Who is responsible
MagnaCore Ltd is the proposed controller for core Hairia account, platform, security, marketplace and product-improvement data. A salon or professional may be a separate controller for service delivery, client notes and marketing. Some business-software processing may be performed by Hairia as processor under a data-processing agreement.
The final notice will identify each controller, processor and contact route by market and feature.
Data Hairia may collect
Depending on role and features, Hairia may process identity, contact, account, professional history, portfolio, services, availability, booking, communication, location, device, security, payment-provider identifiers, ledger entries, support, consent and marketing-preference data.
Special-category data must not be collected without documented necessity, a valid legal condition, minimisation and access controls. Free-text fields must never receive card credentials.
Purposes and lawful bases
Data may create accounts, deliver bookings, show relevant professionals, administer businesses, prevent fraud, secure the platform, support payments, meet legal duties, improve Hairia and communicate service information.
The final processing record maps each purpose to contract, legal obligation, legitimate interests, consent or another lawful basis. Consent remains withdrawable where used.
Location and nearby discovery
Location may support nearby results, routes, travel estimates and commercial territory tools. Precise background location stays off unless a clearly explained feature needs it.
Users must know whether access is one-time, while using the app or background, and can change device or Hairia permissions.
Bookings and professional records
A booking may connect client, professional, salon, location, service, policy version, payment and provenance. Access is limited by role and responsibility.
Professional CV and passport information remains controlled by the professional. Verified metrics are shared according to visibility settings and lawful rules.
Payments and bank details
Payment and bank onboarding should use regulated provider interfaces. Hairia stores only identifiers, statuses, amounts and ledger information required to operate and reconcile.
Identity and fraud providers may require additional information under their notices and legal duties.
Commercial attribution
Hairia may record campaign, QR, referral, lead-source, territory and conversion events to prevent duplicates and calculate eligible commissions. Recruitment alone never creates a reward.
Attribution must be documented, time-limited where appropriate and available for authorised review and dispute.
AI and automated assistance
Hairia may use AI to interpret requests, suggest professionals, summarise information, identify booking risks and support communications. High-impact actions require confirmation or human review.
The final notice will explain applicable automated logic, consequences and rights. Hairia must not infer ethnicity from appearance to restrict service access.
Sharing and ecosystem partners
Data may be shared with the booked provider, authorised business users, payment, identity, hosting, communication and mapping providers, advisers, authorities where required and an ecosystem partner selected by the user.
Cross-platform sharing requires defined fields, purposes, agreements and logs. Common group relationships do not create unrestricted access.
Hosting, network and security providers
Hairia is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States, provides Hairia's content delivery network, DNS and protection. For security and caching purposes Cloudflare processes IP addresses and technical connection data. This transfer outside the UK and the European Union is covered by the EU-U.S. Data Privacy Framework and by standard contractual clauses.
International transfers
Before protected data leaves the UK or another region, Hairia must identify the destination, transfer mechanism, provider safeguards and supplementary measures.
Market features can remain disabled until safeguards are ready.
Retention and deletion
Hairia retains data only for documented operational, safety, tax, accounting, dispute and legal periods. Account deletion does not erase immutable financial events or legally required records.
A no-code retention register defines duration, owner, deletion or anonymisation and legal holds.
Choices and rights
Depending on law, people may request access, correction, deletion, restriction, objection, portability, consent withdrawal and review of certain automated decisions. Identity may need verification.
Marketing preferences remain separate from necessary service messages, and opt-outs must propagate to communication tools.
Cookies and device storage
Necessary storage may support security, sessions, language and theme. Analytics, personalisation and advertising require appropriate information and consent.
The final cookie notice will list technology, provider, purpose and duration and let users revisit choices.
Children and safeguarding
Hairia's minimum age and guardian rules must be defined before launch. Providers remain responsible for safeguarding, consent and professional requirements.
Images of minors require appropriate guardian consent and additional moderation.
Security and contact
Hairia will use role-based access, authentication, encryption where appropriate, logging, backups, supplier review and incident procedures proportionate to risk.
Until a dedicated privacy mailbox is activated, development enquiries can use the Hairia contact page. The production notice must provide the final privacy and regulator routes.