BEAUTLIX PRIVACY POLICY

Edition valid from: 2026-02-01
Last updated: 2026-08-17

This privacy policy explains how personal data is collected, used, stored, and transferred when using the website qa-lt-20261111.beautlix.com, the Beautlix platform, mobile applications, and other related services (hereinafter collectively referred to as the Platform).

1. DATA CONTROLLER

The Platform is administered and the personal data controller in the cases specified in this document is:

UAB Global shops owners
Legal entity code: 306329475
VAT payer code: LT100017569812
Registered address: Giedraičių g. 39-R53, LT-09302 Vilnius, Lithuania
Website: qa-lt-20261111.beautlix.com
Email for privacy and data protection matters: support@beautlix.com

Hereinafter UAB Global shops owners is referred to as “Beautlix”, “we” or “our”.

2. WHEN BEAUTLIX IS A DATA CONTROLLER OR PROCESSOR

2.1. Beautlix acts as an independent data controller when processing data for Platform accounts, booking transfers, security, payments with Business users, customer service, analytics, marketing, compliance with legal obligations, and protection of its rights.

2.2. When a Client books a service, the data necessary for the booking is transferred to the selected salon, clinic, studio or specialist (hereinafter – Service Provider). The Service Provider independently determines how the data will be used to provide the service, and thus usually acts as a separate data controller for their processing.

2.3. When the Service Provider uses Beautlix as a system for managing clients, employees, work schedules, bookings, or other business processes and independently determines the purposes of such processing, Beautlix may act as a data processor on behalf of the Service Provider. Such processing is regulated by a separate Data Processing Agreement. For the use of such data, please primarily contact the specific Service Provider.

2.4. This policy applies to the personal data processing for which Beautlix is responsible. It does not replace the privacy notices of Service Providers.

3. WHERE WE OBTAIN DATA FROM

We may obtain personal data:

directly from you when you register, make a booking, fill out a profile, contact us, post a review, or use Platform features;
from the Service Provider or their authorized employee when they create or manage a booking, client, employee access, or update service information;
automatically from your device, browser, app, cookies, and similar technologies;
from payment, authentication, communication, analytics, and other service providers used for Platform operation;
from public registers or other lawful sources when verifying the Service Provider's identity, registration, license, or right to conduct business.

If you provide data about another person, you have the right to provide it and, if necessary, inform that person about the transfer of data to Beautlix.

4. WHAT PERSONAL DATA WE PROCESS

4.1. Account and Identity Data

We may process:

first and last name;
email address and phone number;
login identifiers, encrypted password, and authentication data;
profile picture, selected language, and account settings;
account type, role, permissions, and status;
history of consents, acceptance of terms, and their changes.

4.2. Booking and Service Data

We may process:

chosen Service Provider, specialist, and service;
Booking date, time, location, duration, and status;
information about booking creation, confirmation, modification, cancellation, or no-show;
notes related to the Booking for the Service Provider;
notifications about the Booking and their delivery information;
data related to complaints, refunds, or disputes.

4.3. Payment and Accounting Data

When payments are made or managed on the Platform, we may process:

payment amount, currency, time, and status;
payment transaction number or other limited identifier;
invoices, subscriptions, payments, and refund information;
data required for invoices or other accounting documents.

All payment card data is usually processed directly by the selected licensed payment service provider unless otherwise specified for a particular payment.

4.4. Service Providers and Their Team Data

We may process:

name, surname, and contacts of the service provider representative, owner, specialist, or employee;
data related to the legal entity, individual activity, professional registration, and representation;
license, permit, qualification, or insurance information when required;
workplace, position, Platform role, and access permissions;
work schedules, working hours, Bookings, and service availability;
data on the chosen plan, subscription, billing, and use of business functions;
content of salons, specialists, services, and profiles.

When the Service Provider processes work schedules, compensation, clients, or other business management data for its own purposes, the controller of such data is the Service Provider, and Beautlix acts on its instructions.

