests contact hello@prominentehaare.com.

Right to object (Art. 21 GDPR): You can object at any time, on grounds relating to your particular situation, to processing of your data based on our legitimate interest (Art. 6(1)(f) GDPR).

Withdrawal of consent: You can withdraw any consent given at any time with effect for the future. The lawfulness of processing carried out until then remains unaffected.

14. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.

15. Provision of Data, Automated Decisions

The details we ask for during checkout (name, address, email) are required for a purchase; without them we cannot perform the contract. There is no solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

16. Changes

We update this privacy policy when our processing or the legal situation changes. The current version on this page applies.