Privacy Policy

Short Cuts Barbershop
Calle Jaume Ferrer 7, 07012, Palma de Mallorca, Illes Balears, Spain
NIF: X5207741N
Contact: lopd@shortcutsbarber.com

• Booking data: name, email address, mobile phone number, preferred language, chosen service, chosen barber, appointment date and time, any notes you add when booking, and date of birth (optional).
• Customer record data: if you've booked with us before, we keep a record matched by your phone number so we can recognize returning customers, track visit history, and avoid asking you to re-enter your details every time.
• Technical and security data: for admin access to our booking system, we keep security logs (hashed IP address and browser identifier, login attempt timestamps) solely to detect and block unauthorized login attempts. This data is not linked to customer bookings.
• Cookies: we use essential cookies only — to remember your language preference and, for staff, to keep an admin session signed in. We do not use advertising or tracking cookies.

We do not collect payment card details through the website. Payment is made in person at the shop by cash, card, or Apple Pay.

We normally collect personal data directly from you when you make a booking, contact us, or use our website. Where a parent or guardian makes a booking for a child, the information relating to the child is provided by the parent or guardian.

• To create, confirm, and manage your booking.
• To send booking confirmation and cancellation emails.
• To add your appointment to our shop's calendar.
• To recognize you as a returning customer and maintain accurate records.
• To comply with Spanish tax, accounting, and invoicing obligations.
• To keep our booking system secure and prevent misuse.

We process your data based on:

• Contract performance — to fulfil the booking you've requested.
• Legitimate interest — to keep our systems secure and maintain accurate customer records for service quality.
• Legal obligation — to meet Spanish tax and accounting requirements.

We do not send marketing communications, and we do not process your data based on marketing consent.

We only share data with the service providers needed to run our booking system:

• Supabase — our database provider, which stores your booking and customer record data.
• Resend — our email provider, used to send booking confirmation and cancellation emails.
• Google — used to synchronize appointment information with the shop's business calendar.
• Lovable — the platform used to build and host our booking website.

These providers act as data processors on our behalf under data processing agreements. We do not sell your data, and we do not share it with any third party for their own marketing purposes.

If any of these providers store or process data outside the European Economic Area, we rely on appropriate safeguards (such as Standard Contractual Clauses) to ensure your data remains protected to EU standards.

• Booking and invoicing records are kept for the period required by Spanish law, which may be six years for certain business records.
• Customer records are kept while you remain an active customer and deleted on request unless we're legally required to retain them.
• Admin security logs are kept only as long as needed to detect abuse, then automatically discarded.

Under GDPR and Spanish law, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data, where we're not legally required to keep it.
• Restrict how we process your data in certain circumstances.
• Object to processing based on legitimate interest.
• Port your data to another provider, where technically feasible.

You also have the right to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at lopd@shortcutsbarber.com. We may ask for identity verification before processing a request.

If you believe your data protection rights have not been respected, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es.

We take appropriate technical and organizational measures to protect your data against unauthorized access, loss, or misuse. Customer booking and payment data is access-restricted at the database level, with no public access — only authenticated staff and the booking system itself can read or write this data. Admin access is password-protected and rate-limited against repeated login attempts.

Our platform provider, Lovable, maintains security and compliance documentation, and our database provider, Supabase, maintains its own security certifications. No system can be guaranteed completely secure, but we take reasonable, ongoing steps to protect your information.

Our booking system allows parents or guardians to book haircuts for children (our "Kids Haircut" service, for under-12s). Where a booking is made for a minor, the personal data collected (name, and the parent/guardian's contact details) is provided by the responsible adult making the booking, not the child directly.

We may update this policy from time to time. The "Last updated" date at the top always reflects the current version. Significant changes will be reflected on this page.