Platform operator
Hairmarket Platform
- Registration number
- DEV-AE-0000001
- Registered address
- Dubai, United Arab Emirates (dev address), United Arab Emirates
Version 2 · in force from 28 October 2026
This policy explains what personal data the operator of the hairmarket marketplace processes, for what purposes and on what legal grounds, who receives it, how long it is kept and how you can use your rights. It is also the operator's document on the processing of personal data: the conditions below apply whenever you use the marketplace. The operator's name, registered details and contact address are shown at the top of this page.
Who is responsible for your data - The marketplace operator, whose details are shown at the top of this page, decides how personal data is processed on hairmarket and is responsible for it. - Each seller on hairmarket receives the data needed to fulfil your order with that seller and uses it for that purpose. Questions about how a seller handles your data can be sent to the seller from the order page or to the operator. - Person responsible for the organisation of personal data processing: [to be completed by the operator: name or role and contact].
What data we process ### Account - Name, e-mail address and phone number. - How you sign in: password (stored only as a one-way hash), one-time codes sent by e-mail or SMS, passkeys, sign-in with Google, Apple or VK when you choose it, and a second sign-in step through Telegram when you turn it on. - Security records: active sessions, sign-in history with IP address, device and browser type. - Preferences: language, region, currency, delivery preferences, saved addresses and pick-up points.
Orders and delivery - What you buy, from which seller, prices, discounts, taxes and duties, delivery method and the status history of each order. - Recipient name, phone number and delivery address or pick-up point. - Messages with sellers and with support about your order, returns, refund requests and claims, including photos you attach as evidence.
Payments - Payment method type, amount, currency, the result of the payment and the payment provider's reference. - Card details are entered on the payment provider's page or form and are processed by the provider; the marketplace does not receive or store full card numbers. - If you pay by bank transfer, the payment confirmation you upload and the details on it.
Your activity on the marketplace - Wishlist, comparison lists, saved searches, followed sellers and recently viewed items. - Reviews, questions and answers you publish, with the name you show publicly, and your votes on them. - Photos you upload to search for similar products (visual search). - Support tickets and chat messages with their attachments.
Technical data - IP address, browser and device type, the pages and requests our servers handle, and error reports. Error reports are cleaned of passwords, tokens and payment data before they are stored. - A security check against automated abuse (Cloudflare Turnstile) on sign-in and public forms. - Cookies and similar browser storage, as described on the "Cookies" page.
Why we process data and on what grounds - To create and run your account, take and deliver orders, accept payments and make refunds: necessary to perform the contract you enter into with us and with the sellers. - To keep accounting, tax and payment records and to answer lawful requests from authorities: necessary to comply with legal obligations. - To protect your account and the marketplace (sign-in checks, the security activity log, fraud and abuse prevention): our legitimate interest in a safe service, and necessary for the contract. - To answer your support requests and handle returns, refunds and claims: necessary for the contract and our legitimate interest in resolving disputes. - To send service messages about your orders, payments and account: necessary for the contract. - To send news, selections, offers and reminders about items left in your cart: only with your consent, which you can withdraw at any time. - To measure how the marketplace is used with analytics services: only with your consent given in the cookie notice. - Where Russian law applies, these grounds correspond to the performance of a contract to which you are a party, compliance with the law, and your consent (Federal Law No. 152-FZ "On Personal Data").
You do not have to give us data, but without the data needed for an order (recipient, address, contact phone) the order cannot be placed or delivered.
Who receives your data - The seller of an order receives the recipient's name, phone number and delivery address, the order contents and messages about the order. - Delivery services you choose (for example CDEK or DHL) receive the recipient's name, phone number, address and parcel details. - Payment providers that process the payment method you choose (for example Stripe, YooKassa or Sber) receive the payment data they need. - Service providers that run the marketplace for us under our instructions: database and file storage (Supabase), website hosting (Vercel), e-mail delivery (Resend), messaging (Telegram, only when you link it), security checks (Cloudflare), error monitoring (Sentry) and, only with your consent, analytics (PostHog, Google Analytics, Yandex Metrica). - Operator staff see data only as far as their work requires; their access is limited by role and recorded. - Authorities, courts and other bodies when the law requires it. - We do not sell personal data.
Current list of service providers with their countries: [to be completed by the operator].
Where your data is processed Some of the service providers above are located in other countries. When data is transferred abroad, the operator relies on the safeguards that the applicable law requires. [To be completed by the operator: the country where the main database is hosted, the countries data is transferred to, the safeguards used, and where personal data of users in Russia is recorded and stored.]
How long we keep data - Account data: while your account is open. After you delete the account, we keep only what the law or a pending dispute requires. - Orders, payments, refunds and invoices: for the period required for accounting and tax records [to be completed by the operator: period under the operator's law]. - Messages and evidence for returns, refunds and claims: until the request is closed and the period for disputes about it has passed [to be completed by the operator: period]. - Photos for visual search: up to one day. - Marketing consent and your choices about it: while the consent is in force and afterwards for as long as needed to prove it [to be completed by the operator: period]. - Security activity log: [to be completed by the operator: period]. - Data for which no period is set yet is kept no longer than its purpose requires and is then deleted or anonymised.
How we protect data - The connection to the marketplace is encrypted. - Passwords are stored only as one-way hashes; card details stay with the payment provider. - Files you upload are kept in private storage and opened only through short-lived links. - Staff access is limited by role, and every change to orders, money and accounts is recorded. - You can add a passkey or a second sign-in step in your security settings and sign out other devices at any time.
Your rights You can: - get a copy of your data and information about how it is processed; - correct inaccurate data; - ask us to delete your data or to restrict its processing; - object to processing based on our legitimate interest; - receive your data in a structured, machine-readable form; - withdraw your consent to marketing or analytics at any time; this does not affect processing that took place before; - complain to the data protection authority of your country (in Russia: Roskomnadzor).
How to use them: - Account › Security › Privacy: request a copy of your data or the deletion of your account. - Every marketing e-mail has an unsubscribe link; you can also change your choices in your account. - To change or withdraw your cookie choice, use "Cookie settings" at the bottom of every page (see the "Cookies" page). - For any other request, write to the support address at the top of this page.
We answer within the time the law sets: under Russian law within 10 working days (extendable by 5 working days with a reasoned notice), under the GDPR within one month (extendable by two months for complex requests). We may ask you to confirm your identity first.