Privacy policy

This document is a translation provided for information purposes only. The Romanian version is the sole legally binding version and prevails in the event of any discrepancy.

Article 1. Definitions

(1) For the purposes of this Privacy Policy (the "Policy"), the following terms have the meanings set out below:

• a) "GDPR": Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;
• b) "DSA": Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services;
• c) "KYRO": to complete: company name, the operator of the Platform, identified in Article 2;
• d) "the Platform": the Kyro App, Kyro Studio and the KYRO web app, together with their associated services;
• e) "the Kyro App": the mobile application intended for Clients;
• f) "Kyro Studio": the application intended for Salons and Team Members;
• g) "the Website": the presentation website on which KYRO's legal documents, including this Policy, are published;
• h) "User": any natural person who accesses or uses the Platform or the Website;
• i) "Client": a User who uses the Kyro App to search for and book Salon Services;
• j) "Salon": the professional (legal person, authorised natural person, sole or family enterprise or other authorised form of organisation) that registers its business in Kyro Studio and provides Salon Services;
• k) "Owner": the Team Member who registered the Salon or to whom that capacity was subsequently transferred, and who represents the Salon in its dealings with KYRO;
• l) "Team Member": a natural person added by a Salon in Kyro Studio with one of the roles Owner, Manager, Specialist, Booth Renter (Chiriaș) or Reception;
• m) "Salon Service": the beauty, personal care or barbering service provided by a Salon to a Client;
• n) "Account": the User's personal account in the Kyro App or in Kyro Studio;
• o) "Booking": an appointment for a Salon Service, made by the Client through the Kyro App or recorded by the Salon in Kyro Studio;
• p) "Review": the assessment published by a Client about a Salon and, optionally, about a Specialist;
• q) "Client Rating": the score from 1 to 5 and the comment that a Salon may give a Client after the date of a Booking, including one marked as a no-show;
• r) "Client Record": the record that a Salon keeps in Kyro Studio about a Client;
• s) "Subscription Plan": an offer by a Salon (or by a Specialist, approved by the Salon) of monthly sessions for a monthly price, contracted by the Client with the Salon;
• t) "the Kyro Studio Subscription": the monthly fee payable by a Salon to KYRO;
• u) "Loyalty Programme": a programme run by a Salon (or by a Specialist, with the Salon's approval) under which the Client collects points for visits;
• v) "KYRO Administrator": a person authorised by KYRO to have administrative access to the Platform;
• w) "EEA": the European Economic Area;
• x) "Specialist": a Team Member who actually provides the Salon Service and whom the Client may choose when making a Booking.

(2) The terms "personal data", "processing", "data subject", "controller", "processor", "recipient", "consent" and "personal data breach" have the meanings given in Article 4 GDPR.

(3) This Policy is an information notice under Articles 13 and 14 GDPR. It is not a contract and is not subject to acceptance. The contractual conditions for using the Platform are set out in the Terms and conditions for clients (the "Terms") and the Terms and conditions for salons.

Article 2. Identity and contact details of the controller

(1) The controller of the personal data processed under this Policy, except in the cases set out in Article 4(1)(b) and (c), is to complete: company name, with its registered office at to complete: registered office, registered with the Trade Register under no. to complete: trade register number, tax identification code (CUI) to complete: tax ID (CUI), EUID to complete: EUID. KYRO's full identification details are published in the Legal notice.

(2) Requests and questions concerning personal data must be sent to [email protected]. For any other matter, KYRO may be contacted at [email protected] or by telephone on to complete: phone.

(3) KYRO has not designated a data protection officer since, at the date of this Policy, it is not in any of the situations set out in Article 37(1) GDPR. Requests sent under paragraph (2) are handled directly by the person designated by KYRO to deal with data protection.

Article 3. Scope

This Policy applies to the processing of personal data carried out through:

• a) the Kyro App (iOS), through which the Client searches for salons on a map, makes and cancels Bookings, receives reminders, collects points in Loyalty Programmes, requests Subscription Plans paid at the Salon and publishes Reviews; the Android version, which is in preparation, will be subject to the same rules;
• b) Kyro Studio, used by Team Members with the roles Owner, Manager, Reception, Specialist and Booth Renter;
• c) the KYRO web app (kyro.nicolas-tech.com);
• d) the Website.

Article 4. Controller and processor roles

(1) There are three distinct processing situations on the Platform, as follows:

(2) The relationship between KYRO and Salons concerning the processing referred to in paragraph (1)(c) is governed by the Data processing agreement.

