1. PRIVACY POLICY
To be published on page /notelegali/privacy-policy
1. Data controller
This Privacy Policy explains how personal data is collected, used, stored and protected through the website www.milanoextensioncapelli.com, the booking system, online shop, forms, customer area, WhatsApp, email, Instagram and other channels connected with the business.
The data controller is NAVARRO SALAZAR MICHAELL MILAGROS, sole proprietor, trading as Master Extension Michelle, with registered and operating office at Via Padova 236, 20132 Milan (MI), Italy. VAT No. 14601160964, tax code NVRMHL05L45F205J, REA MI-2796383, certified email (PEC) michaellnavarro@pec.libero.it, telephone +39 328 687 5675.
2. Categories of data processed
2.1 Identification and contact data
• First and last name.
• Email address.
• Phone number and WhatsApp contact.
• Home, delivery or billing address.
• Customer account data and login credentials managed by the Wix platform.
2.2 Order and booking data
• Product or service selected.
• Appointment date, time, duration and history.
• Amounts paid, booking fees, deposits and payment method.
• Information needed for delivery, collection, billing and customer support.
• Messages and communications about orders, bookings, complaints or requests.
2.3 Technical information about hair
• Hair color, length, density and type.
• Desired result and requested service.
• Photos of hair uploaded or voluntarily sent to assess color, length, natural base and extension availability.
• Technical information needed to check whether the service can be provided.
2.4 Special-category data that may be shared
Master Extension Michelle does not make medical diagnoses and asks customers not to share unnecessary health data. If a customer voluntarily shares information about significant hair loss, thinning, alopecia, irritation, allergies, treatments or other scalp conditions, that data is processed only when strictly necessary for the technical assessment and, where required, on the basis of separate explicit consent.
2.5 Payment data
Full card details are not stored directly by Master Extension Michelle. Payments are processed by the providers available at checkout, such as Wix Payments, Stripe, PayPal, Klarna or other authorized providers, under their respective privacy notices.
2.6 Browsing data and cookies
• IP address and online identifiers.
• Browser, device and operating system type.
• Date and time of access.
• Pages, products and services viewed.
• Interactions with forms, campaigns and checkout.
• Cookies and tracking tools, according to the preferences selected.
3. Purposes and legal bases
3.1 Managing orders, bookings and services
Data is processed to confirm and manage bookings, provide in-salon services, prepare extensions and products, process payments, deposits and refunds, arrange deliveries or collections and provide support. The legal basis is performance of the contract or pre-contractual steps requested by the customer.
3.2 Support and service communications
Data is used to respond to requests, communicate changes, availability, pre-orders, reminders and appointment information, and handle complaints and after-sales support. The legal basis is performance of the contract, pre-contractual steps and the legitimate interest in properly managing the relationship with the customer.
3.3 Administrative, tax and legal obligations
Data is processed for accounting, tax documents, fraud prevention, handling disputes and complying with requests from authorities. The legal basis is compliance with legal obligations and the data controller’s legitimate interest in protecting its rights.
3.4 Newsletters, promotions and WhatsApp marketing
News, promotions, advance notices from the promotions channel and commercial messages by email or WhatsApp are sent only with freely given, specific and withdrawable consent. Refusing consent does not prevent a purchase or booking.
3.5 Analytics, measurement and advertising
When non-essential tools are used, such as Google Analytics 4, Google Ads, Meta Pixel or equivalent features, processing is based on consent collected through the cookie banner. The purposes are to measure website use, improve content and assess campaigns.
3.6 Promotional photos and videos
Creating and publishing identifiable photos or videos of the customer on the website, social media, in advertising or in a portfolio takes place only after separate, specific and optional consent. Refusal does not prevent the customer from receiving the service.
4. Hair photos sent before the appointment
Photos sent to assess color, length or availability are used only to prepare the service, check available colors, determine whether an order is needed and respond to the request. They are not published without separate consent.
5. Providing data
Data marked as mandatory is needed to complete an order, booking, payment, delivery or request. Failure to provide it may prevent the contract from being concluded or the service from being properly provided. Data requested for marketing, promotional photos and commercial messages is optional.
6. Data recipients
• Wix.com and the website’s technical providers.
• Payment providers and instalment services.
• Couriers and logistics providers.
• Accountant, tax, legal and privacy advisers.
• Email, CRM, newsletter and automation providers.
• Google, Meta and advertising platforms, if authorized.
• Authorized collaborators and staff.
• Public authorities, where required by law.
7. Transfers outside the European Economic Area
Some providers may also process data outside the European Economic Area. Transfers take place under adequacy decisions, Standard Contractual Clauses or other safeguards provided for by the GDPR.
8. Data retention periods
8.1 Tax, accounting and contract documents
Up to 10 years, unless longer retention is needed for disputes or legal obligations.
8.2 Orders, bookings and support
For as long as needed to manage the relationship and, generally, up to 24 months from the last interaction, unless legal obligations, warranties or disputes require otherwise.
8.3 Photos sent for assessment
Until the request or service is completed and, normally, for no more than 6 months, unless separate consent to publication is given or records need to be retained.
8.4 Marketing data
Until consent is withdrawn and, in any case, subject to periodic review.
8.5 Customer account
Until the account is deleted or after a prolonged period of inactivity, subject to legal obligations.
8.6 Cookies and browsing data
For the period stated in the preferences panel and the Cookie Policy.
9. Minors
The website is not intended for independent use by anyone under 18. For bookings, purchases or services relating to a minor, authorization from a parent or guardian may be required.
10. Automated decisions
No decisions are made solely by automated means that produce legal or similarly significant effects for the customer. Some tools may segment communications or measure interests only within the limits of the consent given.
11. Data subject rights
• Access to personal data.
• Rectification of inaccurate data.
• Erasure, where applicable.
• Restriction of processing.
• Objection to processing.
• Data portability, where applicable.
• Withdrawal of consent at any time.
• Information about the source and use of data.
12. How to exercise your rights
Requests may be sent to the certified email address (PEC) michaellnavarro@pec.libero.it or by post to NAVARRO SALAZAR MICHAELL MILAGROS, Via Padova 236, 20132 Milan. Requests are handled within the time limits set by the GDPR.
13. Complaint to the Data Protection Authority
The customer may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if they believe that processing violates applicable law.
14. Security
Reasonable technical and organizational measures are used to protect data from unauthorized access, loss, alteration or unlawful use. No online system can guarantee absolute security.
15. Link to the Cookie Policy
Information about cookies and tracking tools is available in the Cookie Policy and the permanent cookie preferences panel.
16. Changes
This Privacy Policy may be updated if services, providers, technologies used or applicable laws change. The latest version is published on this page with its update date.