What is the purpose of this Privacy Policy?
Alopy, the company behind hairdex.com, treats the protection and confidentiality of your personal data as a priority: for us, it is a matter of trust and of professional integrity.
This Privacy Policy sets out how we make sure that the applicable data protection rules are respected within Alopy, and in particular those of the General Data Protection Regulation ("GDPR").
Its purpose is to explain how and why we process your personal data in connection with the services we provide to you.
Who is this Privacy Policy for?
This Privacy Policy applies to you wherever you live, provided that you are at least 18 years old, whether you are a customer, a healthcare professional, an applicant for a position at Alopy, or simply a visitor to the hairdex.com website.
If you are below the legal age indicated above, you may not use our services without the prior and explicit consent of a parent or legal guardian, which must be sent to us by email to legal@hairdex.fr.
If you believe that we hold personal data relating to your children without your consent, please contact us at the address given above.
Why do we process your personal data, and on what legal basis?
We process your personal data mainly for the following purposes:
- to let you browse our website, use our services and allow us to answer your requests (for example, requests for information or complaints), on the basis of our terms of use and our legitimate interest in providing you with the best possible service;
- to run our customer service, on the basis of the performance of the contract and our legitimate interest in dealing as effectively as possible with your requests and complaints;
- to manage invoicing and any unpaid amounts, on the basis of our legitimate interest in receiving payment for the service we provide and on the basis of our general terms and conditions;
- to let you follow us and comment on our posts on social media, on the basis of our legitimate interest in running a dedicated page on social networks;
- to let you use our live chat, on the basis of our legitimate interest in communicating easily with you;
- to send you our newsletter, which keeps you informed about our services, on the basis of our legitimate interest in building customer loyalty and, if you are not yet a customer of ours, on the basis of your consent;
- to handle applications for a position at Alopy, on the basis of the exchanges we have with you during the recruitment process and our legitimate interest in recruiting and selecting candidates;
- to make the videos on our website work, on the basis of our legitimate interest in offering you content in video format;
- to let you book an appointment with our teams, on the basis of our legitimate interest in giving you a simple way to reach us;
- to allow documents to be downloaded, on the basis of our terms of use;
- to send satisfaction surveys, on the basis of our legitimate interest in improving our services.
How did we obtain your personal data?
Your data is collected directly from you, whether you are a customer of our services or simply a visitor to the hairdex.com website, and we undertake to process it only for the purposes described above.
Where you voluntarily post content on the pages we run on social networks, you acknowledge that you are entirely responsible for any personal information you may share, whatever the nature and origin of that information.
What personal data do we process, and for how long?
- Identification data (such as first name and surname) and contact details (such as your email address): kept for as long as the service is provided, plus the period we need to meet our legal obligations and to deal with any dispute.
- Financial data (such as bank account number or verification code): kept for the time needed to complete the transaction and to manage invoicing and payments, plus the period we need to meet our legal obligations.
- Email address used to receive our newsletter: kept until you unsubscribe.
- Information contained in your CV and covering letter: kept for the duration of the recruitment process, then for 2 years from the date of your application.
- Statistical data on the viewing of our videos: anonymised and kept without time limit.
- Connection data (such as logs and IP address): kept for 1 year.
- Cookies: generally kept for a maximum of 13 months. For more detail on how we use cookies, please see our Cookie Policy, available at any time on our website.
- Health data collected when you complete the Hairdex questionnaire about your hair loss: kept for as long as you use our services.
Once the applicable retention periods have expired, the deletion of your personal data is irreversible and we will no longer be able to provide it to you. At most, we may keep anonymised data for statistical purposes.
In the event of a dispute, we are required to keep all of your personal data for as long as the matter is being handled, even beyond the retention periods described above.
What rights do you have to control the use of your personal data?
Applicable data protection law gives you specific rights, which you may exercise at any time and free of charge, to control the use we make of your data:
- The right of access to your personal data and to obtain a copy of it, provided that the request does not conflict with trade secrets, confidentiality or the secrecy of correspondence.
- The right to have personal data corrected where it is inaccurate, out of date or incomplete.
- The right to object to the processing of your personal data where it is based on our legitimate interest, unless there are compelling legitimate grounds for the processing that override your interests, rights and freedoms.
- The right to erasure (the "right to be forgotten") for personal data that is not essential to the proper functioning of our services.
- The right to restriction of processing, which allows the use of your data to be frozen where the lawfulness of a processing operation is contested.
- The right to data portability, which allows you to retrieve part of your personal data in order to store it or transfer it easily from one information system to another.
- The right to give directions on what happens to your data after your death, either yourself or through a trusted third party or a person entitled to act on your behalf.
For a request to be considered, it must come directly from you or from your representative, and be sent to legal@hairdex.fr.
Requests may not come from anyone other than you or your representative. We may therefore ask you for proof of identity if there is any doubt as to the identity of the person making the request, together with evidence of authority to act on your behalf.
We will respond as quickly as we can, and within one month of receiving your request at the latest, unless the request is technically complex or we receive a large number of requests at the same time. In that case, the response time may extend to three months.
We reserve the right to refuse to act on requests that are manifestly excessive or unfounded, in particular because they are repetitive.
Who can access your personal data?
Your personal data is processed by our teams and by our technical service providers, for the sole purpose of operating our service.
We check all our technical service providers before appointing them, to make sure they strictly comply with the applicable data protection rules.
WE ALSO GUARANTEE THAT WE NEVER TRANSFER OR SELL YOUR DATA TO THIRD PARTIES OR COMMERCIAL PARTNERS.
Our services in your country are currently limited to the online hair loss assessment and to registration on a waiting list. Your data is therefore not passed on to any doctor or pharmacy. We will update this Policy as soon as new services become available that involve sharing your data with third-party healthcare professionals.
Can your personal data be transferred outside the European Union?
The personal data processed by our Hairdex platform is hosted on servers located in France. We have chosen sovereign hosting in order to guarantee the highest level of confidentiality and protection for your data, in full compliance with the General Data Protection Regulation (GDPR) and the recommendations of the French supervisory authority.
Should we use technical tools located outside the European Union, we guarantee that they strictly comply with the applicable rules on data transfers, so that your personal data remains adequately protected.
How do we protect your personal data?
We put in place all the technical and organisational measures required to keep your personal data secure on a day-to-day basis and, in particular, to guard against any risk of destruction, loss, alteration or unauthorised disclosure.
Do we use cookies when you browse our website?
We use cookies when you browse our website. For more information, please see our Cookie Policy.
Who can you contact for more information about the use of your personal data?
To give your data the best possible protection and integrity, we have formally appointed an independent Data Protection Officer ("DPO"), registered with our supervisory authority.
You can contact our DPO at any time and free of charge at legal@hairdex.fr for more information or detail on how we process your data.
How can you contact the data protection authority?
As Alopy is established in France, the lead supervisory authority for our processing activities is the CNIL (Commission Nationale de l'Informatique et des Libertés), which can be reached at: Service des plaintes de la CNIL, 3 place de Fontenoy – TSA 80751, 75334 Paris Cedex 07, France, or by telephone on +33 1 53 73 22 22.
If you live in the European Union or the European Economic Area, you also have the right to lodge a complaint with the supervisory authority of your country of residence. The full list of national authorities is published by the European Data Protection Board at www.edpb.europa.eu.
Can this Privacy Policy be changed?
We may amend this Privacy Policy at any time in order to adapt it to new legal requirements and to any new processing activities we may introduce in the future.