Article 5. Categories of personal data processed

(1) KYRO processes the following data provided directly by the User:

• a) when the Account is created: first and last name, email address, mobile telephone number and password; the password is stored solely in cryptographic form and cannot be read by KYRO; the telephone number is requested so that the Salon can contact the Client if a Booking changes;
• b) the confirmation that the User is at least 16 years old and the acceptance of the Terms, together with the version accepted and the time of acceptance;
• c) optionally, a profile photo;
• d) when a Booking is made: the Salon, the service, the Specialist, the date and the time; in the event of cancellation, the time of cancellation;
• e) when a Review is published: the score given to the Salon, optionally the score given to the Specialist, and the comments, each comment being limited to 1,000 characters;
• f) when content is reported: the reason for the report, the content concerned, the name and email address of the person reporting and that person's good-faith statement;
• g) when a Salon or a Review author is blocked: the identity of the blocked Salon or author;
• h) when KYRO is contacted: the content of the message and the sender's contact details.

(2) KYRO processes the following data received from Salons:

• a) Bookings made by the Salon for the Client, the status of the visit (including "completed" or "no-show") and cancellations made by the Salon;
• b) the Client Record kept by that Salon, as described in Article 4(1)(c);
• c) the Client Rating, consisting of a score from 1 to 5 and, optionally, a comment of no more than 500 characters;
• d) the loyalty points awarded and the Subscription Plans recorded (the plan, the months paid, the sessions used, and the amount and payment method noted by the Salon).

(3) KYRO processes the following technical data:

• a) the IP address and the time of certain sensitive actions, including requests for a sign-in code, in order to limit abuse;
• b) the device's push notification token, only if the User has accepted notifications;
• c) 4-character sign-in codes, stored solely as a cryptographic fingerprint until they expire.

(4) KYRO does not collect personal numeric codes (CNP), does not process card payments, does not store card details and does not build marketing profiles. The Salon Service is paid for directly at the Salon. The Platform and the Website do not use traffic analytics, advertising or tracking tools.

(5) If the User grants the Kyro App access to the device's location, the location is used solely on the device, to display nearby salons and calculate distances. KYRO does not send the location to its servers and does not store it. The map in the iOS app is provided by Apple (Apple Maps), which receives the map requests sent by the device.

(6) If the User turns on calendar syncing, the Kyro App adds Bookings to the device's calendar and updates them whenever they change. Access to the calendar takes place solely on the device; KYRO does not read the User's calendar.

Article 6. Purposes, legal bases and retention periods

(1) KYRO processes personal data for the purposes, on the basis of the GDPR provisions and for the periods set out in the table below:

(2) When the periods set out in paragraph (1) expire, the data is deleted automatically by a scheduled procedure that runs every day. Messages received by email are deleted manually. By way of exception to the periods set out in paragraph (1), the data concerning a Salon whose contract with KYRO has ended, for whatever reason, including the Bookings, loyalty points, Subscription Plans and Client Ratings, is deleted when 30 days have elapsed since the contract ended, the Salon being permanently closed no later than on the date on which the contract ends, in accordance with the Personal data processing agreement.

(3) For processing based on legitimate interest, KYRO has weighed the interests pursued by KYRO and by Salons (the security of Accounts, the reduction of no-shows and abusive behaviour, trust in the Platform) against the rights and freedoms of data subjects. The data subject has the right to object to such processing at any time, in accordance with Article 13(1)(f) of this Policy.

(4) The name, email address and telephone number are necessary for entering into the contract for the use of the Kyro App and so that the Salon can contact the Client about the Booking. Without this data KYRO cannot create the Account. Salons can be browsed without an Account.

(5) KYRO does not take decisions based solely on automated processing which produce legal effects concerning the data subject or similarly significantly affect the data subject, within the meaning of Article 22 GDPR. The order of salons in search results is determined automatically, according to the criteria set out in Salon ranking criteria. The automatic language filter may reject a text before publication, in accordance with the Terms and conditions for clients; in that case the User may rephrase the text. Reports are in all cases reviewed by natural persons.

Article 7. Allergy notes (data concerning health)

(1) A note about a Client's allergy, including to hair dye or latex, is data concerning health and belongs to the special categories of data referred to in Article 9 GDPR. A Salon may record such a note in the Client Record solely for the purpose of protecting the Client's health at subsequent visits.

(2) The controller of this data is the Salon. KYRO acts solely as processor.