4.5. Communication, support and content data

We may process:

Your inquiries, complaints, and correspondence with Beautlix;
communication date, channel, content, and resolution status;
feedback, ratings, photos, and other content you have published;
reports of potentially illegal or rule-violating content;
newsletter subscriptions and marketing preferences.

4.6. Technical, usage and security data

We may process:

IP address, device and session identifiers;
device type, model, operating system, app version, and browser;
login, logout, error, and security event logs;
visited pages, performed actions, searches, filters, and usage duration;
approximate location determined by IP address, or more precise location if allowed in device settings;
data from cookies and similar technologies.

4.7. Special categories of data

Typically, Beautlix does not request diagnoses, detailed health histories, or other special category data for reservations. If information about allergies, contraindications, or other health conditions is necessary for safe service provision, it is recommended to provide it directly to the selected Service Provider.

If in the future a feature dedicated to such data is implemented on the Platform, additional information will be provided before collection and a proper legal basis as per GDPR Article 9 will be ensured. Please do not write unnecessary health information in general notes or correspondence fields.

5. PURPOSES AND LEGAL BASES OF DATA PROCESSING

Purpose	Processed data	Legal basis
Create, authenticate and administer an Account	Account, identity, contact and security data	Performance of a contract or pre-contractual actions – GDPR Article 6(1)(b).
Accept, transmit, confirm and administer Reservations	Contact, Reservation, service, message and where applicable, payment data	Performance of a contract or pre-contractual actions – GDPR Article 6(1)(b).
Provide business management functions to Service Providers	Service provider's, team, clients, Reservations, schedule and plan data	Performance of a contract – GDPR Article 6(1)(b); when acting as processor – documented instructions from the Service Provider
Manage payments, subscriptions, invoices, and refunds	Payment, accounting, plan, and contact details	Contract performance – GDPR Article 6(1)(b); legal obligation – GDPR Article 6(1)(c).
Provide customer service and resolve complaints	Contact, communication, Account, Booking, and related data	Contract performance – GDPR Article 6(1)(b); legitimate interest in effectively handling inquiries – GDPR Article 6(1)(f).
Ensure Platform security, prevent fraud and abuse	Technical, login, activity, Account, payment, and incident data	Legitimate interest to protect the Platform and its users – GDPR Article 6(1)(f); legal obligation – GDPR Article 6(1)(c), where applicable
Verify Service Provider identity and legality of operations	Identity, registration, contact, license, and representation data	Legal obligation – GDPR Article 6(1)(c), where applicable; legitimate interest to ensure a reliable Platform – GDPR Article 6(1)(f).
Manage reviews and other content	Review, rating, Booking confirmation, content, and message data	Contract performance – GDPR Article 6(1)(b); legitimate interest to ensure reliable information – GDPR Article 6(1)(f); legal obligation – GDPR Article 6(1)(c), where applicable
Analyze and improve the Platform	Aggregated usage, technical, error, and statistical data	Legitimate interest to improve the Platform – GDPR Article 6(1)(f); consent – GDPR Article 6(1)(a), when consent-requiring technologies are used
Send news and marketing offers	Name, email, phone number, marketing preferences, and interaction data	Consent – GDPR Article 6(1)(a) and electronic communications rules
Fulfill legal, tax, and accounting obligations	Contract, payments, accounting, identity, and communication data	Legal obligation – GDPR Article 6(1)(c).
Establish, assert, or defend legal claims	Data related to disputes, contracts, Bookings, payments, security, or communications	Legitimate interest to defend rights – GDPR Article 6(1)(f).

When relying on legitimate interest, we assess Beautlix’s or a third party’s interest, necessity of processing, and possible impact on your rights. You have the right to object to such processing as described in section 12.

6. DATA YOU MUST PROVIDE

Data marked as mandatory during registration, Booking, payment, or Service Provider verification are needed to provide the relevant function or fulfill a legal obligation. Without them, it may be impossible to create an Account, make or confirm a Booking, enable payment, activate a Service Provider profile, or provide a specific Platform feature.

