Privacy Policy

This Privacy Policy explains how 7StarSalons ("we", "us", "our"), a unisex salon at Bhikhna Pahari More, near Style Bazaar, New Gupta Colony, Chak Musallahpur, Koiritola, Patna, Bihar 800006, collects and uses personal data when you visit 7starsalons.com, contact us, or book and receive our services.

We act as the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), and as the data controller under the EU General Data Protection Regulation ("GDPR") where it applies. Your specific rights are explained on our Data Protection (DPDP & GDPR) page.

1. Data we collect

This website has no sign-up forms and currently sets no advertising or analytics cookies. Fonts are served from our own website, not from third-party font services. If we add analytics or cookies in future, we will update this policy and ask for your consent where the law requires.

2. Why we use your data

• To book and deliver services: confirming appointments, sending reminders and carrying out treatments safely.
• For your safety: recording allergies or sensitivities so we can avoid products that may harm you.
• For billing and legal compliance: issuing invoices and keeping records required by tax and accounting laws.
• To answer your enquiries: replying to calls, WhatsApp messages and emails.
• For offers and updates: only if you have opted in. You can opt out at any time by replying "STOP" or contacting us.
• For website security: server logs help us detect abuse and keep the site working.

3. Legal basis

Under the DPDP Act, we process your personal data on the basis of your consent (which you give when you share your details with us for a stated purpose), or for legitimate uses allowed under Section 7, such as when you voluntarily provide data for a service, or when we must comply with law.

Under the GDPR, we rely on performance of a contract (your booking), legal obligation (tax records), consent (marketing messages and photographs) and legitimate interests (website security and service improvement).

4. Who we share data with

We do not sell or rent your personal data. We share it only with:

• Service providers (Data Processors) who act on our instructions, such as our website host (Vercel Inc.), messaging platforms (WhatsApp, operated by Meta Platforms), email providers, and billing or payment providers.
• Government or legal authorities, when required by law, court order or a lawful request.

When you contact us through WhatsApp, follow or message us on Instagram or Facebook, or open our location in Google Maps, those services also process your data under their own privacy policies.

5. International transfers

We are based in India and store data mainly in India. Some processors (for example our website host or messaging platforms) may process data in other countries. We transfer data outside India only as the DPDP Act and any Government restrictions allow. For visitors in the EU/EEA, transfers to India or elsewhere rely on appropriate safeguards such as Standard Contractual Clauses provided by those processors.

6. How long we keep data

• Enquiries that don't lead to a booking: up to 6 months.
• Client and appointment records: up to 3 years after your last visit, unless you ask us to delete them sooner.
• Invoices and payment records: for as long as Indian tax and accounting laws require (generally up to 8 years).
• Photographs: until you withdraw consent.
• Server logs: as set by our hosting provider, usually no more than 90 days.

When the purpose has been met and no law requires us to keep the data, we delete it or make it anonymous.

7. Security

We use reasonable security safeguards as the DPDP Rules require, including access controls on our booking and billing records, password-protected devices, HTTPS encryption on this website, and contracts with our processors. If a personal data breach happens, we will inform affected people and the Data Protection Board of India as the DPDP Act requires. Where the GDPR applies, we will also notify the relevant authority within 72 hours where required.

8. Children

We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or lawful guardian, as the DPDP Act requires. Appointments for minors must be made by a parent or guardian. We do not track, profile or target advertising at children.

9. Your rights

You can ask to access, correct, update or erase your data, withdraw consent, nominate someone to act for you, and raise a grievance. EU/EEA visitors also have GDPR rights such as data portability and the right to object. See Data Protection (DPDP & GDPR) for how to use these rights.

10. AI-generated images

Many images on this website are AI-generated or AI-enhanced. The people shown in them are not real clients or staff, and no personal data of any real person was used to create them. We will never put a client's photo into an AI tool without their explicit written consent. See Copyright & AI Images.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. If the changes are significant, we will post a notice on this website.

12. Contact & Grievance Officer