(3) A Salon may record allergy notes only on the basis of the Client's explicit consent, in accordance with Article 9(2)(a) GDPR. Before the note is saved, the Team Member is required to tick, in Kyro Studio, the fixed-wording confirmation by which they attest that they have requested and obtained the Client's consent. KYRO records the identity of the Team Member who ticked the confirmation and the time at which it was ticked. Each entry in this record is kept for as long as the Client Record exists, but for no less than 3 years from the date of the entry.

(4) The note is visible solely to the Team Members who have access to the Client Record, namely the Owner, the Managers, the persons with the Reception role and the Team Members with the Specialist or Booth Renter role who have at least one Booking, past or future, with the Client.

(5) Data concerning health is recorded solely in the field intended for allergies. The Salon's internal notes and Client Ratings must not contain data concerning health.

(6) The Client may withdraw consent at any time by asking the Salon or KYRO to delete the note. A request by the Client to delete the note constitutes withdrawal of consent. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

(7) When the Account is deleted in the Kyro App, KYRO deletes the allergy notes linked to the Account at every Salon.

(8) KYRO does not use this data for ranking salons, for marketing, for statistics or for any purpose other than the one set out in paragraph (1).

Article 8. Client Ratings given by Salons

(1) After the date of a Booking, including one marked as a no-show, a Salon may give the Client a Client Rating, consisting of a score from 1 to 5 and, optionally, a comment. The Client Rating forms part of the Client Record kept by that Salon.

(2) The Client Rating is visible solely to the Salon that gave it and to the Client. KYRO does not make it accessible to other Salons and does not compile, on the basis of Client Ratings, a profile of the Client shared across several Salons.

(3) The Client may view the Client Ratings received in the Kyro App, in the "Cum te văd saloanele" (How salons see you) section, and may report them from that section, using the "Raportează" (Report) function, if they are inaccurate, offensive or contain data unrelated to the visit, including data concerning health. KYRO reviews the report within no more than 24 hours of receiving it and, if the report is well founded, removes the comment.

(4) The Client has the right to object to this processing, under Article 21 GDPR, and the right to request rectification of the data, under Article 16 GDPR, by a request addressed to the Salon or to KYRO; a request addressed to KYRO is sent to [email protected].

(5) Client Ratings are kept for 2 years from the date on which they were given and are deleted automatically when that period expires.

(6) Salons are required to include in a Client Rating solely factual and respectful remarks about the visit, without data concerning health, private life or other special categories of data. Comments are subject to the same automatic language filter as Reviews.

Article 9. Recipients of the data and international transfers

(1) KYRO does not sell or rent out personal data. The data is disclosed solely to the following recipients:

• a) the Salon with which the Client makes the Booking and its Team Members: the Booking details, the Client's name and contact details, the Client's Review of that Salon and the reply to it;
• b) the public: Reviews are displayed on the Salon's page together with the first name and the initial of the surname of their author;
• c) KYRO's providers, acting as processors, which process the data solely on KYRO's instructions and under a contract, as set out in the table in paragraph (2);
• d) public authorities, solely where the law requires KYRO to make the disclosure, including at the request of a court or a competent authority, or where KYRO is required to notify a criminal offence involving a threat to the life or safety of a person, under Article 18 DSA;
• e) KYRO's advisers (lawyers, accountants), who are bound by a duty of confidentiality, where the disclosure is necessary for the establishment, exercise or defence of legal claims or for compliance with legal obligations;
• f) a potential acquirer of the business, in the event of a merger or sale, which is required to comply with this Policy; KYRO informs Users before the data is disclosed.

(2) The KYRO providers that receive personal data are the following:

(3) KYRO does not process Clients' card payments and does not store card details. The Salon Service is paid for directly at the Salon. The Kyro Studio Subscription is paid solely by Salons, on the web, and never in the app.

(4) The Platform's database is hosted in London, in the United Kingdom, a country for which the European Commission has adopted an adequacy decision valid until 27 December 2031. Transfers to providers established in the United States are based on their certification under the DPF or, in the absence of such certification, on the standard contractual clauses approved by the European Commission, included in the data processing agreements concluded with those providers. The data subject may at any time request a copy of the safeguards applied, at [email protected].

Article 10. Data of Team Members (Kyro Studio)

(1) For the Kyro Studio Account, KYRO processes the following data of the Team Member: name, email address, telephone number, photo, role in the team, the Salon or Salons in which they work, the invitations received (which expire 7 days after they are issued), working hours, the time off blocked (the related note being visible solely to the team, never to Clients), the reports made and, for Specialists, the professional profile (title, description, specialities, years of experience, Instagram account).

