Privacy Policy

This Privacy Policy explains how Black Silva Hairdresser ("we", "us") collects, uses and protects your personal data when you use our website blacksilva.dk and book an appointment. We comply with the EU General Data Protection Regulation (GDPR) and Danish data-protection law.

1. What data we collect

• Booking data: your name, email address, phone number, chosen service, stylist, date and time.
• Payment data: processed securely by Stripe. We never see or store your full card details — Stripe handles them.
• Technical data: IP address and basic request data, used only for security (rate-limiting, abuse prevention).
• Local storage: your browser stores functional data (booking progress, a discount-code flag, your cookie choice) — see our Cookie Policy.

2. Why we use it and our legal basis

• To provide and confirm your booking and send confirmation/cancellation emails — legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• To take payment for your appointment — contract.
• To contact you about your appointment (including our emergency phone) — contract / legitimate interest.
• To secure the service (prevent spam and abuse) — legitimate interest (GDPR Art. 6(1)(f)).
• Marketing (e.g. discount codes), only where offered — consent, which you can withdraw at any time.

3. Who we share data with (processors)

We only share what is necessary, with trusted providers acting on our instructions:

• Stripe — payment processing.
• Resend — sending confirmation/cancellation emails.
• Cloudflare — our booking backend (Workers/KV) and security.
• Cloudflare Web Analytics — privacy-first, cookieless visitor statistics. It counts page views and visits in aggregate only; it uses no cookies and does not track or identify individual visitors.
• FulgerHost — website hosting.

We never sell your data. Some providers may process data outside the EU/EEA under appropriate safeguards (e.g. EU Standard Contractual Clauses).

4. How long we keep it

We keep booking data only as long as needed to provide the service and for our legitimate business/legal needs. Payment records may be retained by Stripe and for accounting purposes as required by Danish law (typically up to 5 years). Discount codes and temporary booking state expire automatically. You can ask us to delete your data at any time (subject to legal retention).

5. Your rights

Under the GDPR you have the right to: access your data; correct it; delete it ("right to be forgotten"); restrict or object to processing; data portability; and to withdraw consent at any time. To exercise any right, email blacksilvahd@gmail.com. We respond within one month.

6. Complaints

If you believe we have mishandled your data, you can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby — datatilsynet.dk.

7. Security

The site is served over HTTPS with strict security headers. Card data is handled by Stripe and never touches our site. Payment secrets live only on our secure backend.

8. Changes

We may update this policy; the "last updated" date shows the latest version.