Pursuant to Article 13 of EU Regulation 2016/679 (GDPR), M.C.G. Consulting Srl (Tax Code/VAT No. 02724720996), the data controller, takes the protection of your personal data and privacy very seriously. Please read this notice carefully, as it explains how the personal data provided during your relationship with our salon is processed.
1. Purposes of processing
The data you provide will be processed for the following purposes:
- To meet pre-contractual requirements (processing of client quotes or orders, creditworthiness checks, etc.);
- To fulfil contractual obligations (supply or purchase of goods and/or services) and legal obligations (bookkeeping, tax formalities, administrative and treasury management);
- Operational, organisational, management, tax, payment, financial, insurance and accounting requirements relating to the contractual and/or pre-contractual relationship established;
- To comply with any obligation imposed by laws, regulations or EU legislation;
- Indirect marketing, through the publication of photos, images and videos – subject to your explicit consent;
- Direct marketing, through the sending of newsletters via e-mail or SMS – subject to your explicit consent.
2. Categories of data processed
In relation to the purposes described above, the Company processes your personal data: first and last name; residential address; tax code; e-mail address; telephone number; services rendered (products used, treatments carried out, etc.); social media contacts (Facebook, Instagram, TikTok and others).
During the hairdressing service, photos and video footage may be taken, with your explicit consent, which may be published on the Company's website, on the data controller's own social media channels or other means of dissemination.
3. Processing methods
Processing will be carried out manually and in a partially automated manner. Operations may consist of: collection and recording; organisation and storage; consultation and use; processing and modification; selection, extraction and comparison; transmission and disclosure; erasure and destruction; blocking and restriction.
Processing will be carried out using both paper records and electronic, IT and telematic tools suited to ensuring the security and confidentiality of the data, in compliance with Article 32 of the GDPR and the provisions of Legislative Decree 196/03 on security measures.
4. Nature of the data provided
The provision of data is mandatory — and does not require your consent — for purposes related to obligations imposed by laws, regulations or EU legislation; essential — and does not require your consent — for all personal data essential to correctly establish, manage and continue the existing commercial, contractual and/or pre-contractual relationship (purposes 1-4); optional — and requires your explicit consent — regarding the use of data for purposes 5 and 6.
Any refusal, though legitimate, could compromise the proper conduct of your relationship with our salon. Refusal of marketing processing does not in any way affect the provision of the service.
5. Parties who may access the data
The data may be accessed or disclosed exclusively for the above purposes to:
- employees and staff of the Controller, acting as internal and external persons in charge and/or processors and/or system administrators;
- third-party companies or other parties (for example: credit institutions, professional firms, consultants, insurance companies, etc.) that carry out outsourced activities on behalf of the Controller, acting as external data processors. The list is available at our premises.
Your data will not be transferred to other EU Member States or to third countries outside the EU.
6. Your rights (Article 15 GDPR)
As a data subject, you may:
- obtain confirmation of whether or not personal data concerning you exists, and its disclosure in an intelligible form;
- obtain information about the source of the data, the purposes and methods of processing, the logic applied, the identity of the Controller and of the parties to whom the data may be disclosed;
- obtain the updating, rectification, completion, erasure, anonymisation or blocking of data processed unlawfully;
- object, in whole or in part, on legitimate grounds, to the processing or to processing for the purpose of sending advertising material.
Where applicable, you also have the rights under Articles 16-21 GDPR (rectification, erasure, restriction of processing, data portability, objection), as well as the right to lodge a complaint with the Italian Data Protection Authority.
7. Surveys and statistical processing
We specifically inform you that your data and the treatments carried out by the hairdresser may be disclosed to third parties for survey and statistical processing purposes, solely in aggregate form and not attributable to you, in compliance with the principle of data minimisation.