Data Protection • GDPR Regulation (EU 2016/679) & Belgian Law
Privacy Policy & GDPR Compliance
Total transparency regarding data collection, processing, and strict personal data protection.
1. Data Controller
The data controller responsible for personal data processed on https://haircarebysunshine.com is:
Data Controller: SUNSHINE CONSULTING SRL
Enterprise Number (CBE / VAT): BE 0775.855.191 (Belgium)
Registered Office: 51 Chaussée de Charleroi, 6061 Charleroi, Belgium
DPO / Privacy Contact: contact@haircarebysunshine.com
2. External Technical Service Providers & Sub-Processors (Art. 28 GDPR)
To ensure the smooth, uninterrupted, and highly secure technical operation of the platform, SUNSHINE CONSULTING SRL engages qualified external technical and IT service providers: cloud hosting infrastructure, application software development and maintenance, certified secure payment processing (PCI-DSS Level 1 compliant), and transactional email routing.
In compliance with Article 28 of the GDPR, all external technical processors operate under strict data processing agreements (DPA). They are bound by absolute confidentiality and security standards, and are strictly prohibited from utilizing, transferring, or commercializing personal data for their own purposes.
In compliance with Article 28 of the GDPR, all external technical processors operate under strict data processing agreements (DPA). They are bound by absolute confidentiality and security standards, and are strictly prohibited from utilizing, transferring, or commercializing personal data for their own purposes.
3. Collected Data, Purposes & Legal Bases (Art. 6 GDPR)
We strictly observe data minimization (Art. 5 GDPR). Gathered data is limited to what is strictly necessary for:
• Order management and parcel delivery: Full name, email, phone (WhatsApp), billing and shipping addresses. Legal basis: Contractual necessity (Art. 6.1.b) & tax obligations (Art. 6.1.c).
• Custom hair routine diagnostic (Porosity quiz): Cuticular porosity, curl pattern, chemical treatment history. Legal basis: Explicit consent (Art. 6.1.a).
• Payment processing: Encrypted end-to-end and handled directly by our certified payment processor (PCI-DSS Level 1 compliant) without transit on our servers. Legal basis: Contractual performance (Art. 6.1.b).
• Claims, returns, and refunds: Order reference, refund IBAN, return reason. Legal basis: Contractual performance & statutory withdrawal duty (Art. 6.1.b & c).
• Order management and parcel delivery: Full name, email, phone (WhatsApp), billing and shipping addresses. Legal basis: Contractual necessity (Art. 6.1.b) & tax obligations (Art. 6.1.c).
• Custom hair routine diagnostic (Porosity quiz): Cuticular porosity, curl pattern, chemical treatment history. Legal basis: Explicit consent (Art. 6.1.a).
• Payment processing: Encrypted end-to-end and handled directly by our certified payment processor (PCI-DSS Level 1 compliant) without transit on our servers. Legal basis: Contractual performance (Art. 6.1.b).
• Claims, returns, and refunds: Order reference, refund IBAN, return reason. Legal basis: Contractual performance & statutory withdrawal duty (Art. 6.1.b & c).
4. Audience Analytics & Google Analytics 4 (ePrivacy)
To optimize the user experience and refine hair routine recommendations, we use Google Analytics 4 (GA4). IP addresses are anonymized upon collection. No personally identifying information is provided to Google. Maximum retention period: 14 months. You can modify your consent at any time via the cookie manager below.
• Data Processor: Google Ireland Limited (Dublin, Ireland).
• Default IP Anonymization: Google Analytics 4 anonymise automatiquement les adresses IP.
• Data Retention Period: 14 mois maximum.
Gestion Interactive du Consentement :
5. Data Retention Periods
Your data is stored for periods strictly proportional to their intended purposes:
• Billing and order accounting records: 7 years (statutory Belgian tax and accounting requirement).
• Customer relationship data: 3 years following the last active contact.
• Hair routine diagnostic answers: 12 months, or immediate erasure upon simple request.
• GA4 analytics metrics: 14 months maximum.
• Claims and returns records: 3 years following case resolution.
• Billing and order accounting records: 7 years (statutory Belgian tax and accounting requirement).
• Customer relationship data: 3 years following the last active contact.
• Hair routine diagnostic answers: 12 months, or immediate erasure upon simple request.
• GA4 analytics metrics: 14 months maximum.
• Claims and returns records: 3 years following case resolution.
6. Your Rights & Right to Erasure (Art. 15 to 22 GDPR)
Under the GDPR and the Belgian Act of 30 July 2018, you possess the following rights:
• Right of access (Art. 15) and Right to rectification (Art. 16) of your data.
• Right to erasure / Right to be forgotten (Art. 17): permanent deletion upon request.
• Right to restriction of processing (Art. 18) and Right to data portability (Art. 20).
• Right to object (Art. 21) and Right to withdraw consent (Art. 7.3).
To exercise any of these rights, contact us at contact@haircarebysunshine.com. Requests are acknowledged within 48 business hours and settled within 30 calendar days.
• Right of access (Art. 15) and Right to rectification (Art. 16) of your data.
• Right to erasure / Right to be forgotten (Art. 17): permanent deletion upon request.
• Right to restriction of processing (Art. 18) and Right to data portability (Art. 20).
• Right to object (Art. 21) and Right to withdraw consent (Art. 7.3).
To exercise any of these rights, contact us at contact@haircarebysunshine.com. Requests are acknowledged within 48 business hours and settled within 30 calendar days.
7. Data Security & Technical Measures
SUNSHINE CONSULTING SRL implements stringent technical and organizational measures (256-bit TLS encryption, strict role-based access control, secure cloud infrastructure) to safeguard personal data against alteration, accidental loss, unauthorized disclosure, or illicit access.
8. Supervisory Authority (APD / GBA Belgium)
If you consider, after contacting us, that your data rights have been infringed, you are entitled to lodge a formal complaint with the Belgian Data Protection Authority:
• Authority: Data Protection Authority (APD / GBA Belgium)
• Address: Rue de la Presse 35, 1000 Brussels, Belgium
• Phone: +32 2 274 48 00 — Email: contact@apd-gba.be
• Website: https://www.autoriteprotectiondonnees.be
• Authority: Data Protection Authority (APD / GBA Belgium)
• Address: Rue de la Presse 35, 1000 Brussels, Belgium
• Phone: +32 2 274 48 00 — Email: contact@apd-gba.be
• Website: https://www.autoriteprotectiondonnees.be