Privacy Policy
This policy explains how we process personal data when you visit tricho.doctor, take the hair and scalp test, use the AI assistant, create a customer account or buy from us.
1. Controller
TRICHO DOCTOR COSMETICS s.r.o., Švehlova 3333/19, Záběhlice, 106 00 Praha 10, Czech Republic, Company ID (IČO) 30044871, registered with the Municipal Court in Prague, file C 456130. Contact for all data protection matters: info@trichodoctor.it.
We have not appointed a data protection officer.
2. What data we process, why and on what legal basis
Orders and delivery
Data: name, e-mail, phone, delivery address or pick-up point, ordered goods, prices, payment status (not your card details), invoice, communication about the order, returns and complaints. Purpose: concluding and performing the contract — payment, delivery, invoicing, withdrawal, complaints. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); keeping accounting and tax documents is our legal obligation (Art. 6(1)(c) GDPR).
Customer account
Data: e-mail, chosen market and language, sign-in sessions, order history and — only if you choose so — saved test results and Protocols. Purpose: giving you access to your orders and saved Protocols. You sign in with a one-time code sent to your e-mail; we store no passwords. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Hair and scalp test and Personal Protocol
Data: your answers about the scalp and hair (e.g. hair loss, oiliness, itching, flaking, sensitivity, duration of the problem). Some answers may be data concerning health (special category of data under Art. 9 GDPR). Purpose: evaluating the answers and creating your Personal Protocol. Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which we ask for before the answers are evaluated. Without it, the test cannot be evaluated; you can still buy products without the test. Saving the result is a separate, optional consent. You can save it in your customer account, or without an account under a personal link (you may also have the link sent to your e-mail; the address is used only for that and is deleted with the saved protocol). If you give neither consent, the answers are not stored by us after the result is shown; a test you have not finished stays only in your browser (see Cookies).
AI assistant (chat and voice)
Data: your messages, the assistant's replies, technical data of the session (time, language, market, page); if you have taken the test, your answers and your Personal Protocol, so that the assistant can explain them; in voice mode the sound of your voice (processed in real time, not recorded) and the text transcript. We also count the topics of questions (e.g. "price", "how to apply a product") without the text of the conversation. Purpose: answering your questions about products, the test and orders; improving the quality of answers (reviewing conversations, also with the help of AI). Legal basis: your consent (Art. 6(1)(a) GDPR and, for health-related answers, Art. 9(2)(a) GDPR), which you give before the first message.
Contact and forms
Data: name, e-mail, phone if given, order number, message, attachments. Purpose: handling your enquiry, withdrawal or complaint. Legal basis: performance of a contract or steps before concluding it (Art. 6(1)(b) GDPR); for other enquiries our legitimate interest in answering them (Art. 6(1)(f) GDPR).
Website operation, security and statistics
Data: technical data necessary to deliver the website (IP address, browser data, time of request), error reports with personal data removed, and anonymous statistics of visits and clicks. Our own statistics and click map do not use cookies and do not store your IP address: a visitor is counted with a key derived from a daily changing random value, so visitors cannot be identified or tracked across days. The click map records only the position of clicks on a page and the element clicked, never the content of forms or test answers. Purpose: secure operation of the website, protection against abuse, fixing errors, improving the website. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
Analytics and marketing cookies
Only with your consent given in the cookie banner (Art. 6(1)(a) GDPR). See Cookies.
Legal claims
Where necessary, we use data to establish, exercise or defend legal claims — legitimate interest (Art. 6(1)(f) GDPR).
We do not send newsletters or marketing e-mails. We do not use your data for automated decision-making that has legal or similarly significant effects on you; the Personal Protocol is a cosmetic recommendation according to fixed rules.
3. Recipients and processors
We share data only with providers who need it for the purpose stated, under data processing agreements or as independent controllers where they act on their own behalf:
| Provider | Role | Location |
|---|---|---|
| INTERNET CZ, a.s. (FORPSI) | hosting of the website and database | Czech Republic |
| Stripe Payments Europe, Ltd. (Stripe) | payment processing | Ireland / EU |
| Zásilkovna s.r.o. (Packeta) and its partner carriers | delivery of parcels | EU |
| Fakturoid s.r.o. | invoicing and accounting documents | Czech Republic |
| Sendinblue SAS (Brevo) | sending e-mails about sign-in and orders | France / EU |
| Anthropic, PBC | AI model for the text assistant | USA |
| Google (Gemini) | AI model for the voice assistant | USA / EU |
| Google (Google Analytics) | visit statistics — only with your consent | USA / EU |
| Functional Software, Inc. (Sentry) | error monitoring, personal data removed, EU data region | Germany |
| Cloudflare, Inc. | receiving e-mails sent to @tricho.doctor addresses and forwarding them to our mailbox | USA / EU |
| Telegram (Telegram FZ-LLC) | short notices to our staff about incoming e-mails: sender, subject and the beginning of the message | United Arab Emirates and other countries |
Our accountant and legal advisers may receive data where necessary. Public authorities receive data only where the law requires it.
4. Transfers outside the EU/EEA
Some providers (Anthropic, Google, Sentry, Cloudflare) are based in the USA or their parent companies are. Transfers take place on the basis of the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, where the provider is certified, or on the basis of the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards at info@trichodoctor.it.
Notices about incoming e-mails are delivered to our staff through Telegram, whose servers are located outside the EU/EEA, including in countries without an adequacy decision. We therefore limit them to the sender, the subject and the beginning of the message; the full e-mail stays in our mailbox.
5. How long we keep data
| Data | Retention |
|---|---|
| Orders, invoices and accounting documents | for the period required by accounting and tax law (up to 10 years); when an account is deleted they are kept without link to the account |
| Customer account | until you or we delete it |
| Saved test results and Protocols | until you withdraw the consent to saving or delete the account |
| Test answers without saving | not stored after the result is shown |
| Protocols saved under a personal link (answers, protocol, e-mail if given) | 90 days, then deleted automatically; earlier if you delete them on the page |
| AI assistant conversations without a customer account | 14 days after the last message |
| AI assistant conversations of signed-in customers | 12 months after the last message; earlier if you delete the account |
| Topics of assistant questions (without the text of the conversation) | kept as anonymous statistics: once the conversation is deleted, nothing in them relates to you |
| Voice recordings | not stored — only the text transcript is kept like other conversations |
| Contact messages, withdrawals and complaints | until the matter is settled and then during the limitation period for claims (usually 3 years) |
| Telegram notices about incoming e-mails | in the staff chat for as long as needed to handle the enquiry |
| Records of consents | for as long as the consent is valid and then during the limitation period, as evidence |
| Anonymous visit and click statistics | 13 months, then only aggregated numbers |
| Cookie consent | 12 months |
6. Your rights
You have the right to:
- access your data and receive a copy,
- rectification of inaccurate data,
- erasure ("right to be forgotten"),
- restriction of processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw your consent at any time — this does not affect processing before withdrawal.
Signed-in customers can download their data and delete their account directly in the profile; the consent to saving test results can be withdrawn there too. For all other requests write to info@trichodoctor.it. We reply within one month.
You also have the right to lodge a complaint with a supervisory authority — in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz — or with the authority in your country of residence.
7. Is providing data mandatory?
Data needed for an order is necessary to conclude the contract; without it we cannot deliver. Everything else — the test, saving results, the AI assistant, analytics cookies — is voluntary.
8. Changes
We update this policy when our processing changes. The current version is published on this page with its effective date and version number.