Privacy Policy
Privacy Policy
Last updated: 28 July 2026
1. Who is responsible for your data
N. Evgeniou Limited (trading as "Effective Hair Center"), company registration number HE 161605, Methanon 10, Germasogeia, Limassol 4042, Cyprus, is the data controller for the personal data described in this policy.
Email: contact@effectivehair.cy · Phone: +357 25 325377
This policy explains how we collect, use, share and protect your personal data when you visit effectivehair.cy, create an account, place an order, choose Click & Collect, contact us, or otherwise use our services. It applies to the website in all three languages (English, Greek, Russian).
We have not appointed a Data Protection Officer, as we are not required to; the contact for all privacy matters is contact@effectivehair.cy.
2. Summary (short version)
- We collect the data needed to run your account and deliver your orders — and not more.
- Card payments are handled by Stripe; we never see or store your full card number.
- We send only service emails (order confirmations, shipping updates, account security). We do not send marketing emails.
- Analytics cookies run only if you accept them in the cookie banner.
- Your data is stored on servers in the EU.
- You can ask us at any time to access, correct or delete your data.
3. Personal data we collect
A) Account and profile data — when you register: name, email address, password (stored only as a cryptographic hash — we cannot read it), phone number (if provided), preferred language, saved delivery addresses, and your account activity (orders, sign-in method). If you register or sign in with Google, we receive your name, email address and a Google account identifier from Google; we do not receive your Google password.
B) Order and checkout data — billing and delivery details (name, address, email, phone), the products you ordered, order notes you add, your chosen delivery method, order history, and refund/return history. If you check out as a guest, we collect the same order data without creating a login. We also record the language you used at checkout so we can write to you in that language.
C) Payment data — payments are processed by Stripe. Your card number, Apple Pay / Google Pay credentials and similar details go directly to Stripe and are never received or stored by us. We receive and store: confirmation of payment, the payment method type, and — for cards — the brand, last four digits and expiry date. If you choose to save a card, Stripe stores it in tokenised form against a Stripe customer reference linked to your account; we store only that reference.
D) Delivery and collection data — the information needed for ACS Courier to deliver your parcel (name, address, phone), and the parcel tracking number. For Click & Collect: your name, contact details and order number.
E) Communications — messages you send us by email, the website contact form, WhatsApp or phone, and our transactional emails to you (order confirmation, shipping, refunds, account security notices such as password-change confirmations).
F) Technical data — IP address, device and browser information, pages requested, timestamps, and similar server-log data generated automatically when you access the website; session identifiers that keep you signed in; and the cookie/consent data described in our Cookie Policy. With your consent, Google Analytics collects aggregated usage statistics (see section 7 and the Cookie Policy).
We do not collect any special categories of personal data, and we ask you not to include such information in order notes or messages.
4. Whether you must provide data
Data marked as required at registration or checkout is needed to create your account or fulfil your order — without it we cannot provide the service. Everything else (e.g. phone number where optional, order notes, saving a card, analytics consent) is optional.
5. Why we use your data and the legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and running your account; sign-in (email/password or Google); saved addresses; password/email changes | A | Contract (Art. 6(1)(b)) |
| Processing orders and payments; delivery or Click & Collect; sending order, shipping and refund emails | B, C, D | Contract (Art. 6(1)(b)) |
| Saving a card at your request for future purchases | C | Contract (Art. 6(1)(b)) — at your request |
| Keeping accounting records, invoices and tax records | B, C | Legal obligation (Art. 6(1)(c)) |
| Handling returns, withdrawal requests, guarantee claims and complaints | B, C, D, E | Contract and legal obligation |
| Customer support and answering enquiries | E | Legitimate interests (Art. 6(1)(f)) — responding to you |
| Fraud prevention and payment security (via Stripe) | C, F | Legitimate interests (Art. 6(1)(f)) — protecting our business and customers |
| Website security, error diagnosis, server logs | F | Legitimate interests (Art. 6(1)(f)) — running a secure service |
| Account security notices (e.g. "your password was changed") | A, E | Legitimate interests / legal obligation — protecting your account |
| Analytics (Google Analytics 4) | F | Consent (Art. 6(1)(a)) — via the cookie banner; you can withdraw at any time |
We do not use your data for marketing emails, profiling for advertising, or automated decisions with legal effects (see section 10 for payment fraud screening). If we ever introduce a newsletter, it will be strictly opt-in.