Filling out optional profile fields is not required. Consent to direct marketing is voluntary and does not affect the ability to use the main Platform services.

7. WHO WE MAY DISCLOSE DATA TO

To the extent necessary for a specific purpose, we may disclose data to:

Your chosen Service Provider, its authorized specialists or employees to fulfill the Reservation;
providers of payment, banking or fraud prevention services;
providers of hosting, cloud, database, backup, and cybersecurity services;
providers of email, SMS, messaging, customer support, and other communication services;
providers of authentication, software, maintenance, and analytics services;
accountants, auditors, lawyers, insurers, and other professional consultants;
affiliated companies, investors, or business acquirers in case of reorganization, merger, financing or business transfer, subject to confidentiality and data protection measures;
courts, law enforcement, supervisory, tax, and other state authorities when we are required or have a lawful basis to provide data;
other persons when you have given valid consent or the transfer is permitted by laws.

We allow data processors to use data only according to our documented instructions, concluded contracts, and applicable data protection requirements.

Beautlix does not sell or rent personal data to third parties.

8. SERVICE PROVIDERS AS INDEPENDENT DATA CONTROLLERS

8.1. Only the data necessary for the Reservation and service administration are transferred to the Service Provider. Typically, these include name, contact details, selected service, time, Reservation status, and any notes you provided related to the Reservation.

8.2. Upon receiving the data, the Service Provider may use it to provide the service, communicate, conduct accounting, fulfill legal obligations, and defend its rights according to its privacy notice.

8.3. The Service Provider may not use Client data obtained through the Platform for marketing unrelated to the Reservation without proper legal grounds.

8.4. For issues related to the Service Provider’s data processing, storage periods, or marketing, contact that Service Provider directly. Beautlix may assist in identifying the party responsible for a specific request.

9. INTERNATIONAL DATA TRANSFER

We aim to process data primarily within the European Economic Area (EEA). When a service provider or its infrastructure is outside the EEA, or data is accessed from there, transfer occurs only with a legal basis and appropriate safeguards, such as:

European Commission decision on an adequate level of data protection;
European Commission approved standard contractual clauses and, if needed, additional technical or organizational measures;
another transfer mechanism provided under Chapter V of the GDPR.

Information or copies of safeguards applicable to a specific transfer can be requested by email support@beautlix.com. Commercially or security-sensitive information may be reasonably redacted.

10. DATA RETENTION PERIODS

We retain data no longer than necessary to achieve the purpose, fulfill legal obligations, or assert and defend claims. The following main retention periods apply:

Data category	Standard retention period
Account and profile data	While the Account is active and up to 3 years after its closure, except for data required or necessary to be kept longer
History of reservations, their changes and cancellations	Up to 5 years from the completion or cancellation of the Reservation, when needed to support disputes, fraud prevention, and service history
Customer service inquiries and complaints	Up to 3 years from the final resolution, and in case of a dispute – until its final resolution and the applicable statute of limitations ends
Service provider contract, verification and business account data	During the contract validity and up to 10 years after its termination, as required for legal claims or compliance with laws
Payment and accounting documents	For the period established by law; when Beautlix must retain accounting documents – usually 10 years
Marketing data	Until consent withdrawal or another lawful basis ends; proof of consent and its withdrawal can be kept for 2 more years
Reviews and public User content	While the content is published; after removal, a limited copy may be kept up to 3 years for violations, disputes, and enforcement purposes
Technical, usage and security logs	Usually up to 12 months; data related to incidents, fraud, or disputes – until investigations and legal deadlines are completed
Cookie data	For the periods specified in the cookie policy

After the term expires, the data is deleted, irreversibly anonymized, or securely isolated until technical deletion from backups occurs according to the established backup cycle.

