Privacy policy
Last updated: 6 October 2026
This policy explains what personal data we use when you visit hqlashes.com, buy from us, enrol in a course, contact us or subscribe to our news: why we use it, on what legal basis, who we share it with, how long we keep it and what your rights are.
In short: we use your data to deliver your order, to reply to you and to comply with the law. We only use it for the newsletter, statistics and cookie-based ads with your consent. To show suitable ads to people who have bought from us before, or to exclude them from some ads, we use their email address and phone number based on our legitimate interest, and you can object at any time. We do not sell your data. For any question, write to us at contact@hqlashes.com.
Contents
- Who we are
- Who this policy applies to
- What data we use and where it comes from
- Why we use data, on what legal basis and how long we keep it
- Who we share data with
- Transfers outside the European Economic Area
- How we protect data
- Your rights
- Cookies and similar technologies
- Minors
- Links to other websites and social networks
- Changes to this policy
1. Who we are
The controller of your personal data is S.C. KAROL SUITES S.R.L., which runs the HQ Lashes online store.
| Company name | S.C. KAROL SUITES S.R.L. |
|---|---|
| Brand | HQ Lashes |
| Registered office | str. Fabrica de Chibrituri nr. 17-21, Bucharest, Romania |
| Tax registration code (CUI) | 48795432 |
| Trade Register number | J40/17333/2023 |
| contact@hqlashes.com | |
| Phone | +40 730 038 368, Monday–Friday, 09:00–17:00 (Romanian time) |
For any question about your data, you can write to us at contact@hqlashes.com.
2. Who this policy applies to
This policy applies to the data of people who buy from us, as well as of people who visit the website, subscribe to our news, enrol in courses or contact us by email, phone or WhatsApp. It does not apply to other companies’ websites and apps, even if you reach them through a link on our website.
3. What data we use and where it comes from
| Category | What it includes | Where it comes from |
|---|---|---|
| Identification and contact data | First and last name, phone, email, delivery and billing address | From you, when you order, enrol in a course or contact us |
| Billing data for businesses | Company name, tax code, company address | From you, at checkout |
| Order data | Products ordered, prices, discounts, payment and delivery method, order and return history | From your order; we receive the delivery status from the courier |
| Payment data | Payment confirmation, card type and its last digits. We never see or store your full card number. For refunds by bank transfer: the IBAN and the account holder’s name. | From the payment processor; the IBAN from you |
| Customer account | The email address you sign in with, saved addresses, orders | From you, if you create an account |
| Your messages | What you write to us by email, on WhatsApp or through the website forms, and what you tell us by phone, including about courses | From you |
| News subscription | Email address, phone number if you give it, and how you interact with the emails you receive, for example opens and clicks | From you and from the email platform |
| Reviews | Rating, text, photos and the display name you choose | From you, through the reviews app |
| Technical and browsing data | IP address, device and browser type, pages visited, products added to the cart, where your visit came from, for example an ad | Automatically, through cookies and similar technologies, as set out in our Cookie Policy |
We do not ask for or knowingly use sensitive data, for example health data. Please do not send us such data in your messages.
To conclude and perform the contract we need your name, address, phone number and email address. Without them we cannot take and deliver your order. Any other data you give us is optional.
4. Why we use data, on what legal basis and how long we keep it
The legal bases are those in Article 6(1) of Regulation (EU) 2016/679 (“GDPR”).
| Purpose | Legal basis | How long we keep the data |
|---|---|---|
| Taking your order, processing payment and delivering it; order messages (confirmation, shipping, tracking number); returns, refunds and the guarantee | Performance of the contract (point b) | For the duration of the order and the guarantee, then as long as needed for any complaints, up to 3 years. Accounting records are kept as long as the law requires (next row). |
| Invoicing, accounting and tax obligations, including sending invoices through the RO e-Factura system | Legal obligation (point c) | 5 years, counted from 1 July of the year following the end of the financial year, under Romanian Accounting Law no. 82/1991 |
| Customer account | Performance of the contract (point b) | Until you delete it or ask us to delete it, except for data the law requires us to keep |
| Course enrolment, agreeing the date and the certificate of attendance | Performance of the contract (point b) | For the duration of the course, then as long as needed for any complaints, up to 3 years |
| Replying to questions and complaints by email, phone or WhatsApp | Steps you take before ordering or performance of the contract (point b) and our legitimate interest in replying to you (point f) | As long as needed to resolve them, then up to 3 years, the general limitation period |
| News and offers by email (newsletter), including reminders about products you viewed | Your consent, given when you subscribe (point a) | Until you unsubscribe |
| Reminders about an order you started and did not complete, by email or WhatsApp | Our legitimate interest in helping you complete the order you started (point f). You can opt out of these messages using the link in the message or by writing to us. | Until you complete the order or opt out |
| Asking for a review after delivery and displaying reviews | Our legitimate interest, for the request (point f); you can object at any time using the link in the email. Your consent, for publishing your review (point a). | For as long as the review is displayed. We delete it if you ask us to. |
| Statistics about how the website is used | Your consent, given through the cookie banner (point a) | For the lifetime of each cookie, as set out in our Cookie Policy |
| Relevant ads on Facebook, Instagram, Google and TikTok and measuring their results | Your consent, given through the cookie banner (point a) | For the lifetime of each cookie. Data received by the platforms is kept under their own policies. |
| Showing suitable ads to people who have bought from us before, or excluding them from certain ads, using their email address and phone number sent in hashed (pseudonymised) form | Our legitimate interest (point f). You can object at any time by writing to contact@hqlashes.com. | Until you object |
