The short version
This site sets no cookies of its own, runs no analytics, shows no advertising, and loads nothing from third parties while you look around: fonts, images and the film come from our own domain. We only process personal data when you do something that needs it: join a waitlist, buy or pre-order, withdraw from a purchase, or write to us. We do not sell data and we do not build profiles.
1. Who is responsible
capXholding AG, Oberallmendstrasse 18, 6300 Zug, Switzerland (company number CHE-493.168.511) runs this site and decides how personal data is handled here. For anything about your data, write to your@bighairaffair.com.
We apply the Swiss Federal Act on Data Protection and, for people in the European Union, the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR) and its UK counterpart. Where this notice names a legal basis, it refers to Art. 6 GDPR.
2. When you visit the site
The site is hosted on the network of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA), which answers every request from a data center near you. To deliver a page, and to protect the site against attacks, Cloudflare processes on our behalf what every web server sees: your IP address, the page or file requested, date and time, the browser and operating system your browser reports, and the page you came from. We do not combine this with anything else we know, and we do not try to identify visitors. Legal basis: our legitimate interest in running a secure, working site (Art. 6(1)(f)).
From your IP address Cloudflare derives the country you are probably in. We use it for one thing: to preselect the "ship to" country in the cart. Technical logs of the parts of the site that run as a program (cart, forms, payment hand-over) are kept for a few days, 7 at most, and then deleted automatically. They can contain the technical details above, but no names, email or postal addresses.
3. What is stored on your device
The site itself sets no cookies. It uses your browser's local storage for three things, none of which leaves your device except as described: the contents of your cart, the reference of a payment page you have opened (so that the units reserved for you are recognized as yours, and released when you come back without paying), and the reference of your last completed order (so that the confirmation page does not empty a newer cart). This is strictly necessary for a shop you asked to use; you can clear it in your browser at any time. Cloudflare's protection systems may set a short-lived, technically necessary security cookie when they check whether a request comes from a person.
4. Protection against automated abuse
The forms and the checkout are protected by Cloudflare Turnstile. It is loaded only at the moment you go for a form or open a filled cart, not before. Turnstile examines technical signals from your browser (such as IP address, browser characteristics and how the page was loaded) to tell people from programs, and gives us a yes or a no. It is not used for advertising. Legal basis: our legitimate interest in keeping bots from reserving stock and from sending email through our forms (Art. 6(1)(f)).
5. The waitlist
If you join a waitlist we store your email address, the product you are waiting for, the page you signed up on, the country derived from your IP address (two letters, not the address itself) and the time. We use it to send you one email when that product is available, and for nothing else. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time by writing to your@bighairaffair.com; we then delete the entry. Otherwise we keep it until that email has been sent.
6. Orders, pre-orders and payment
Payment takes place on a page hosted by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). There you enter your name, email address, phone number, delivery and billing address and your payment details. Your card or account details go to Stripe only; we never see or store them. Stripe also uses data about the payment to prevent fraud and to meet its own legal duties, for which it is responsible itself: stripe.com/privacy. Stripe's page uses Stripe's own cookies.
From Stripe we receive, and store in our order database in Western Europe: your name, email address, phone number, delivery address, what you bought, the amounts, the payment status and Stripe's reference numbers. We use this to deliver your order, to send you the emails that belong to it, to handle withdrawals, returns and complaints, and to keep our books. Legal basis: performance of the contract with you (Art. 6(1)(b)) and our legal obligations under commercial and tax law (Art. 6(1)(c)). Without this data we cannot sell to you. We keep order records for as long as commercial and tax law requires, which is up to 10 years.
To get the parcel to you, our warehouse in Germany and the carrier receive your name, delivery address and, for delivery notices, your email address or phone number. For destinations outside the European Union the customs authorities receive what a customs declaration requires.
7. Emails we send you
We send the emails a purchase requires: the order confirmation (with the pre-order date, if any, and your withdrawal rights), the notice that your parcel is on its way, and the acknowledgment of a withdrawal. We do not send newsletters. The only other email you can get from us is the one you asked for on the waitlist.
To deliver them we use Resend (Plus Five Five, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, United States, which processes your email address, the content of the message and the technical delivery data on our behalf and stores it in the United States, for thirty days: resend.com/legal/privacy-policy. The transfer to the United States takes place under the European Commission’s standard contractual clauses, which form part of our data processing agreement with them. Alerts to ourselves about new orders may instead go through Cloudflare's email service.
8. The withdrawal form
If you declare a withdrawal online, we store what you enter (name, order number, email address, your note if any) and the date and time we received it, send you the acknowledgment the law requires, and keep the declaration with the records of the order. Legal basis: the contract and our legal obligations (Art. 6(1)(b) and (c)).
9. When you write to us
If you send us an email we use what you tell us to answer you and to deal with your request. Legal basis: steps toward or performance of a contract, or our legitimate interest in answering inquiries (Art. 6(1)(b) or (f)). We keep such correspondence as long as the matter requires, and business correspondence for as long as the law requires.
10. Instagram
The Instagram symbol on this site is an ordinary link: nothing is loaded from Instagram, and Instagram learns nothing about you, unless you click it. Where we show posts from our Instagram account on this site, our server fetches them and the images come from our own domain, so your browser still does not contact Instagram.
11. Who receives data, and where
Apart from the recipients named above (Cloudflare for hosting and security; Resend for sending our emails; Stripe for payment; our warehouse and the carrier for delivery; the provider of our own mailbox; our accountants and, where the law requires it, authorities), nobody receives your data. Service providers that work for us are bound by data processing agreements.
Our company is in Switzerland, for which the European Commission has recognized an adequate level of data protection. Cloudflare and Stripe are groups with parent companies in the United States; where personal data reaches the United States, this happens under the EU-US and Swiss-US Data Privacy Frameworks, under which both are certified, and under the standard contractual clauses in our agreements with them.
12. Your rights
You can ask us at any time what we store about you and get a copy, have wrong data corrected, have data deleted or its use restricted, receive the data you gave us in a common format, and object to processing that we base on our legitimate interests. Where processing is based on your consent you can withdraw it at any time, with effect for the future. There is no automated decision-making and no profiling on this site. Write to your@bighairaffair.com; we answer within one month and may ask you to show that you are the person the data is about. Data we must keep by law is blocked from other use instead of deleted.
You also have the right to complain to a data protection authority: in the European Union the authority of the country where you live or work, in the United Kingdom the Information Commissioner's Office, in Switzerland the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
13. Security
All traffic to and from this site is encrypted. Order data is stored in a database that only the shop's own program and we can reach; the back office is protected by a password and refuses requests from other sites. Payment details never touch our systems.
14. Changes
When the site changes, this notice changes with it; the version date at the top tells you when. The version published here at the time of your visit applies.