Privacy policy
Last updated: 13 November 2026
We explain what personal data we process, why, for how long and what rights you have. We apply Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).
1. Data controller
| Item | Information |
|---|---|
| Controller | Aion Hair, S.L. |
| Tax ID (NIF) | B09708512 |
| Address | Av. Menéndez Pelayo 101, 6.º D, escalera derecha, 28007 Madrid (España) |
| Phone | 682 44 89 92 |
| Email (also for exercising your rights) | [email protected] |
2. What we process, why, and on what legal grounds
| Processing | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Purchases and orders | Name, billing and shipping address, email, phone, order contents, amount. Card details are processed by Stripe; we do not see or store them. | Managing the order, collecting payment, shipping it, handling returns and guarantees. | Performance of a contract (art. 6.1.b GDPR) | For as long as the contract lasts. Afterwards, blocked for the legal limitation periods. |
| Tax and accounting obligations | Billing data and transaction data | Invoicing and complying with the tax authorities and accounting regulations. | Legal obligation (art. 6.1.c) | 6 years (Commercial Code, art. 30). |
| Shipping and tracking | Name, address, phone, email | Delivering the package and notifying you of the tracking number by email. | Performance of a contract (art. 6.1.b) | For the duration of the shipment. Afterwards, same as the order. |
| User account and online training area | Name, email, password (encrypted), orders, videos you access | Giving you access to the training area and your order history. | Performance of a contract (art. 6.1.b) | For as long as you have the account. If you close it, it is deleted, except for what we must keep by law. |
| Contact form | Name, email, phone (if you provide it), message | Replying to your message. | Consent (art. 6.1.a) | For the time needed to handle it. Afterwards, blocked for the limitation periods (art. 32 LOPDGDD). |
| Training inquiry form | Name, email, phone, training of interest, message | Answering your inquiry and, where applicable, preparing the separate enrollment. | Pre-contractual measures at your request (art. 6.1.b) | Same as the contact form. If you enroll, it moves on to the corresponding contract. |
| AI chatbot | Your messages, date and time, and any data you write | Handling inquiries and improving responses to future questions. Conversations are stored on the website. | Legitimate interest in handling your inquiries (art. 6.1.f) | For as long as needed to answer your query. You can ask us to delete them at any time. |
| Web analytics (Google Analytics 4) | Cookie identifiers, page views, device, country, browsing events | Understanding how the website is used and improving it. | Consent (art. 6.1.a) | Cookies: see the cookie policy. Data in Google Analytics: 2 months. |
| Advertising and measurement (Meta pixel) | Cookie identifiers, page views, purchase events | Measuring campaigns and showing ads on Facebook and Instagram. | Consent (art. 6.1.a) | Cookies: see the cookie policy. Data in Meta: according to its policy. |
| Security and fraud | IP address, device data, technical payment data | Protecting the website and payments. | Legitimate interest (art. 6.1.f) | The time strictly necessary. |
While you watch the training videos, we save how far you have got in each one and when you last logged in, so you can pick up where you left off and so we can support you.
Analytics and advertising only work if you accept the corresponding cookies. You can withdraw your consent at any time (section 8 and the cookie policy).
The AI does not make decisions about you with legal effects. Do not enter health data or other sensitive data in the chatbot.
If you do not give us the data needed to buy, we cannot process the order. All other data is optional.
If you sign up with the link provided by Prolook Professional, Aion Hair processes your data (first name, last name, email, phone, salon, city, country and your acceptance of this policy) to give you access to the online training and, only if you tick the box, to send you news and offers by email. You can withdraw that consent at any time.
3. Where the data comes from
From you, when you buy, register, fill in a form or write to the chatbot. From your browser, through the cookies you accept.
4. Recipients and data processors
We do not sell your data. These providers receive or process it on our behalf, under a data processing agreement (art. 28 GDPR) when they act as processors:
| Provider | Purpose | Country |
|---|---|---|
| MKPRO / Blooglee servers | Hosting of the website and database | EU |
| Stripe Payments Europe, Ltd. | Card payment and anti-fraud | Ireland (EU) |
| Packlink Shipping S.L. and the carrier chosen for the order | Shipping management, labels and tracking | EU |
| BunnyWay d.o.o. (Bunny Stream) | Hosting of the training area videos | Slovenia (EU) |
| AI provider (Anthropic PBC, USA) | Operation of the chatbot | USA (see section 5) |
| MXroute | Sending order, form and tracking emails | USA |
| Google Ireland Ltd. | Google Tag Manager and Google Analytics 4, only with your consent | Ireland (EU) |
| Meta Platforms Ireland Ltd. | Meta pixel, only with your consent | Ireland (EU) |
| Aion Hair's tax and accounting advisory firm | Accounting and taxes | Spain |
By law, we may also disclose data to the Tax Agency, to courts and tribunals and to the competent authorities.
If you ship a package outside the EU, the carrier and the customs authorities of the destination country receive your delivery details. This is necessary to perform the contract (art. 49.1.b GDPR).
5. International transfers
- AI provider (Anthropic PBC, USA). Your messages to the chatbot (Claude) are sent to the USA. The transfer is covered by the European Commission’s standard contractual clauses, included in Anthropic’s data processing addendum.
- Google and Meta. Although we contract with their Irish subsidiaries, they may process data in the USA or other countries. They do so under the EU-US Data Privacy Framework or standard contractual clauses.
You can ask us for a copy of the safeguards by writing to [email protected].
6. Minors
To send us data through forms you must be 14 or older. To buy, 18 or older. If you believe a minor has given us data without the permission of their parents or guardians, let us know and we will delete it.
7. Security
We use HTTPS, encrypted passwords, access limited to those who need it, and backups. No one at Aion Hair sees your full card number.
8. Your rights
You can ask us for:
- Access: to know what data of yours we process and receive a copy.
- Rectification: to correct inaccurate data.
- Erasure: to delete your data when it is no longer necessary or you withdraw your consent.
- Objection: to object to processing based on legitimate interest.
- Restriction: that we only store the data, without using it.
- Portability: to receive your data in a commonly used electronic format.
- Withdraw consent at any time. It does not affect what was done before.
How to exercise them: write to [email protected], or by letter to Av. Menéndez Pelayo 101, 6.º D, escalera derecha, 28007 Madrid. State which right you are exercising and attach a document proving your identity. We respond within one month at most. If the request is complex, we may extend this by two more months and we will let you know.
To change your cookie choice, use “Cookie settings” in the footer of the website.
9. Complaints
If you believe we are not handling your data properly, write to us first. You can also file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es, C/ Jorge Juan 6, 28001 Madrid.
10. Changes
If we change this policy, we will publish the new version here with its date. If the change is significant, we will notify you.