Privacy Policy

1. Data controller

The controller of personal data is SC MEGASUNCONCEPT SRL, with its registered office in Timișoara, Str. Coriolan Brediceanu Nr. 2, Timiș County, tax ID RO39927445, registered with the Trade Registry under no. J35/3332/2018.

Controller contact details:

• Phone: +40 742 080 840
• Email: contact@megasunconcept.ro

Data Protection Officer (DPO): contact@megasunconcept.ro

This policy applies to data processing carried out through the megasunconcept.ro website, the online booking system, and the ongoing activities of the MegaSun Beauty House salon, in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR).

2. Data collected and its source

2.1. Data provided at online booking: first and last name, phone number, email address, requested service, preferred date and time.

2.2. Data provided when creating an account: first and last name, email address, and password (stored only as a hash; SC MEGASUNCONCEPT SRL cannot see the plain-text password).

2.3. Payment data: online transactions are processed by a third-party payment provider. SC MEGASUNCONCEPT SRL does not store and has no access to clients' card details; we receive only the transaction confirmation and the amount paid.

2.4. Browsing and cookie data: IP address, browser type, pages visited, session duration, cookie consent preference — collected automatically when the website is accessed. Details in the Cookie Policy (megasunconcept.ro/cookies).

2.5. Data collected in the salon: additional information may be collected on service preferences, allergies, or contraindications relevant to the safety of the service.

3. Purpose and legal basis of processing

3.1. Managing bookings and communicating with the client — legal basis: performance of the contract, under Article 6(1)(b) GDPR. The data is needed to confirm, change, or cancel appointments.

3.2. Creating and managing the user account — legal basis: performance of the contract, under Article 6(1)(b) GDPR.

3.3. Sending notifications about appointments (confirmations, reminders) — legal basis: performance of the contract, under Article 6(1)(b) GDPR.

3.4. Loyalty program and personalized offers — legal basis: the client's express consent, under Article 6(1)(a) GDPR. Consent can be withdrawn at any time.

3.5. Website traffic analysis via Google Analytics — legal basis: the user's express consent for analytics cookies, under Article 6(1)(a) GDPR. Analytics is enabled only after consent is given through the cookie banner.

3.6. Compliance with legal obligations (tax, accounting) — legal basis: legal obligation, under Article 6(1)(c) GDPR.

3.7. Defending the rights of SC MEGASUNCONCEPT SRL before courts or competent authorities — legal basis: legitimate interest, under Article 6(1)(f) GDPR.

4. Data recipients

4.1. The MegaSun Beauty House team — limited access to the data needed to manage bookings and provide services.

4.2. IT and hosting providers — technical access for maintaining and operating the platform, under data processing agreements that require providers to comply with GDPR.

4.3. The third-party payment processor — receives only the payment data strictly necessary to process the transaction, under a data processing agreement.

4.4. Google LLC — anonymized browsing data collected through Google Analytics, only with the user's consent. Google acts as an independent controller for data transmitted through its services.

4.5. Public authorities — where disclosure is required by law (e.g. tax or judicial authorities).

SC MEGASUNCONCEPT SRL does not sell or transfer personal data to third parties for commercial purposes.

5. Data retention period

5.1. Booking data (including service history): 3 years from the last interaction, a period justified by possible complaints or disputes.

5.2. Active account data: for the lifetime of the account. When an account is deleted, data is anonymized or erased within 30 days, except for data subject to a legal retention obligation.

5.3. Accounting and tax documents (invoices, receipts): 10 years, in accordance with Accounting Law no. 82/1991 and applicable tax rules.

5.4. Browsing data (technical logs): a maximum of 90 days.

5.5. Data collected via Google Analytics: according to the configured retention policy (14 months from last activity by default).

6. International data transfers

SC MEGASUNCONCEPT SRL uses services from providers based outside the European Economic Area:

6.1. Google LLC (USA) — Google Analytics services. The transfer relies on the Standard Contractual Clauses (SCC) adopted by the European Commission, under Article 46(2)(c) GDPR, and, where applicable, the EU-U.S. Data Privacy Framework.

Users who do not want their browsing data transferred to Google can decline analytics cookies through the consent banner or install the Google Analytics Opt-out browser add-on.

7. Rights of data subjects

Under GDPR, you have the following rights regarding your personal data processed by SC MEGASUNCONCEPT SRL:

7.1. Right of access (Article 15 GDPR): you can request a copy of the personal data we hold about you, including information on the purpose of processing and the data recipients.

7.2. Right to rectification (Article 16 GDPR): you can request correction of inaccurate data or completion of incomplete data.

7.3. Right to erasure / the “right to be forgotten” (Article 17 GDPR): you can request deletion of your personal data when it is no longer needed for the purpose it was collected for, when you withdraw your consent, or when the data has been processed unlawfully. This right does not apply where processing is necessary to comply with a legal obligation.

7.4. Right to restriction of processing (Article 18 GDPR): you can request the temporary suspension of processing of your data in certain situations (e.g. you contest the accuracy of the data or have objected to processing).

7.5. Right to data portability (Article 20 GDPR): you can request to receive the data you provided in a structured, commonly used, machine-readable format.

7.6. Right to object (Article 21 GDPR): you can object to the processing of your data for direct marketing purposes, or where processing is based on the controller's legitimate interests.

7.7. Right to withdraw consent (Article 7(3) GDPR): where processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

7.8. Right to lodge a complaint with the supervisory authority (Article 77 GDPR): if you believe your rights have been infringed, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), located at Bd. G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, email: anspdcp@dataprotection.ro, website: www.dataprotection.ro.

8. Exercising your rights

The rights listed in Article 7 can be exercised by:

• Sending an email to contact@megasunconcept.ro, with the subject line “GDPR Rights Request”, stating the right requested and your identifying details;
• The contact form available on megasunconcept.ro/contact.

SC MEGASUNCONCEPT SRL will respond to requests without undue delay and within one month of receiving the request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests; we will inform you of any such extension, and the reasons for it, within one month of receiving your request.

9. Minors

The MegaSun website and services are not aimed at persons under 16 years of age. We do not knowingly collect personal data from minors under 16 without the verifiable consent of the holder of parental authority, in accordance with Article 8 GDPR. If we learn that we have collected such data without the required consent, we will delete it immediately.

10. Data security

SC MEGASUNCONCEPT SRL implements appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or accidental destruction. Account passwords are stored only as hashes. Access to data is restricted to authorized staff.

11. Changes to this privacy policy

This policy may be updated periodically. The date of the last change is shown at the top of the document. Users are encouraged to check this page periodically. Significant changes will be communicated by email or through a notice on the website.

Contact

For any question about your personal data, you can reach us at:

• Email: contact@megasunconcept.ro
• Phone: +40 742 080 840
• Address: Str. Coriolan Brediceanu Nr. 2, Timișoara, Romania