Controller SOCIETY acts as the data controller and is responsible for managing your personal data (referred to as “we,” “us,” or “our” in this privacy notice). If you are a client of our salon, we will function as a joint data controller.
We have designated a Data Privacy Manager to oversee matters related to this privacy notice. If you have any questions or wish to exercise your legal rights regarding your personal data, please reach out to the Data Privacy Manager using the contact details provided below.
Our Details
SOCIETY is registered in Bangalore, Karnataka, located at: NO.187/A, 22nd Cross Rd, Sector 3, HSR Layout, Bengaluru, Karnataka 560102
Contact Us
For the attention of: Data Privacy Manager
Email: info@society.co.in
Postal Address: NO.187/A, 22nd Cross Rd, Sector 3, HSR Layout, Bengaluru, Karnataka 560102

You have the right to file a complaint with the Information Commissioner’s Office (ICO), the supervisory authority for data protection issues in India. However, we would appreciate the opportunity to address your concerns first, so please contact us directly before seeking legal advice.

Use of 17 September 2024.
Changes to the Privacy Notice and Your Duty to Inform Us of Changes This privacy notice was last updated on 15 September 2024. We reserve the right to modify this privacy notice at any time. Any updates or changes will be posted on this page, and, where appropriate, you will be notified via email. It is crucial that the personal data we have on record is accurate and up to date. Please inform us of any changes to your personal information during your association with us.

Third-party Links Our website may contain links to external websites, plug-ins, or applications. Clicking on these links or enabling certain connections might allow third parties to gather or share data about you. We do not have control over third-party websites and are not responsible for their privacy policies. When leaving our site, we recommend reviewing the privacy policy of every website you visit.

The Data We Collect About You
Personal data, or personal information, refers to any information that can be used to identify an individual. This does not include data where the identity has been removed (anonymous data).
We may collect, use, store, and share various types of personal data about you, grouped as follows:
Identity Data: This includes your first name, last name, username or similar identifier, title, date of birth, gender, and facial imagery.
Contact Data: Includes your billing address, delivery address, email address, and telephone numbers.
Transaction Data: Consists of details regarding payments to and from you and other details of products and services you have purchased from us.
Technical Data: Encompasses your internet protocol (IP) address, login details, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, platform, and other technology on devices you use to access our website.
Profile Data: Contains your username and password, purchases or orders made by you, reward card points, preferences, feedback, and responses to surveys.
Allergy Test Data: Involves information gathered during allergy tests and any medical conditions that could impact the services provided.
Usage Data: Covers how you use our website, products, and services.
Marketing and Communications Data: Reflects your preferences in receiving marketing from us and third parties, as well as your communication preferences.
We also collect, use, and share Aggregated Data—statistical or demographic data collected for various purposes. Aggregated Data may be derived from your personal data but is not considered personal data under the law as it does not reveal your identity directly or indirectly. For example, we may aggregate your Usage Data to determine the percentage of users accessing a specific feature on our website. However, if Aggregated Data is combined with your personal data in a way that allows you to be identified, we will treat it as personal data and use it in accordance with this privacy notice.
Aside from health information and Allergy Test Data, we do not collect any special categories of personal data about you. Additionally, we do not collect information relating to criminal convictions and offenses.

If You Fail to Provide Personal Data
Where we are required by law or by the terms of a contract to collect your personal data and you do not provide it when requested, we may be unable to fulfill the contract we have with you (for instance, to provide goods or services). In such cases, we may have to cancel your order or service, but we will inform you of this at the time.
How We Collect Your Personal Data
Direct Interactions: You may provide us with your Identity, Contact, Transaction, Profile, and Allergy Test Data when visiting our single SOCIETY salon, filling out forms, or contacting us by post, phone, email, or other means. This includes when you:
Purchase products or services;
Make an appointment
Sign up for our rewards card
Subscribe to our services or publications
Request marketing communications;
Participate in a competition, promotion, or survey
Provide feedback
Our salon operates a CCTV system, recording your image during visits to ensure the security of our customers, employees, and business.