(2) When a Salon is registered, KYRO keeps, together with the version and the time of acceptance, the acceptance of the Terms and conditions for salons and of the Data processing agreement, as well as the declaration by which the Salon attests that it provides its services as a professional.

(3) The legal basis for the processing referred to in paragraph (1) is performance of a contract, under Article 6(1)(b) GDPR; the data is kept until the Account is deleted. The proof referred to in paragraph (2), together with the Salon's name and tax identification number and the email address of the Owner who accepted, is processed on the basis of KYRO's legitimate interest in establishing, exercising or defending legal claims, under Article 6(1)(f) GDPR, and is kept for as long as the Salon exists on the Platform and for 3 years after its data is deleted.

(4) Team Members must be at least 16 years old, and the Owner who registers a Salon must be at least 18 years old.

(5) For the Kyro Studio Subscription, KYRO keeps the Salon's billing details and payment history for the period required by tax law.

(6) Income reports, the calendar and Client Records are the Salon's data, for which KYRO acts as processor. The team's internal notes must not contain data concerning health; allergies are recorded solely in the separate field, with the Client's consent, in accordance with Article 7. Team Members with the Specialist or Booth Renter role have access solely to the Client Records of the Clients with whom they have at least one Booking, past or future. The Owner has access to the income of the whole Salon and of each Team Member; the other Team Members have access solely to their own income.

(7) A Team Member may delete their Account from Kyro Studio. The Account used in Kyro Studio and the Account used in the Kyro App are a single Account, so deletion takes effect in both applications. Deletion cannot be carried out while:

• a) the Team Member is the Owner of a Salon that has not been permanently closed; in that case, the Owner is required first to transfer the capacity of Owner to another active Team Member or to close the Salon permanently;
• b) Bookings that have not ended and have not been cancelled are assigned to the Team Member.

(8) When a Team Member's Account is deleted, their name is kept on past Bookings and in the Salon's team records, as data of the Salon, without being associated any longer with an Account, and the Team Member's own Subscription Plans and Loyalty Programme end.

Article 11. Cookies and local storage

(1) The Website does not use cookies. The only information stored in the User's browser is the chosen display theme, under the kyro-theme key in localStorage, which is saved only after the theme button is pressed and is not sent to any server. The Website does not use traffic analytics, advertising pixels or embedded third-party content, and the fonts are hosted by KYRO. The Website's server keeps no access logs. The Website is delivered through the Cloudflare network, which receives the device's IP address in order to send the pages.

(2) The Kyro App and Kyro Studio store on the User's device solely:

• a) the sign-in session, in the device's secure storage (Keychain on iPhone), so that the User does not have to sign in every time the app is opened;
• b) the User's preferences (appearance, notification settings, favourite salons, recent searches, calendar syncing);
• c) the push notification token, only after notifications have been accepted;
• d) the reminders scheduled on the device for Bookings.

(3) The KYRO web app uses a session cookie, which is set only after the User signs in.

(4) The storage described in paragraphs (1) to (3) is strictly necessary to provide the service requested by the User and therefore does not require consent, under Article 4(5) of Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector. Before introducing any analytics or advertising tool, KYRO will ask for the User's consent, through acceptance and refusal options presented with equal prominence. The full list, for each platform, is published in Cookies and local storage policy.

Article 12. Security of processing

(1) KYRO applies technical and organisational measures appropriate to the risk, under Article 32 GDPR, including:

• a) encryption of the connections (HTTPS/TLS) between the apps, the Website and the servers;
• b) storage of passwords and sign-in codes solely as cryptographic fingerprints;
• c) database-level access rules under which each Account has access solely to the data it is permitted to access (including the rule that a Salon cannot access another Salon's Client Records);
• d) the restriction of access to profile photos, which are not public and can be opened solely through temporary links, in the apps;
• e) limits on the number of attempts for codes and for signing in, in order to block automated attacks;
• f) restriction of administrative access to a small number of authorised persons bound by a duty of confidentiality; every consultation of personal data by a KYRO Administrator is logged (the author, the data consulted, the time);
• g) in the event of a personal data breach, notification of the supervisory authority within no more than 72 hours of KYRO becoming aware of the breach and, where the breach is likely to result in a high risk to the rights and freedoms of natural persons, communication to the data subjects, under Articles 33 and 34 GDPR.

(2) No technical measure guarantees absolute security. A User who notices a security problem may report it to [email protected].

