Privacy Policy

International Platform — international.prohairlabs.com

Platform	international.prohairlabs.com
Legal Entity	Professional Hair Labs Ltd
Effective Date	June 2025

 

 

Professional Hair Labs Ltd is the data controller for personal data processed through international.prohairlabs.com (the 'Platform') in respect of users located in the European Economic Area (EEA), the United Kingdom, and other international jurisdictions.

 

Data Controller	Professional Hair Labs Ltd
Platform	international.prohairlabs.com
Privacy Contact	cs@prohairlabs.com
DPO / Data Enquiries	cs@prohairlabs.com
Registered Address	Scientific Cosmetix Business Park, Whitemill Industrial Estate, Wexford Town, Wexford, Ireland  Y35 X0TK

 

 

This policy is drafted in compliance with:

•        EU Regulation 2016/679 — General Data Protection Regulation (GDPR)

•        UK GDPR and the UK Data Protection Act 2018

•        EU ePrivacy Directive 2002/58/EC and national implementing legislation

•        Irish Data Protection Acts 1988–2018 (where Irish law applies as the lex fori)

•        Other applicable national data protection legislation in jurisdictions where we operate

 

Where the GDPR and UK GDPR impose different obligations, we comply with the stricter standard. Buyers located in jurisdictions outside the EEA and UK should note that equivalent protections are applied as a matter of company policy, even where local law may not require them.

 

The table below sets out the categories of personal data we collect, the purpose for which it is processed, and our lawful basis under Article 6 GDPR:

 

Data Category	Purpose	Lawful Basis (Art. 6 GDPR)
Identity & contact data (name, email, phone, business address)	Account registration, order processing, communications	Art. 6(1)(b) — Contract performance; Art. 6(1)(c) — Legal obligation
Professional credentials (licence number, regulatory status)	Trade buyer verification and compliance	Art. 6(1)(b) — Contract; Art. 6(1)(f) — Legitimate interests
Order and transaction data (products, quantities, invoices)	Order fulfilment, account management, financial records	Art. 6(1)(b) — Contract; Art. 6(1)(c) — Legal obligation (VAT/tax)
Payment data (last 4 digits; full data held by payment processor)	Payment processing and fraud prevention	Art. 6(1)(b) — Contract; Art. 6(1)(f) — Legitimate interests
Platform usage data (IP, browser, session data)	Platform security, analytics, fraud prevention	Art. 6(1)(f) — Legitimate interests
Marketing preferences and communication history	Trade marketing, product updates, newsletters	Art. 6(1)(a) — Consent; Art. 6(1)(f) — Legitimate interests
Cookie and tracking data	Platform functionality, analytics, targeted advertising	Art. 6(1)(a) — Consent (non-essential); Art. 6(1)(f) — Legitimate interests (essential)

 

 

Special Category Data

We do not seek to collect special category data as defined under Article 9 GDPR (including health data, biometric data, racial or ethnic origin, or religious beliefs). Professional licence numbers and trade credentials are not considered special category data under GDPR. If special category data is inadvertently provided, we will delete it without further processing.

 

Where we rely on legitimate interests (Art. 6(1)(f)) as our lawful basis, we have carried out a legitimate interests assessment (LIA) and concluded that our interests are not overridden by your fundamental rights and freedoms, having regard to:

•        The B2B commercial context — you are a professional business entity, not a vulnerable consumer

•        The reasonable expectations of trade buyers in a wholesale supply relationship

•        The proportionate and limited nature of the data processing involved

•        The technical and organisational safeguards we have implemented

 

A summary of our LIA is available on request by contacting dpo@prohairlabs.com.

 

As a global B2B operation, some of your personal data may be transferred to or accessed by recipients outside the EEA or UK. We ensure such transfers are protected by appropriate safeguards:

 

USA (HQ operations)	EU Standard Contractual Clauses (SCCs) — Module 1 or 2 as applicable; UK IDTA where UK data is involved
Cloud/infrastructure providers	SCCs with sub-processors; adequacy decision where applicable (e.g. Canada under PIPEDA)
Logistics/shipping carriers	SCCs or equivalent transfer mechanism; data minimisation (name and address only)
Payment processors	SCCs; PCI-DSS compliance; no financial data retained at HQ

 

 

A copy of our data transfer impact assessments (DTIAs) is available on request. Where an adequacy decision exists for the destination country, we rely on that decision as the transfer mechanism.

 

We retain personal data only for as long as necessary for the purposes set out in this policy, or as required by applicable law:

 

Account registration data	Duration of account + 7 years from account closure
Order and invoice records	7 years from transaction date (EU VAT / tax compliance)
Payment records	7 years from transaction date
Marketing consent records	Until withdrawal of consent + 1 year (proof of consent)
Cookie consent records	13 months from consent (ePrivacy Directive guidance)
Platform access logs	13 months (rolling)
Compliance documentation	As required by applicable EU/national regulation (min. 5 years)
Support and communications	3 years from last interaction

 

 

On expiry of the applicable retention period, data is securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for aggregated analytics purposes.

 

7.1 Processors and Sub-Processors

We engage the following categories of data processors who act under our instruction and are bound by data processing agreements (DPAs) under Article 28 GDPR:

•        Payment processor (Stripe Payments Europe Ltd) — payment processing

•        Cloud infrastructure providers — Platform hosting and storage

•        Logistics and shipping carriers (DHL, UPS, freight partners) — order despatch

•        CRM platform — account and relationship management

•        Email service provider — transactional and marketing communications

•        Web analytics provider (Google Ireland Ltd) — Platform performance analytics

 

A current list of sub-processors is available on request at dpo@prohairlabs.com.