| Browser (push) notifications | Your consent, given in your browser (point a) | Until you turn them off in your browser settings |
| Website security and fraud prevention | Our legitimate interest (point f) | As long as needed for this purpose |
| Defending our rights in complaints or legal disputes | Our legitimate interest (point f) | Until they are finally resolved |
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
5. Who we share data with
We only share the data needed for each purpose, with providers who work for us or who are involved in your order:
| Recipient | What they do | Their privacy policy |
|---|---|---|
| Shopify International Limited (Ireland) | The store platform: website, cart, checkout, customer account, order emails and reminder emails | shopify.com/legal/privacy |
| Shopify Payments, with the processor Stripe Payments Europe, Limited (Ireland) | Card and Google Pay payments | stripe.com/en-ro/privacy |
| Our bank | Bank transfer payments and refunds | – |
| Cargus | Delivery in Romania | cargus.ro |
| DPD Romania | Delivery to the other European Union countries | dpd.com/ro |
| xConnector | Issuing tracking numbers (AWB) and tracking parcels | – |
| Oblio | Issuing invoices | – |
| Romanian National Agency for Fiscal Administration (ANAF) | Receiving invoices through the RO e-Factura system, as required by law | – |
| Omnisend (UAB Omnisend) | Newsletter and automated emails | omnisend.com/privacy |
| CK: WhatsApp, by CartHike | The WhatsApp button on the website and WhatsApp messages about your cart and order | – |
| WhatsApp Ireland Limited (Meta) | Our conversations with you on WhatsApp | whatsapp.com |
| Brevo PushOwl | Browser notifications, only with your consent | – |
| Judge.me | Review requests and displaying reviews | judge.me/privacy |
| Meta Platforms Ireland Limited | Ads on Facebook and Instagram and measuring them | facebook.com/privacy |
| Google Ireland Limited | Google Ads, Google Analytics and Google Merchant Center | policies.google.com |
| TikTok Technology Limited (Ireland) | Ads on TikTok and measuring them | tiktok.com |
| Other store apps | Features such as cash on delivery, showing suitable payment methods, language and currency, or automating internal tasks | – |
| Our accountant, legal advisers, public authorities and courts | When necessary or required by law | – |
Providers that process data on our behalf, for example Shopify, Omnisend, Oblio, xConnector or Judge.me, only use it for the services they provide to us and are contractually bound to protect it. The couriers, the bank, the payment processor, ANAF, WhatsApp, Meta, Google and TikTok also use the data as independent controllers, under their own policies. We do not sell your personal data.
6. Transfers outside the European Economic Area
Some of the providers above, for example Shopify, Stripe, Google, Meta or TikTok, may also process data outside the European Economic Area, for example in Canada or the United States. In these cases, the transfer is based on an adequacy decision of the European Commission, for example for Canada or for companies certified under the EU-U.S. Data Privacy Framework, or on standard contractual clauses approved by the European Commission. You can ask for a copy of these safeguards by writing to contact@hqlashes.com.
7. How we protect data
- The website uses an encrypted connection (HTTPS).
- Card payments are processed on Shopify’s infrastructure, certified under the PCI DSS security standard.
- Only the people and providers who need your data for the purposes above have access to it.
- We only work with providers that offer security and confidentiality guarantees.
- If a security incident occurs that may affect your data, we report it to the Romanian data protection authority (ANSPDCP) within 72 hours and also inform you where the law requires it.
8. Your rights
| Right | What it means |
|---|---|
| Right of access | To find out whether we use your data and to receive a copy of it. |
| Right to rectification | To have incorrect or incomplete data corrected. |
| Right to erasure | To have your data deleted when we no longer need it or no longer have a legal basis. Data the law requires us to keep, for example invoices, is deleted at the end of the legal period. |
| Right to restriction | To have your data used only in a limited way, for example while we check whether it is accurate. |
| Right to data portability | To receive the data you gave us in a structured format, or to have us send it to another company. |
| Right to object | To object to the use of your data based on our legitimate interest. You can object to direct marketing at any time, without giving a reason. |
| Withdrawing consent | At any time, without affecting the use of your data before that. |
| Automated decisions | Not to be subject to a decision based solely on automated processing. We do not make such decisions. |
| Right to lodge a complaint | With ANSPDCP or with the data protection authority of the EU country where you live. |
To exercise your rights, write to us at contact@hqlashes.com. We reply free of charge within one month of receiving your request. If your request is complex, this period may be extended by two more months, and we will let you know. We may ask you for additional information to make sure the request comes from you.
ANSPDCP contact details: B-dul G-ral. Gheorghe Magheru 28-30, sector 1, postal code 010336, Bucharest, Romania; email anspdcp@dataprotection.ro; www.dataprotection.ro.
9. Cookies and similar technologies
We use strictly necessary cookies to make the store work, and statistics and marketing cookies only if you agree. The full list, how long each cookie lasts and the button to change your choice at any time are in our Cookie Policy.
10. Minors
Our website and products are intended for adults, mainly lash technicians and salons. We do not knowingly collect data about people under 16. If you find out that a minor has sent us personal data, write to us and we will delete it.
11. Links to other websites and social networks
Our website links to Instagram, Facebook, TikTok, WhatsApp and other websites. They have their own privacy policies, which we encourage you to read. When you message us on Instagram, Facebook or WhatsApp, your data is also used by Meta, under its own policy.
12. Changes to this policy
When we change this policy, we publish the new version here, with the date of the last update. If the changes are significant, we will also let you know by email, if we have your address.
Questions?
Write to us at contact@hqlashes.com or call us on +40 730 038 368, Monday–Friday, 09:00–17:00 (Romanian time).