6. Who we share data with
We share personal data only with service providers ("processors" or independent controllers) that we need to run the shop:
| Recipient | Role | What they receive |
|---|---|---|
| Stripe (Stripe Payments Europe Ltd, Ireland) | Payment processing, fraud prevention, saved cards | Payment details, billing name/email, order amount, technical data during checkout |
| ACS Courier (Cyprus / Greece) | Parcel delivery | Recipient name, delivery address, phone, parcel details |
| Resend (transactional email service) | Sending our service emails | Your email address, name, and the content of order/account emails |
| Google (Google Ireland Ltd) | Google Sign-In (if you use it); Google Analytics (if you consent); the embedded map on our contact page | Sign-In: your Google identifiers. Analytics: usage data per the Cookie Policy. Maps: technical data when the contact page loads |
| Hetzner Online GmbH (EU) | Server hosting — our database and application run on servers rented from Hetzner | All website data is stored on this infrastructure |
| CY Digital Transformation Ltd (Digideus, Limassol, Cyprus) | Website development and technical administration | Access to website systems for maintenance and support |
We do not sell personal data, and we do not share it with advertisers.
We may also disclose data where required by law, to competent authorities, or to establish or defend legal claims.
7. Analytics
We use Google Analytics 4 to understand how the website is used (pages visited, approximate location at city level, device type). Analytics cookies are set only if you accept them in the cookie banner; IP addresses are anonymised. If you decline, no analytics cookies are set and any previously set analytics cookies are deleted; Google may still receive minimal, cookieless technical pings that are not linked to you. Details, including how to change your choice, are in the Cookie Policy.
8. International transfers
Your data is primarily stored and processed within the European Union (our servers are in the EU, and our email service sends from an EU region). Some of our providers (Stripe, Google, Resend) are part of US-headquartered groups and may transfer limited data to the United States or other countries. Where that happens, the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework) and/or the European Commission's Standard Contractual Clauses. You can ask us for more information about the safeguards used.
9. How long we keep data
| Data | Retention |
|---|---|
| Orders, invoices, payment records | 6 years from the end of the relevant financial year (Cyprus tax and VAT record-keeping) |
| Account data | While your account is active; deleted or anonymised on your deletion request, except data we must keep (e.g. order/invoice records above) |
| Guest checkout data | Kept as part of the order record (above) |
| Saved cards | Until you remove them in your account, or on account deletion |
| Sign-in sessions | Up to 30 days of inactivity |
| Password-reset links | Valid 15 minutes |
| Email-change verification links | Valid 24 hours |
| Support correspondence | Up to 2 years after the matter is closed |
| Server logs | Up to 30 days |
| Analytics data | Google Analytics retention set to 14 months |
10. Automated decision-making
We do not make decisions producing legal or similarly significant effects about you by purely automated means. One near-exception, in the interest of transparency: card payments are screened automatically for fraud by Stripe, and a payment that is flagged may be declined automatically. If your payment is declined and you believe this is an error, contact us and we will look into it with Stripe — you can also contact your card issuer.
11. How we protect your data
All traffic to the website is encrypted (TLS/HTTPS). Passwords are stored only as strong cryptographic hashes. Sign-in sessions use secure, HTTP-only cookies. Card data is handled exclusively by Stripe, a PCI-DSS-certified payment processor. Our systems run on EU servers with access restricted to those who need it for the purposes above. No system is perfectly secure, but we take the protection of your data seriously and review our measures regularly.
12. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate or incomplete data (you can edit most account data yourself in your account);
- erasure ("right to be forgotten") — subject to records we are legally required to keep;
- restrict processing in certain circumstances;
- object to processing based on legitimate interests;
- data portability — receive data you provided to us in a structured, machine-readable format;
- withdraw consent at any time where processing is based on consent (e.g. analytics cookies), without affecting prior processing.
To exercise any right, email contact@effectivehair.cy. We will respond within one month (extendable by two further months for complex requests, in which case we will tell you). We may need to verify your identity first. Exercising your rights is free of charge.
You also have the right to lodge a complaint with a supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy, 1 Iasonos Street, 1082 Nicosia). If you are in Greece, you may instead contact the Hellenic Data Protection Authority (www.dpa.gr). We would, however, appreciate the chance to resolve your concern first.
13. Children
The website and shop are not intended for children under 16, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.
14. Cookies
See our Cookie Policy for full details of the cookies and similar technologies used on the website and how to manage them.
15. Changes to this policy
We may update this policy from time to time — for example if we add new features or providers. The current version is always available on the website with its "Last updated" date. For significant changes affecting you (e.g. a new purpose of processing), we will take reasonable steps to inform you.