 

7.2 No Sale of Personal Data

Professional Hair Labs Ltd does not sell, licence, or transfer personal data to third parties for their own commercial or marketing purposes.

 

7.3 Legal Disclosures

We may disclose personal data to competent authorities, courts, or regulators where required by EU law, national law, or court order, and only to the extent required. We will inform you of any such disclosure unless legally prohibited from doing so.

 

As a data subject under the GDPR or UK GDPR, you have the following rights, exercisable free of charge:

 

8.1 Right of Access (Art. 15)

You have the right to obtain confirmation of whether we process personal data about you, and if so, to receive a copy of that data and supplementary information about how it is used.

 

8.2 Right to Rectification (Art. 16)

You have the right to request correction of inaccurate or incomplete personal data we hold about you without undue delay.

 

8.3 Right to Erasure — 'Right to be Forgotten' (Art. 17)

You have the right to request deletion of your personal data where: it is no longer necessary for the purposes for which it was collected; you withdraw consent and there is no other lawful basis; you object and there are no overriding legitimate grounds; the data has been unlawfully processed; or deletion is required by EU/national law. This right is subject to exceptions, including where retention is required for legal compliance or the establishment, exercise, or defence of legal claims.

 

8.4 Right to Restriction of Processing (Art. 18)

You have the right to restrict our processing of your data in certain circumstances, including where you contest the accuracy of the data, object to processing, or require the data for legal claims.

 

8.5 Right to Data Portability (Art. 20)

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

 

8.6 Right to Object (Art. 21)

You have the right to object at any time to processing of your personal data based on legitimate interests (Art. 6(1)(f)), including profiling. We will cease processing unless we can demonstrate compelling legitimate grounds which override your interests, rights, and freedoms. You have an unconditional right to object to direct marketing at any time.

 

8.7 Rights in Relation to Automated Decision-Making (Art. 22)

We do not use fully automated decision-making (including profiling) that produces legal effects or similarly significant effects on you without human involvement. If this changes, we will notify you and ensure appropriate rights and safeguards are in place.

 

8.8 Right to Withdraw Consent (Art. 7(3))

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

 

8.9 How to Exercise Your Rights

Submit requests to:

•        Email: cs@prohairlabs.com

•        Subject line: 'GDPR Data Subject Rights Request'

•        Include: full name, account email address, and specify the right(s) you wish to exercise

 

We will respond within one calendar month. We may extend this by two further months for complex or multiple requests, with prior notice. We may need to verify your identity before processing your request. There is no fee for exercising your rights unless requests are manifestly unfounded or excessive.

 

8.10 Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority:

•        EU residents: the supervisory authority in your EU member state of residence, or the Irish Data Protection Commission (DPC) at dataprotection.ie

•        UK residents: the Information Commissioner's Office (ICO) at ico.org.uk

 

We would, however, appreciate the opportunity to address your concerns directly before you approach a supervisory authority. Please contact us at dpo@prohairlabs.com in the first instance.

 

We implement appropriate technical and organisational measures (TOMs) pursuant to Article 32 GDPR to ensure a level of security appropriate to the risk, including:

•        TLS 1.2+ encryption for all data in transit

•        Encryption of sensitive personal data at rest using AES-256 or equivalent

•        Role-based access controls and the principle of least privilege

•        Regular vulnerability assessments and penetration testing

•        Staff training and awareness programmes on data protection obligations

•        Data processing agreements with all sub-processors meeting Art. 28 requirements

•        Documented incident response procedures and breach notification protocols

 

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware (Art. 33 GDPR) and notify affected individuals without undue delay where the risk is high (Art. 34 GDPR).

 

We use cookies and similar tracking technologies on the Platform in accordance with the ePrivacy Directive and applicable national implementing legislation. Non-essential cookies require your prior informed consent. Full details are set out in our Cookie Policy, available on the Platform. The legal basis for cookie processing follows the lawful basis table in §3.

 

The Platform is not directed at persons under the age of 18. We do not knowingly process personal data of minors. If you become aware that a minor has provided us with personal data, please notify us at cs@prohairlabs.com and we will delete it promptly in accordance with Article 17 GDPR.

 

We may update this Privacy Policy to reflect changes in law, regulatory guidance, or our data processing activities. We will provide advance notice of material changes via the Platform and/or by email to registered account holders. Where required by law, we will seek fresh consent.

 

The version history of this Privacy Policy is maintained internally and the current version number is shown on the cover page. Previous versions are available on request.

 

This Privacy Policy is governed by Irish law and, where applicable, EU data protection law. Where the UK GDPR applies to a processing activity, UK law governs that activity. Nothing in this clause limits or affects your rights under applicable data protection law.

 

For all privacy-related enquiries, data subject rights requests, or to contact our Data Protection Officer:

 

General Privacy	cs@prohairlabs.com
Data Protection Officer	cs@prohairlabs.com
Subject Line	Privacy Policy Enquiry — international.prohairlabs.com
Registered Address	Scientific Cosmetix Business Park, Whitemill Industrial Estate, Wexford Town, Wexford, Ireland  Y35 X0TK
Response Time	Within 30 days of receipt of verified request (extendable by 2 months for complex requests)