Privacy Policy

Controller and contact details

The salon ValeBarb, Palermo, Italy determines the purposes and means of processing for its services. Data enquiries: valerio955@gmail.com. Telephone: +39 3926352905.

Data and purposes

• Name, phone number, optional email, service, time and selected staff member: availability, bookings, changes, cancellations and service communications.
• Customer records, appointment history and relevant salon notes: managing the customer relationship. Do not enter health information, identity documents or other special categories of data in Beta free-text fields.
• Optional waiting list: contact details and requested availability to contact you if a slot opens. You can remove a request through its link or by contacting the salon.
• Optional account and personal area: access to your bookings, salon links and profile management. A TapTurn account is not required to book.
• IP address, access events, technical identifiers and logs: security, abuse and duplicate prevention, requests and error handling. Do not share personal access links.

Legal bases and required information

Booking data is processed to provide the requested service or take pre-contractual steps (GDPR Article 6(1)(b)); required fields are necessary to handle the request. Legal obligations rely on Article 6(1)(c), while security and the defence of rights rely on legitimate interests (Article 6(1)(f)), subject to the individual’s rights. Optional external content relies on consent (Article 6(1)(a)). Advertising consent is not required to book and service messages are not marketing.

Recipients

Authorised salon staff access the data needed for their duties. TapTurn provides the management software and processes salon data under an Article 28 GDPR agreement. TapTurn’s own customer account and platform security are covered by its platform privacy notice.

Vercel hosts the application; Supabase provides database, authentication and files; Resend is involved when transactional email is enabled. We do not sell data or disclose it to other salons. Providers are bound by data-protection contracts. Where processing involves transfers outside the EEA, Chapter V GDPR safeguards apply, such as adequacy decisions or standard contractual clauses. Ask the controller for information and a copy of the safeguards.

Retention

The Beta’s default schedule provides: bookings and customer records up to 24 months after completion or last interaction; unnecessary notes up to 12 months; waiting-list requests up to 90 days after closure or expiry; email metadata up to 90 days; security logs and audit records up to 12 months. These are maximum periods, not minimums; the salon may instruct shorter retention or justify a different need.

When a salon closes, the schedule provides 30 days for export and up to 90 days for returning and deleting ordinary data. Evidence of privacy requests and legal acceptances is retained separately for up to 5 years. Legal duties or disputes can require limited retention of necessary data. Erasure requests are assessed and carried out for the affected salon; these periods do not mean that every category is automatically deleted. Backups have restricted access, and subsequent erasures and revocations must be reapplied before a restored copy is used.

Cookies and maps

Technical sessions and preferences are described in the cookie notice. Google Maps is embedded only after a positive choice; until then a placeholder and external link may be shown. Refusing or withdrawing this choice does not prevent booking. Following an external link voluntarily subjects you to that website’s rules.

Rights and complaints

You may request access, a copy, rectification, erasure, restriction, portability and objection where GDPR provides, and withdraw consent without affecting prior lawful processing. Contact the salon above; proportionate identity verification may be required. A response is normally due within one month, subject to justified lawful extensions. You may complain to the Italian Data Protection Authority (Garante) or the competent supervisory authority. We do not make decisions with legal effects based solely on automated processing.

Beta text · 30 October 2026.