1. Introduction and who we are
1.1. This Policy explains how STILIO DIGITAL LIMITED LIABILITY COMPANY ("STILIO", "we"), IDNO 1022600029811, with its registered office at MD-2044, Chișinău municipality, 17 Mihail Sadoveanu St., office 249A, collects and processes your personal data.
1.2. We process data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.
1.3. Contact for data protection matters: [email protected].
2. STILIO's role in relation to you
2.1. When you use the platform directly (client account, search, booking through the marketplace, communications from STILIO), STILIO is the controller.
2.2. When you are a client of a salon that manages you through the platform, the salon is the controller of your data, and STILIO acts as a processor. For this data, you may contact the salon directly.
3. Definitions
a) "Personal data" — any information relating to an identified or identifiable natural person;
b) "Processing" — any operation performed on data;
c) "Controller" / "Processor" — as defined by Law No. 195/2024 and the GDPR;
d) "Applicable Law" — Law No. 195/2024 and, for users in the EU, the GDPR.
4. How we collect data
a) directly from you (when creating your account, when booking, in correspondence);
b) automatically, through your use of the platform (technical data, IP address, usage data);
c) from the salon you interact with, where applicable.
5. What data we process, for what purpose, on what legal basis, and for how long
5.1. At registration we do not collect date of birth or gender. If a salon adds such information to its own client record, it does so as controller, at its own responsibility.
5.2. The table below summarizes the main processing activities:
| Data category | Purpose | Legal basis | Retention period |
| Identification and contact details (first name, last name, e-mail, phone) | Account, bookings, service notifications | Performance of the contract / pre-contractual measures | For the duration of the account |
| Booking data (salon, service, date/time) | Managing appointments | Performance of the contract | For the duration of the account plus a reasonable period |
| Technical and usage data (IP, pages, device) | Operation, statistics, security | Legitimate interest | No more than 24 months |
| Marketing preferences and consents | Newsletter and commercial communications | Consent | Until withdrawn |
| Health information (allergies, etc.) communicated to the salon | Safe provision of the service | Explicit consent; the salon is the controller | In accordance with the salon's policy |
| Data with tax relevance (where applicable) | Accounting/tax obligations | Legal obligation | For the period required by accounting and tax legislation |
6. Legal bases explained
6.1. Performance of the contract / pre-contractual measures — for the account, bookings, and service notifications.
6.2. Legitimate interest — for security, fraud prevention, and the operation and improvement of the platform; you may object to this (Art. 11).
6.3. Consent — for marketing, for non-essential cookies, and for health data communicated to the salon; it may be withdrawn at any time.
6.4. Legal obligation — for accounting/tax obligations, where applicable.
7. Marketing, profiling, and location
7.1. We send marketing communications only with your consent, with an unsubscribe option in every message. Booking-related notifications are service messages, not marketing.
7.2. We do not carry out automated profiling for marketing purposes and we do not use geolocation (GPS) to send you offers.
8. Automated decisions and profiling
8.1. We do not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or significantly affect you.
9. Health information
9.1. If, prior to a service, you communicate information about allergies or medical conditions to the salon, this constitutes special categories of data. This information is provided on your own initiative to the salon. The salon determines the purpose and legal basis for processing it and is its controller. STILIO does not request such data; where it merely stores or technically transmits it, it acts as processor for the salon, in accordance with the DPA.
10. Cookies and similar technologies
10.1. We use cookies in accordance with the Cookie Policy. Non-essential cookies and analytics/advertising tools, including Meta Pixel, are activated only based on the consent given through the cookie banner, which you may withdraw at any time.
11. Recipients and sub-processors
11.1. Data may be processed by service providers (sub-processors) acting on behalf of STILIO. To make a booking, the necessary data is transmitted to the salon you selected. List of sub-processors: https://stilio.md/en/subprocessor. Data may be disclosed to authorities where required by law.
12. International transfers
12.1. The main infrastructure is located in the European Union. For providers outside the EU/Republic of Moldova, transfers are carried out with adequate safeguards: Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. A copy of the safeguards may be requested at the contact address.
13. How long we retain data
13.1. We retain data for as long as you have an active account. In the absence of any activity for 5 (five) years, the account and associated data are deleted, following prior notice. Upon a deletion request, data is deleted without undue delay. Exceptions apply to data whose retention is required by law (accounting/tax), which is kept for the legally required period.
14. Data security
14.1. We apply technical and organizational measures appropriate to the risk: encryption in transit (TLS) and at rest at the infrastructure level, access control, two-factor authentication for critical systems, logging, backups, and hosting within the EU.
15. Your rights
15.1. You have the following rights:
a) the right of access to your data;
b) the right to rectification of inaccurate or incomplete data;
c) the right to erasure ("the right to be forgotten"), under the conditions provided by law;
d) the right to restriction of processing;
e) the right to data portability — receiving your data in a structured, commonly used, machine-readable format;
f) the right to object, including to marketing;
g) the right to withdraw your consent at any time;
h) the right to lodge a complaint with the supervisory authority.
15.2. Requests should be sent to [email protected]. We respond within one month, extendable by two months for complex requests, with prior notice to you. We may request information to verify your identity. Exercising these rights is, as a rule, free of charge.
15.3. For data managed by a salon as controller, you may contact that salon directly.
16. Supervisory authority
16.1. You have the right to lodge a complaint with the National Center for Personal Data Protection (CNPDCP), without prejudice to any other remedies.
17. Minors
17.1. The platform is intended for persons over 18 years of age. For services intended for a minor, the booking and the data are provided by the legal representative. If we learn that an account was created by a minor without a valid basis, we may suspend or delete it.
18. Contact person for data protection
18.1. STILIO has designated a contact person for data protection, at [email protected]. STILIO is not legally required to appoint a Data Protection Officer (DPO).
19. Changes
19.1. This Policy may be updated. Changes are published on the platform, indicating the effective date; significant changes may also be communicated separately.
20. Contact
20.1. For any question regarding this Policy: [email protected].
Last updated: 23 August, 2026