Article 13. Rights of the data subject

(1) The data subject has, under the conditions laid down in Articles 15 to 22 GDPR, the following rights:

• a) the right of access (Article 15): the right to obtain confirmation as to whether or not their data is being processed and a copy of that data;
• b) the right to rectification (Article 16): the right to have inaccurate data corrected and incomplete data completed; part of the data can be changed directly in the app, in the "Cont" (Account) section;
• c) the right to erasure (Article 17); the Account can be deleted directly in the app, in accordance with paragraph (6);
• d) the right to restriction of processing (Article 18), including while a challenge is being verified;
• e) the right to data portability (Article 20): the right to receive the data provided to KYRO in a structured, commonly used and machine-readable format;
• f) the right to object (Article 21): the right to object to processing based on legitimate interest and, at any time, to processing for direct marketing purposes;
• g) the right not to be subject to a decision based solely on automated processing which produces legal effects concerning them or similarly significantly affects them (Article 22);
• h) the right to withdraw consent at any time (Article 7(3)), without affecting the lawfulness of processing carried out before the withdrawal.

(2) KYRO communicates any rectification, erasure or restriction carried out to each recipient to whom the data has been disclosed, unless this proves impossible or involves disproportionate effort, under Article 19 GDPR.

(3) The rights are exercised by a request sent to [email protected] from the email address linked to the Account. Where the request is sent from another address, KYRO may ask for the additional information necessary to confirm the identity of the requester, so as not to disclose the data to another person.

(4) KYRO handles the request free of charge within no more than one month of receiving it. That period may be extended by no more than two further months where necessary, taking into account the complexity and number of the requests; in that case KYRO informs the requester of the extension and of the reasons for it within one month of receiving the request, under Article 12(3) GDPR.

(5) For the data in a Client Record kept by a Salon, including allergy notes and the Client Rating, the data subject may contact the Salon directly or KYRO. A request addressed to KYRO is forwarded to the Salon, which KYRO assists in handling it.

(6) The Client may delete the Account in the Kyro App, in the "Cont" (Account) section, without sending a written request. Upon deletion, KYRO deletes the Account, the profile, the profile photo, the Client's Reviews, loyalty points, the Client's Subscription Plans, including the record of payments noted by Salons, and the allergy notes linked to the Account, at every Salon. The Salons at which the Client had visits keep, as separate controllers, the history of their own visits in their Client Records; that data is no longer linked to the Account and is deleted when the periods set out in Article 6(1) expire. KYRO keeps solely the data that the law requires it to keep or that is necessary for the establishment, exercise or defence of legal claims, for the periods set out in Article 6(1).

Article 14. Complaint to the supervisory authority

(1) A data subject who considers that the processing of their data infringes the law may first send a notice to [email protected], so that KYRO can remedy the situation as quickly as possible. Sending such a prior notice is optional.

(2) The data subject has the right at any time to lodge a complaint with the National Supervisory Authority for Personal Data Processing ("ANSPDCP"):

• a) address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postcode 010336, Bucharest, Romania;
• b) website: www.dataprotection.ro;
• c) email: [email protected].

(3) The data subject also has the right to bring proceedings before the competent court.

Article 15. Minimum age

(1) An Account in the Kyro App is intended solely for persons who have reached the age of 16. When creating the Account, the User confirms that they have reached this age by ticking a box that is unticked by default. The holders of Accounts created before this confirmation was introduced give it the next time they open the app.

(2) KYRO does not knowingly create Accounts for persons under the age of 16. An Account that KYRO learns belongs to a person under the age of 16 is deleted.

(3) A parent or legal representative who believes that a minor under the age of 16 has created an Account may notify KYRO at [email protected].

Article 16. Changes to the Policy

(1) KYRO may update this Policy if its services or the applicable law change. The version in force and the date of the last update are shown at the top of the document.

(2) KYRO informs Users, in the app or by email, before the date on which they take effect, of changes concerning the purposes of processing, the legal bases, the categories of data, the recipients, the transfers, the storage periods or the rights of data subjects, including the addition of a new purpose or of a new provider receiving personal data. All other changes, including drafting corrections, take effect on the date the new version is published.

(3) Processing for a new purpose that is based on consent begins only after the data subject's separate consent has been obtained.

Article 17. Contact details

• a) data protection: [email protected];
• b) general contact: [email protected];
• c) telephone: to complete: phone;
• d) postal address: to complete: company name, to complete: registered office.

Related documents: Cookies and local storage policy, Terms and conditions for clients, Rules on reviews and Legal notice.

Back to top