11. AUTOMATED DECISIONS, SEARCH AND PROFILING

11.1. Beautlix does not make decisions based solely on automated data processing that would cause you legal or similarly significant consequences, unless you have been separately informed about the specific case and your rights.

11.2. The platform may automatically sort search results or recommendations based on selected location, date, service category, availability, price, reviews, and your chosen filters. The main ranking principles are described in the Terms of Use.

11.3. Security and fraud prevention measures may automatically flag unusual activity for additional review, but significant Account restrictions complaints are examined with the participation of an authorized person.

12. YOUR RIGHTS

Depending on the circumstances and the conditions set by GDPR, you have the right to:

receive information about your data processing;
access the processed data and receive a copy;
request correction of inaccurate or completion of incomplete data;
request deletion of data;
request restriction of data processing;
disagree with data processing based on legitimate interest;
disagree with direct marketing at any time and free of charge;
receive your submitted data in a structured, commonly used, and machine-readable format and, where technically feasible, transfer it to another controller;
withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal;
request human intervention, express your opinion, and challenge a decision when a significant automated decision is lawfully applied;
file a complaint with the supervisory authority.

Rights are not absolute. For example, data may not be possible to delete if we are required to retain it by law or if it is needed to assert or defend legal claims.

You can submit a request by email support@beautlix.com. To protect data, we may ask for reasonably necessary information to verify your identity. We respond to requests without undue delay and no later than one month. In complex cases, this period may be extended by two months, with notification and explanation within the first month.

If you believe your data is being processed unlawfully, you have the right to file a complaint:

with the State Data Protection Inspectorate
Address: L. Sapiegos St. 17, LT-10312 Vilnius
Email: ada@ada.lt
Website: vdai.lrv.lt

Before submitting a complaint, we suggest contacting us first so that we can investigate the issue, but this is not mandatory and does not limit the right to contact the Inspectorate directly.

13. CHILDREN'S PERSONAL DATA

Only persons at least 18 years old can independently create an Account. If a service is booked for a minor, the Reservation must be made by their parent, guardian, or other legal representative. In such cases, please provide only the minor's data necessary for the specific service and Reservation.

Upon learning that a minor has submitted data or created an Account without legal representative involvement, we may restrict the Account and delete unnecessary data.

14. DATA SECURITY

We apply technical and organizational measures appropriate to the risk to protect data from unauthorized access, loss, alteration, disclosure, or destruction. Depending on the nature of the data and risk, this may include:

data transfer encryption;
access rights and role management;
authentication and password protection measures;
logging of actions, errors, and security incidents;
backups, recovery procedures, and system updates;
assessment of service providers, contractual obligations, and employee confidentiality;
incident management and response procedures.

No electronic system can guarantee absolute security. If a personal data security breach may pose a high risk to your rights and freedoms, we will inform you according to the applicable laws.

15. COOKIES AND DIRECT MARKETING

15.1. Necessary cookies are used to ensure the Platform and its security. Analytics, advertising, or other non-essential cookies are used only with consent when such consent is mandatory. Detailed information about cookie names, providers, purposes, and expiration dates is provided in the Cookie Policy.

15.2. Marketing emails or SMS are sent only with a proper legal basis. Consent can be withdrawn at any time by clicking the unsubscribe link in the message, changing Account settings, or writing to support@beautlix.com.

15.3. Service and security messages, such as Reservation confirmation, password recovery, or important Terms changes, are not direct marketing and may be sent as necessary to perform the contract or fulfill a legal obligation.

16. PRIVACY POLICY CHANGES

We may update this policy when Platform features, data processing, or legislation change. The latest version is always published on the Platform with the update date indicated.

We will inform about significant changes that may materially affect registered users' rights or expectations by email, Platform notification, or other appropriate means before changes take effect, when practically and legally required.

17. CONTACTS

For questions about this policy, your rights, or the processing of personal data by Beautlix, contact:

Email: support@beautlix.com
Website: qa-lt-20261111.beautlix.com