Privacy Policy

This Privacy Policy explains how BarbaSolution d.o.o. ("BarbaSolution", "we", "us", or "our") collects, uses, stores, and protects personal data when you use the BarbaGlow application and related services (the "Service"). We are committed to protecting your privacy and processing personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable data protection laws in Bosnia and Herzegovina.

1. Data Controller

The data controller responsible for your personal data is: BarbaSolution d.o.o. Musala 7, 71000 Sarajevo, Bosnia and Herzegovina Company ID (ID): 4200825260050 VAT (PDV): 200825260009 Email: info@barbasolution.com For any privacy-related inquiries, contact us at the email address above.

2. Who This Policy Applies To

BarbaGlow is a software-as-a-service (SaaS) platform for salons and service businesses. This Policy applies to two categories of individuals: Account holders ("Customers") — the salon owners, managers, and employees who subscribe to and operate the Service. End clients — individuals whose appointment and contact data is entered into the Service by a Customer (for example, a salon's clients booking appointments). For data relating to end clients, the Customer acts as the data controller and BarbaSolution acts as the data processor, processing such data only on the Customer's behalf and instructions.

3. Personal Data We Collect

Depending on how you use the Service, we may collect: Account and identity data: name, email address, phone number, business name, and login credentials. Billing data: subscription plan, billing history, and transaction records. Payment card details are processed by our payment provider (Paddle) and are not stored on our servers. Client and appointment data entered by Customers: client names, contact details, appointment times, services booked, and related notes. Technical data: IP address, browser type, device information, log data, and usage analytics. Cookies and similar technologies as described in our Cookie Policy.

4. How We Use Personal Data

We process personal data to: provide, operate, and maintain the Service; create and manage accounts and authenticate users; process subscriptions and payments; send transactional communications (e.g. appointment reminders, booking confirmations, account notifications); provide customer support; improve and analyze the Service; detect, prevent, and address fraud, abuse, and security issues; comply with legal obligations.

5. Legal Bases for Processing

We rely on the following legal bases under the GDPR: Performance of a contract — to deliver the Service you subscribe to. Legitimate interests — to secure, maintain, and improve the Service, provided your rights do not override these interests. Consent — for non-essential cookies and certain marketing communications, where applicable. Legal obligation — to comply with accounting, tax, and other legal requirements.

6. Payment Processing

Payments are processed by Paddle (Paddle.com Market Ltd), which acts as the Merchant of Record for purchases of BarbaGlow subscriptions. Paddle handles payment data, billing, and tax compliance under its own privacy policy. We receive transaction confirmations and limited billing information but do not store full payment card details.

7. Third-Party Services and Processors

We share personal data only with service providers necessary to operate the Service, including: Paddle — payment processing and billing. Infobip — transactional SMS, Viber, and email delivery. Hosting and infrastructure providers — for secure data storage and application hosting. Analytics and advertising providers — Google Analytics, Google Ads, and Meta Pixel, as described in our Cookie Policy. These providers process data only as needed to perform their services and are bound by appropriate data protection obligations.

8. International Data Transfers

Where personal data is transferred outside Bosnia and Herzegovina or the European Economic Area, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or transfers to providers in countries with an adequate level of data protection.

9. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy, or as required by law (for example, billing records retained for accounting and tax purposes). When data is no longer needed, we securely delete or anonymize it. Customers may request deletion of their account data as described below.

10. Your Rights

Subject to applicable law, you have the right to: access the personal data we hold about you; rectify inaccurate or incomplete data; request erasure of your data ("right to be forgotten"); restrict or object to certain processing; data portability; withdraw consent at any time, where processing is based on consent; lodge a complaint with a supervisory authority. To exercise these rights, contact us at info@barbasolution.com. If you are an end client whose data was entered by a salon, please contact that salon directly, as they are the controller of your data; we will assist them as processor.

11. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, including encryption in transit, access controls, and secure infrastructure. No method of transmission or storage is completely secure, but we continuously work to protect your data.

12. Children's Privacy

The Service is intended for businesses and is not directed at children under 16. We do not knowingly collect personal data from children. End client records are managed by Customers, who are responsible for any consent required.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date reflects the latest revision. Material changes will be communicated through the Service or by email.

14. Contact

For questions or requests regarding this Privacy Policy or your personal data, contact: BarbaSolution d.o.o. Musala 7, 71000 Sarajevo, Bosnia and Herzegovina Email: info@barbasolution.com