PRIVACY POLICY

1. Data controller

Identity: Nais Hair, owner of naishair.com
Address: 131 Continental Dr, Suite 305, Newark, DE 19713, United States
Email: legal@naishair.com

We have not appointed a data protection officer.

2. Applicable legislation

We process your data in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Spanish Law 34/2002 (LSSI). For customers in the United Kingdom, in accordance with the UK GDPR and the Data Protection Act 2018.

3. What data we process, for what purpose and on what legal basis

  • Managing your order (name, billing and shipping addresses, email address, phone number and order details). Payment data is processed by the payment gateways; we do not store your full card number. Legal basis: performance of the contract (Art. 6.1.b GDPR).
  • Handling your enquiries and requests for returns, exchanges or warranty claims, via form, email, chat or WhatsApp. Legal basis: performance of the contract or pre-contractual measures, and legitimate interest in responding to your request.
  • Complying with legal obligations relating to invoicing, accounting, taxation and customs. Legal basis: legal obligation (Art. 6.1.c GDPR).
  • Sending you marketing communications by email, SMS or WhatsApp about our products. Legal basis: your consent (Art. 6.1.a GDPR). If you are already a customer, we may also inform you about products similar to those you purchased, and you can always object. You can unsubscribe at any time using the link included in each communication or by writing to us.
  • Reminding you of an order you have not completed (abandoned cart), by email or WhatsApp, if you have given us your contact details during checkout and have agreed to receive communications. Legal basis: your consent (Art. 6.1.a GDPR). You can withdraw it at any time.
  • Requesting and publishing your review of the products you buy. We send you a review request after your purchase (legal basis: legitimate interest in learning about your experience). If you decide to publish your review, it is displayed in the store with your name and, if you add them, your photos (legal basis: your consent, which you can withdraw by asking us to delete it).
  • Analytics and personalised advertising through cookies and tracking pixels. Legal basis: your consent, which you can manage or withdraw at any time (see our Cookie Policy).
  • Security and fraud prevention. Legal basis: legitimate interest (Art. 6.1.f GDPR).

We do not make decisions based solely on automated processing that produce legal effects concerning you.

4. Recipients of your data

We do not sell your data. In order to provide our service, we share it with providers acting on our behalf, including:

  • Shopify, as the store platform, for hosting and the checkout process.
  • Payment processors (for example PayPal, cards, Apple Pay and Google Pay).
  • Shipping companies (for example FedEx and DHL) and order tracking tools (AfterShip).
  • Email marketing tools, to send you marketing communications when you have consented.
  • Review apps, to request and publish your review.
  • Chat and messaging tools (including WhatsApp, by Meta), to assist you.
  • Form and customer service tools.
  • Google (Analytics, Tag Manager, Ads), Meta (Facebook and Instagram) and TikTok, for analytics and advertising, only if you accept the corresponding cookies.
  • Public authorities and bodies, where there is a legal obligation.

5. International transfers

Some of these providers are located outside the European Economic Area, for example in the United States. In such cases, transfers are covered by an adequacy decision (such as the EU-U.S. Data Privacy Framework where the provider is certified) or by standard contractual clauses.

As our company is domiciled in the United States, the data you provide to us is also processed in that country.

Orders are shipped from our facilities in China. The data required for delivery (name, address and phone number) is transferred to our operations and to the carrier in that country, as this is essential to perform the contract (Art. 49.1.b GDPR).

6. Retention period

  • Order and billing data: for the periods required by accounting, tax and warranty obligations.
  • Enquiries and requests: for as long as necessary to resolve them and handle any possible claims.
  • Marketing communications: until you withdraw your consent or unsubscribe.
  • Reviews: while they remain published or until you request their deletion.
  • Cookies: as detailed in the Cookie Policy.

Once these periods have expired, the data will be blocked or deleted.

7. Your rights

You may at any time exercise your rights of access, rectification, erasure, restriction of processing, portability and objection, as well as withdraw any consent you have given, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise them, write to us at legal@naishair.com or to our postal address, stating the right you wish to exercise. We may ask you for proof of identity in order to protect your data. We will respond within one month.

If you believe we have not processed your data correctly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or, if you reside in the United Kingdom, with the Information Commissioner's Office (ico.org.uk).

8. Minors

Our store is intended for adults. We do not knowingly collect data from minors.

9. Security

We apply reasonable technical and organisational measures to protect your data against loss, misuse or unauthorised access, including an encrypted connection (HTTPS) throughout the store. However, no system on the Internet is completely secure.

10. Changes to this policy

We may update this policy to reflect legal changes or changes to our services. The version in force is always the one published on this page.

Last updated: 17 October 2026.