Data Protection (DPDP & GDPR)

This page explains your rights over the personal data 7StarSalons holds about you, and how to use them. Please read it together with our Privacy Policy.

1. India: DPDP Act, 2023 & DPDP Rules, 2025

As a Data Fiduciary, 7StarSalons processes your digital personal data only for a lawful purpose, with your consent or for a legitimate use allowed by law. Before we ask for consent, we tell you in clear, plain language what data we need and why. You can ask for this notice in English or in any language listed in the Eighth Schedule of the Constitution of India.

Your rights as a Data Principal

• Right to information (Section 11): a summary of the personal data we hold about you, how we process it, and who we have shared it with.
• Right to correction and erasure (Section 12): you can ask us to correct, complete or update inaccurate data, or erase data we no longer need.
• Right to withdraw consent (Section 6): you can withdraw consent at any time, as easily as you gave it. This does not affect processing already done before you withdrew.
• Right to grievance redressal (Section 13): you can raise a complaint with our Grievance Officer (details below).
• Right to nominate (Section 14): you can nominate someone to exercise your rights if you die or become unable to act.

Your duties (Section 15)

When you use your rights, please give accurate information, do not impersonate anyone, and do not file false or trivial complaints.

Complaints to the Data Protection Board

If our response does not resolve your grievance, you can complain to the Data Protection Board of India once you have first used our grievance process.

Children's data

For anyone under 18, we process personal data only with verifiable consent from a parent or lawful guardian. We do not track, monitor behaviour or target advertising at children.

Personal data breaches

If a breach affects your data, we will tell you without delay: what happened, the likely impact, what we are doing about it, and what you can do to protect yourself. We will also report it to the Data Protection Board of India as the DPDP Rules require.

2. EU/EEA & UK: GDPR

We are a local salon in India and do not target people in the European Union. If you are in the EU/EEA or UK and your personal data is covered by the GDPR (or UK GDPR), you have these rights:

• Access (Art. 15): get a copy of your personal data.
• Rectification (Art. 16): have inaccurate data corrected.
• Erasure / "right to be forgotten" (Art. 17): have your data deleted, subject to legal exceptions.
• Restriction (Art. 18): ask us to limit how we use your data.
• Portability (Art. 20): receive your data in a structured, machine-readable format.
• Objection (Art. 21): object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent (Art. 7): at any time, without affecting earlier lawful processing.
• No automated decisions (Art. 22): we do not make decisions about you using only automated processing or profiling.
• Complain: you can complain to the data protection supervisory authority in the country where you live or work.

The lawful bases we rely on and our international transfer safeguards are explained in sections 3 and 5 of our Privacy Policy.

3. AI and your personal data

• The AI-generated images on this website were created from text prompts. No client's photo, name or other personal data was used to create them.
• We do not upload client photos or personal data to AI tools unless the client has given explicit, written consent for that purpose.
• We do not use AI to profile clients or to make automated decisions that affect them.
• If you think an image on this website looks like you or uses your likeness, please contact us. We will review it and remove it promptly.

4. How to make a request

Send your request by email, phone, WhatsApp or in person at the salon. Tell us your name, the phone number or email you used with us, and which right you want to use. We may ask you to confirm your identity before we act, so that we don't disclose data to the wrong person.

We do not charge for requests. We aim to reply within 30 days (the GDPR time limit) and in every case within 90 days, as the DPDP Rules require.