Privacy Policy
Effective Date: October 09, 2026 • Last Updated: October 12, 2026
At Ona Beauty Bar, we respect your privacy and are committed to protecting your personal data in accordance with the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR, and applicable United States privacy regulations. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website and use our booking or consultation services.
Your GDPR Rights at a Glance
If you are located in the European Economic Area (EEA) or the United Kingdom, you have specific legal rights regarding your personal data:
1. Data Controller Identity and Contact Details
For the purposes of the GDPR and other applicable data protection laws, the Data Controller responsible for the processing of your personal data is:
2. Categories of Personal Data We Collect
We collect personal data that you voluntarily provide to us when you submit a consultation request, book an appointment, or communicate with us, as well as technical data collected automatically:
- Identification & Contact Data: First name, last name, email address, phone number.
- Consultation & Service Inquiry Data: Event date, requested makeup services (e.g., Bridal, Special Event, Lessons), group size, personal preferences, and details submitted in your message.
- Technical & Usage Data: IP address, browser type and version, device identifiers, operating system, referring URL, time stamp, pages visited, and browsing behavior on our website.
- Consent & Communication Records: Timestamp of form submission, opt-in records for SMS or email updates, and email confirmation delivery metadata.
3. Legal Bases for Processing under GDPR (Article 6)
Under the GDPR, we only process personal data when we have a verified legal basis to do so. The applicable legal grounds include:
| Purpose of Processing | Categories of Data | GDPR Legal Basis |
|---|---|---|
| Responding to consultation requests & booking beauty services | Name, email, phone, service details, event notes | Article 6(1)(b) – Performance of a contract or steps taken prior to entering into a contract. |
| Delivering automated appointment confirmations & updates | Name, email, booking details | Article 6(1)(b) – Performance of a contract. |
| Direct marketing, promotional offers & SMS notifications | Email, phone number, consent record | Article 6(1)(a) – Freely given Consent (withdrawable at any time). |
| Website security, fraud prevention & debugging | Usage data, IP address, logs | Article 6(1)(f) – Legitimate interests (maintaining system security and performance). |
| Accounting, tax, and legal compliance | Financial transactions, client invoices | Article 6(1)(c) – Compliance with a legal obligation. |
4. Third-Party Service Providers and Sub-Processors
We do not sell or rent your personal information. To operate our website and deliver our services, we engage trusted third-party service providers ("Sub-processors") bound by data protection agreements:
- Resend (Resend Inc.): Used for transactional email delivery and template confirmations. When you submit an inquiry, your name, email, and inquiry variables are processed via Resend to deliver your confirmation.
- Vercel (Vercel Inc.): Cloud hosting, content delivery network (CDN), and serverless execution for our website.
- Zite / Fillout: Third-party embedded form service used to capture customer appointment inquiries.
5. International Data Transfers & Safeguards
Ona Beauty Bar is based in the United States, and our servers and service providers operate in the United States and other global regions.
If you access our Service from the European Economic Area (EEA), the United Kingdom, or Switzerland, your data will be transferred to and processed in the United States. Where required by GDPR Articles 44–49, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- Participation in the EU-U.S. Data Privacy Framework (DPF) where applicable;
- Contractual, organizational, and technical measures ensuring an equivalent level of protection.
6. Data Retention and Deletion Schedule
We adhere to the data minimization principle (GDPR Art. 5(1)(e)) and retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:
- Inquiries & Consultations: Retained for up to 24 months from your last interaction, allowing us to reference your service preferences for future bookings.
- Service & Billing Records: Retained for up to 7 years to comply with applicable US tax and legal recordkeeping mandates.
- Marketing & Consent Records: Retained until you unsubscribe or withdraw your consent.
- Server & Security Logs: Retained for a maximum of 12 months for diagnostic and defense purposes.
7. Your Rights under the GDPR (Articles 15–22)
If you reside in the EEA or UK, you possess the following statutory rights regarding your personal data:
1. Right to Access (Art. 15 GDPR)
You have the right to request confirmation as to whether your personal data is being processed and to receive a free copy of the personal data we hold.
2. Right to Rectification (Art. 16 GDPR)
You have the right to request immediate correction of inaccurate personal data or completion of incomplete information.
3. Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)
You have the right to request deletion of your personal data where it is no longer necessary, where you have withdrawn consent, or where unlawfully processed, subject to statutory retention obligations.
4. Right to Restriction of Processing (Art. 18 GDPR)
You have the right to restrict processing of your data while accuracy is verified or during an ongoing legal dispute.
5. Right to Data Portability (Art. 20 GDPR)
You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV or JSON) and transfer it to another controller.
6. Right to Object (Art. 21 GDPR)
You have the absolute right to object at any time to processing of your personal data for direct marketing purposes, or processing based on legitimate interests.
7. Right to Withdraw Consent (Art. 7(3) GDPR)
Where processing relies on your consent, you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
8. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)
You have the right to lodge a complaint with an EU data protection supervisory authority in your member state of habitual residence, place of work, or place of the alleged infringement. A directory is available at edpb.europa.eu.
8. How to Exercise Your Rights
To exercise any of your rights under GDPR or state privacy laws, contact us via email at:
Data Protection & Privacy Requests:
Email: hello@onabeautybar.com
We will respond to your verified request within 30 calendar days free of charge. In rare cases involving complex requests, we may extend this timeframe by up to an additional two months as permitted under GDPR Article 12(3).
10. Data Security
We implement robust technical and organizational security measures (GDPR Art. 32), including SSL/TLS 256-bit encryption for all web and API transmissions, restricted server access, encrypted secret storage, and regular security audits to safeguard your personal information against unauthorized access, loss, or alteration.
11. Automated Decision-Making and Profiling
We do not employ automated decision-making or profiling mechanisms (under GDPR Article 22) that produce legal or similarly significant effects concerning you.
12. Children's Privacy
Our services are directed to adults and young adults seeking beauty services. We do not knowingly collect personal data from children under 16 years of age without verified parental or guardian consent. If you believe a minor has submitted data without consent, please contact us immediately for prompt removal.
13. Contact Us
If you have any questions or concerns regarding this Privacy Policy or our privacy practices, please reach out to us:
- Business Name: Ona Beauty Bar
- Email: hello@onabeautybar.com
- Verified Mail Domain: mail.onabeautybar.com
- Phone: (502) 275-0802
- Location: Louisville, Kentucky, USA