Automated Technologies and Interactions
As you navigate our website, we may automatically collect Technical Data about your device, browsing actions, and usage patterns. This personal data is gathered through cookies, server logs, and other similar technologies. For more information regarding our use of cookies, please refer to our Cookie Policy.
Third-Party Data Sources
We may also receive personal data about you from the following third-party sources
Technical Data from analytics providers, such as Google;
We partner with Ve The Society (or the appropriate Indian legal entity, if applicable). Ve collects personal data from users who visit our website using cookies and other similar technologies. You can find detailed information about these technologies in Ve's Cookie Policy.
Ve collects personal data to understand users' preferences and personalize their web experience. For example, it may display personalized offers when you visit our site or advertisements when you visit third-party websites. We and Ve are jointly responsible for collecting personal data under the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) in India.
For more details on how Ve collects and processes data, refer to their Privacy Policy. Users can prevent their personal data from being processed by Ve through various methods outlined in Ve’s Privacy Policy, such as opting out via https://www.ve.com/de/datenschutzerklaerung#opting-out or using the opt-out mechanism in compliance with the DPDP Act, 2023.

How We Use Your Personal Data
To fulfil a contract, we are about to enter into or have already entered into with you.
When it is necessary for our legitimate interests (or those of a third party), provided that your interests and fundamental rights do not override these interests.
Generally, we do not rely on consent as a basis for processing your personal data except for sending marketing communications via email, SMS, or telephone. You have the right to withdraw your consent for marketing at any time by contacting us using the details provided above.
Below is a summary of how we intend to use your personal data, including the legal bases for processing it. We have also noted our legitimate interests where applicable.
We may process your personal data under multiple lawful grounds depending on the specific purpose for which it is used. If you need details about the specific legal grounds we are relying on for processing your data, please contact us using the information provided above.

Marketing
Promotional Offers from Us
We may use your Identity, Contact, Technical, Usage, and Profile Data to assess what products, services, and offers might be of interest to you. This helps us tailor our marketing efforts and provide you with relevant information based on your preferences and interactions with us.
You will receive marketing communications from us if you have requested information, purchased goods or services, or provided your details during a competition or promotion, provided you have not opted out of receiving such communications.
Third-Party Marketing
Opting Out
Contact us using the details provided above.
Visit our salon directly.
Unsubscribe from marketing emails by following the link at the bottom of each email.
Reply “STOP” to marketing SMS messages.
Inform our team during marketing calls to stop receiving such calls.
Please be aware that there may be a brief delay in stopping marketing communications as our systems update your preferences. After this period, you will still receive essential information and service updates.

Change of Purpose
We will use your personal data solely for the purposes for which it was originally collected, unless we determine that it is necessary to use it for another reason that is compatible with the original purpose. If you need an explanation on how the new purpose aligns with the original one, please contact us using the details provided above.
If we need to use your personal data for a purpose unrelated to the original one, we will notify you and explain the legal basis that permits us to do so.
Please be aware that, in accordance with applicable laws, we may process your personal data without your knowledge or consent if required or permitted by law.
Disclosures of Your Personal Data
Business Transfers: Third parties to whom we may sell, transfer, or merge parts of our business or assets. If we undergo such a change, the new owners may use your personal data in the same manner as described in this privacy notice.
We require all third parties to ensure the security of your personal data and to handle it in compliance with the law. We do not permit our third-party service providers to use your personal data for their own purposes. They are only allowed to process your data for specified purposes and in accordance with our instructions.

