Personal data processing policy

The party responsible for processing the personal data collected through the platform is:

• Data controller: Juan David Mateus Rodríguez
• Brand: Flouza — https://flouza.com
• Domicile: Bogotá D. C., Colombia
• Email for personal data matters: privacidad@flouza.com

The team in charge of handling requests, inquiries and complaints about personal data is Flouza's administration, at the email above.

Each business using the platform is an independent controller of its own clients' data for its own purposes. With respect to that data, Flouza also acts as a processor: it hosts and processes it on the business's behalf and following its instructions.

From clients who book: name, email and phone number when you provide them; date of birth only if you choose to give it; the details of your appointments (salon, service, staff member, date, time and price); the reviews you write; and the language you prefer to receive messages in.

From businesses and their staff: salon name, address, city, phone, email, description, photographs, services, prices, hours, and the name, title, photograph and description of each professional the business registers.

From any visitor: the minimum technical data needed for the site to work and stay secure, such as the IP address, the approximate country reported by the network, the browser type, and the date and time of the visit. In addition, on the pages of a salon that has turned on measurement tools, whatever the cookies section describes.

We do not ask for and do not want sensitive data — health, ethnic origin, sexual orientation, religious or political beliefs, among others. If you write any of it in an appointment's notes field, you do so on your own initiative and expressly authorize its processing to fulfill that appointment. We ask that you do not.

Nor do we knowingly collect data about minors. Where a service is provided to a minor, the booking must be made by their legal guardian.

We process personal data for the following purposes:

• Creating and managing the booking, and making it available to the chosen business.
• Sending confirmations, reminders, and notices of changes or cancellations.
• Allowing a booking to be viewed, changed or canceled.
• Creating and administering business accounts and giving them access to their dashboard.
• Displaying the business's public page, its services and its reviews.
• Producing aggregate usage statistics and reports for the business itself and to improve the platform.
• Handling requests, inquiries, complaints and claims.
• Telling businesses about the state of their account: what is left to set up, when their trial ends, and what pricing will apply.
• Asking businesses for their opinion about the platform, with the option to stop receiving those requests at any time.
• Preventing fraud, abuse and unauthorized use, and meeting legal obligations.
• Sending marketing messages and promotions only to those who have given prior, express permission.

Consent to process your data is obtained when it is collected: when you book, when you create a business account, or when you write to us. We keep a record of when and how you gave it.

Marketing is separate and always optional. Confirmation and reminder emails for your own appointments are part of the service you asked for and are always sent. Promotional messages, on the other hand, go only to those who expressly checked the relevant box. If you did not check it, you receive no marketing.

For businesses there are three levels, and the difference matters. *Account notices* —the welcome, what is left to set up, when your trial ends and what we are going to charge— are part of the service you signed up for and always arrive; they are not marketing and cannot be turned off, because without them you could not run your own business. *Feedback requests* about the platform carry a link to stop receiving them. And *Flouza news and tips* are marketing, and go only to those who checked that box.

You may withdraw that consent at any time, without giving reasons and without it affecting your bookings: every promotional email carries a one-click unsubscribe link, and you can also write to us at privacidad@flouza.com.

With the business you chose. When you book, the salon receives your name and whatever contact details you provided, so it can serve you. Without that there is no booking.

With technology providers working on our behalf, under contract and bound by confidentiality, solely to operate the service: application hosting, database, and transactional email delivery.

With Google or Meta, if the salon you're visiting turned on their measurement tools and you agreed to it. This happens only on that salon's pages and is explained in full in the next section.

With authorities, when a judicial or administrative order requires it.

We do not sell personal data. Apart from the measurement case just described — which happens only if you agree to it, and which you can refuse — we do not pass your data to third parties for their own advertising.

We use our own cookies, and only the ones the service needs to work: the one that keeps you signed in and the one that remembers which language you want the site in. Neither is used for advertising and neither is shared with anyone.

Each salon may turn on its own measurement tools — Google Analytics, Google Ads, or the Meta pixel — to learn which ads bring it clients. When it does, those tools load only on that salon's pages: its listing, its booking wizard, and your booking confirmation. Never on the search page, the home page, or another salon's pages.

What those tools receive is that someone viewed that listing, started a booking, and confirmed it, along with the service chosen, its price, and the booking code. They do not receive your name, your email, your phone number, or anything you wrote in the notes.

None of this happens without your say-so. The first time you land on the page of a salon with those tools switched on, you get a notice with two buttons of equal weight: accept or refuse. Until you answer — and also if you refuse — Google's tools run in a restricted mode, without cookies and unable to recognize you, and Meta's are not activated at all. Booking works exactly the same either way.

Your answer is stored in one of our own cookies for six months. To change it, clear this site's cookies in your browser.

In that measurement, the salon and Flouza each act on our own account: the salon decides to turn it on and what it does with what it receives, and we provide the mechanism and this information. Google and Meta handle that data under their own policies, which you can read on their sites.

The servers of our hosting, database and email providers may be located outside Colombia, including in the United States and the European Union.

By accepting this policy you expressly authorize that international transfer and transmission of your data, under article 26 of Law 1581 of 2012. We require those providers to meet security and confidentiality standards equivalent to our own.

As the data subject you have the right to:

• Know, update and correct your personal data.
• Request proof of the consent you gave, except where the law does not require it.
• Be told how your data has been used.
• Withdraw consent and request deletion of your data, where no legal or contractual duty requires it to be kept.
• Access your personal data free of charge.
• File complaints with Colombia's Superintendency of Industry and Commerce for breaches of data protection law, once the inquiry or complaint process with us has been exhausted.

These rights are exercised by the data subject, their successors, their representative or attorney-in-fact, or someone acting under a stipulation in their favor.

Write to privacidad@flouza.com stating your name, the contact detail you booked with, a description of what you are asking for, and how you would like us to reply.

Inquiries: answered within a maximum of ten (10) business days. If that is not possible, we will tell you why and when it will be answered, which will be no more than five (5) business days after the first deadline.

Complaints: answered within a maximum of fifteen (15) business days. If that is not possible, we will tell you why and when it will be answered, which will be no more than eight (8) business days after the first deadline.

If a complaint is incomplete, we will ask you to complete it within the following five (5) days. After two months with no reply from you, it will be treated as withdrawn.

You may ask us to delete your personal data at any time. When we do, we mask your name, email and phone number so that they no longer identify you.

The record of appointments already provided is kept without those identifying details, because it forms part of the business's accounting and tax history, which the law requires it to keep. In other words: you stop being identifiable, but the appointment still counts as a sale for the salon.

Data is kept for as long as the relationship lasts and, afterwards, for the applicable statutory limitation periods.

We apply reasonable technical and administrative measures to protect the data: traffic encryption, passwords stored using key-derivation functions, role-based access control, expiring sessions, and logging of administrative actions.

That said, and consistent with the demonstration phase the platform is in, no measure offers absolute security. Flouza undertakes to act diligently and to report promptly any incident affecting your data, as the law requires.

This policy takes effect on its publication date and remains in force for as long as Flouza processes personal data. Databases are kept for as long as needed to fulfill the purposes described.

Any substantial change will be announced on the site and, where appropriate, by email, before it takes effect.