Privacy Policy
Last updated: 14 October 2026
Who handles your information
ALIA KFT operates On_Lia and is the data controller for On_Lia website, member accounts, enquiries and appointments. Salon/contact address: József Attila utca 10, Budapest, Hungary. Privacy requests: onliahair@gmail.com or WhatsApp +36 30 597 9746.
Information and purposes
We handle names, email addresses, telephone numbers and account/login information to manage membership, appointments and contact. Bookings include the chosen service, date/time, status, messages, relevant communications and acknowledgement of the safety reminder; these support service delivery, confirmations and reminders. If you choose Google or Facebook sign-in, the provider can share profile information authorized by your settings; we do not receive that provider's password.
Where a service asks for consultation details, we receive current hair photos, style/colour references, recent treatment history and hair length/condition to assess the proposed service. Submit only necessary information and frame photos around your hair where practical. Do not include unrelated people, identity documents or health details in uploads, history answers or messages; discuss allergies and previous reactions with your stylist at the salon. The platform and enabled features may also process IP addresses, browser/device details, security events and cookies.
Required fields are identified in forms. Without necessary booking information, an online booking may not be completed. Optional marketing choices are separate.
Health-related information and the safety reminder
The online booking form does not ask you to report allergies or reactions to previous chemical treatments. If you have had an allergic reaction or discomfort after a chemical treatment, please tell your stylist at the salon before treatment. The required checkbox confirms only that you have read this reminder; it does not state your health status and is not consent to process health data. Do not put allergies, reactions, diagnoses or medication details in online answers, messages or uploads. Removing the online question does not mean health information can never be handled: any separately recorded in-salon information or health information received through another channel needs its own legal assessment and safeguards.
Legal grounds
Ordinary account/booking information is used for steps at your request and performing the service agreement (GDPR Article 6(1)(b)). Applicable legal duties may require records (Article 6(1)(c)). Security, disputes and legal rights may rely on legitimate interests balanced against your rights (Article 6(1)(f)). Optional marketing and non-essential cookies rely on consent where required (Article 6(1)(a)). Separate health-information processing within the GDPR's scope requires an applicable Article 6 basis and Article 9 condition, explained for that processing. Where explicit consent is relied on, it must be obtained separately; reading the safety reminder or accepting booking rules does not provide it.
Recipients and transfers
Staff who need information to arrange or provide your service may access it. Wix hosts the website and supports member/booking functions and storage. Your selected sign-in or contact providers, such as Google, Facebook, WhatsApp, Instagram or KakaoTalk, also process data under their own notices. Disclosure may be required by law or for legal claims.
Providers may process data outside the European Economic Area. Wix describes its processing and transfer safeguards in its Data Processing Agreement and Privacy Policy, linked below. Contact us about the providers relevant to your booking.
Photos, marketing and retention
Consultation uploads are for assessing and preparing your appointment. Submission does not authorize portfolio or advertising publication; promotional use needs separate specific permission. Account creation and booking alone do not subscribe you to marketing.
Retention depends on purpose: account data while needed for the account; appointment/communication records while needed for the service and related enquiries or claims; consultation photos and notes while needed for that consultation or separately agreed follow-up. Legal duties can require longer retention of specific records. We consider sensitivity, the appointment or dispute, legal requirements and original purpose. Ask about the period applicable to your data or request deletion. Account deletion does not necessarily remove records lawfully retained.
Your rights
Subject to legal conditions, request access, correction, deletion, restriction or a portable copy, or object to legitimate-interest processing. Withdraw consent without affecting previous lawful processing. Contact us above; identity verification may be needed. We respond without undue delay, normally within one month, and explain lawful extensions or restrictions.
You can complain to Hungary's NAIH or another competent supervisory authority. NAIH's official contact/submission and online-procedure links are below. Contacting us first is not a condition for complaining.
Cookies and changes
Essential cookies support login and security. Optional cookies or similar tracking should activate only after the required consent. Browser cookie removal/blocking may affect login and booking. Use site cookie preferences if available. Optional tracking details need to reflect the live cookie information and controls. External services have their own privacy practices. We update this notice as processing changes; a materially new use may need fresh notice or consent.
NAIH: contact and complaint procedures