International Transfers
Your personal information may be stored at our offices and those of our group companies, franchisees, third-party agencies, service providers, representatives, and agents, as described in the "Disclosures of Your Personal Data" section. Some of these third parties may be based outside your home country. For more details, including how we safeguard your personal data, please refer to the section below, "Transferring Your Personal Information Out of India."
Transferring Your Personal Information Out of India To deliver services to you, it may sometimes be necessary to share your personal information outside India. This could happen, for example:
If your or our service providers are located outside India.
If you are based outside India.
Such transfers are regulated by the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023), meaning we can only transfer your personal data to a country or international organization outside India when:
The Indian government has issued an "adequacy decision" regarding that country or organization.
Appropriate safeguards are in place, including enforceable rights and effective legal remedies for data principals (you as the user).
A specific exception applies under the DPDP Act, 2023.
In all cases, we ensure the transfer complies with the relevant data protection laws, and that your personal data and rights are sufficiently protected. We remain committed to ensuring that your data is handled securely and in accordance with all applicable regulations.

Indian Government Adequacy Decision
Under the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023), the Indian Government has the authority to determine whether a country or international organization provides an adequate level of protection for personal data. This is done through an "adequacy decision." If a country or organization receives such a decision, personal data can be transferred from India to that entity without needing additional safeguards.
It can take several years for the Indian Government to issue an adequacy decision. As of now, only a limited number of countries may benefit from this decision.
For countries or international organizations that do not have an adequacy decision, this does not necessarily imply inadequate protection of personal data. Instead, we must use alternative measures for transferring personal information. These measures might include implementing appropriate safeguards or relying on specific exceptions as permitted under the DPDP Act, 2023, to ensure that your data remains protected.

Transfers With Appropriate Safeguards
We may transfer your data to a third country or international organization under this basis when we ensure that the transfer complies with Indian data protection laws. Specifically, we will verify that appropriate safeguards are in place and that enforceable rights and effective legal remedies are available for data principals (users).
These safeguards generally include utilizing standard data protection contract clauses or similar mechanisms that are approved by the Indian Government under the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023).

Transfers Under an Exception
In the absence of an adequacy decision or appropriate safeguards, we may transfer personal information to a third country or international organization where an exception under the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) applies. These exceptions include:
Explicit Consent: You have explicitly consented to the proposed transfer after being informed of the potential risks involved.
Contractual Necessity: The transfer is necessary for the performance of a contract between us or to take pre-contract measures at your request.
Contract in Your Interests: The transfer is necessary for a contract in your interests, between us and another person.
Legal Claims: The transfer is necessary to establish, exercise, or defend legal claims.
Additionally, we may transfer information to pursue our compelling legitimate interests, provided these interests are not overridden by your interests, rights, and freedoms. Specific conditions apply to such transfers, and we will provide the relevant information if and when we seek to transfer your personal information on this basis.

Further Information
If you require more information about data transferred outside India, please contact our Data Privacy Manager using the details provided in the "Contact Us" section above.

Data Security
We have implemented appropriate security measures to protect your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed.
Access Control: Access to your personal data is restricted to employees, agents, contractors, and other third parties who have a legitimate business need to know.
Processing Instructions: They are permitted to process your personal data only according to our instructions and are bound by a duty of confidentiality.

Data Retention

Your Legal Rights
Request Access: You can request access to your personal data.
Request Correction: You can request correction of your personal data.
Request Erasure: You can request erasure of your personal data.
Object to Processing: You can object to the processing of your personal data.
Request Restriction: You can request restriction of the processing of your personal data.
Request Transfer: You can request transfer of your personal data.
Withdraw Consent: You can withdraw your consent where we rely on it for processing your data.

Glossary
Lawful Basis
Third Parties
Internal Third Parties
External Third Parties
HM Revenue & Customs, Regulators, and Other Authorities
Marketing Platforms
Your Legal Rights
Request Access to Your Personal Data
Request Correction of Your Personal Data
Request Erasure of Your Personal Data
Object to Processing of Your Personal Data
Request Restriction of Processing of Your Personal Data
Request Transfer of Your Personal Data
Withdraw Consent
Your Legal Rights