BEAUTLIX PRIVACY POLICY

Effective from: 1 February 2026
Last updated: 17 August 2026

This Privacy Policy explains how personal data is collected, used, stored and transferred when you use the www.beautlix.lt website, the Beautlix platform, mobile applications and other related services (collectively, the “Platform”).

1. DATA CONTROLLER

The Platform is administered and, in the circumstances described in this document, the controller of personal data is:

UAB Global shops owners
Legal entity code: 306329475
VAT identification number: LT100017569812
Registered office address: Giedraičių St. 39-R53, LT-09302 Vilnius, Lithuania
Website: www.beautlix.lt
Email for privacy and data protection matters: support@beautlix.com

Hereinafter, UAB Global shops owners is referred to as “Beautlix”, “we”, “us” or “our”.

2. WHEN BEAUTLIX ACTS AS A DATA CONTROLLER OR PROCESSOR

2.1. Beautlix acts as an independent data controller when it processes data for Platform accounts, the transmission of bookings, security, settlements with Business Users, customer support, analytics, marketing, compliance with legal obligations and the establishment, exercise or defence of its rights.

2.2. When a Client books a service, the data required for the booking is transferred to the salon, clinic, studio or professional selected by the Client (the “Service Provider”). The Service Provider independently determines how the data will be used to provide the service and therefore generally acts as a separate data controller in respect of its own processing.

2.3. When a Service Provider uses Beautlix as a system for managing clients, employees, work schedules, bookings or other business processes and determines the purposes of such processing, Beautlix may act as a data processor on behalf of the Service Provider. Such processing is governed by a separate Date Processing Agreement. Questions about the use of this data should first be directed to the relevant Service Provider.

2.4. This Policy applies to the processing of personal data for which Beautlix is responsible. It does not replace the privacy notices of Service Providers.

3. HOW WE OBTAIN DATA

We may obtain personal data:

directly from you when you register, make a Booking, complete your profile, contact us, post a review or use Platform features;
from a Service Provider or its authorised employee when they create or administer a Booking, client or employee access, or update service information;
automatically from your device, browser, application, cookies and similar technologies;
from payment, authentication, communications, analytics and other service providers used to operate the Platform;
from public registers or other lawful sources when we verify a Service Provider’s identity, registration, licence or right to carry out its activities.

If you provide data about another person, you must have the right to provide it and, where necessary, inform that person that their data has been transferred to Beautlix.

4. PERSONAL DATA WE PROCESS

4.1. Account and identity data

We may process:

first name and surname;
email address and telephone number;
login identifiers, encrypted password and authentication data;
profile photograph, selected language and account settings;
account type, role, permissions and status;
records of consents, acceptance of terms and subsequent changes.

4.2. Booking and service data

We may process:

the selected Service Provider, professional and service;
the Booking date, time, location, duration and status;
information about the creation, confirmation, modification, cancellation or non-attendance of a Booking;
Booking-related notes intended for the Service Provider;
Booking notifications and delivery information;
data relating to a complaint, refund or dispute.

4.3. Payment and accounting data

When payments are made or administered through the Platform, we may process:

the payment amount, currency, time and status;
the payment transaction number or another limited identifier;
information about invoices, subscriptions, payments and refunds;
data required for invoices or other accounting documents.

Full payment card details are normally processed directly by the selected licensed payment service provider, unless stated otherwise for a specific payment.

4.4. Service Provider and team data

We may process:

the name, surname and contact details of a Service Provider’s representative, owner, professional or employee;
legal entity, self-employment, professional registration and representation data;
licence, permit, qualification or insurance information, where required;
workplace, position, Platform role and access permissions;
work schedules, working hours, Bookings and service availability;
selected plan, subscription, billing and use of business features;
salon, professional, service and profile content.

Where a Service Provider processes work schedules, remuneration, client or other business management data for its own purposes, the Service Provider is the controller of that data and Beautlix acts on its instructions.

4.5. Communications, support and content data

We may process:

your enquiries, complaints and correspondence with Beautlix;
the date, channel, content and resolution status of communications;
reviews, ratings, photographs and other content you publish;
reports of potentially unlawful content or content that breaches the rules;
newsletter subscriptions and marketing preferences.

4.6. Technical, usage and security data

We may process:

IP address, device and session identifiers;
device type and model, operating system, application version and browser;
login, logout, error and security event logs;
pages visited, actions performed, searches, filters and usage time;
approximate location determined from your IP address, or a more precise location if you allow it in your device settings;
cookie and similar technology data.

4.7. Special categories of data

For a standard Booking, Beautlix does not request diagnoses, detailed medical histories or other special categories of data. If information about an allergy, contraindication or another health-related circumstance is necessary for the safe provision of a service, we recommend providing it directly to the selected Service Provider.

If the Platform introduces a feature specifically designed for such data in the future, additional information will be provided before collection and an appropriate basis under Article 9 of the GDPR will be ensured. Please do not enter unnecessary health information in general notes or messaging fields.

5. PURPOSES AND LEGAL BASES FOR PROCESSING

Purpose	Date processed	Legal basis
Create, authenticate and administer an Account	Account, identity, contact and security data	Performance of a contract or steps taken before entering into a contract — Article 6(1)(b) GDPR
Receive, transmit, confirm and administer Bookings	Contact, Booking, service, notification and, where applicable, payment data	Performance of a contract or steps taken before entering into a contract — Article 6(1)(b) GDPR
Provide business management features to Service Providers	Service Provider, team, client, Booking, schedule and plan data	Performance of a contract — Article 6(1)(b) GDPR; when we act as processor — the documented instructions of the Service Provider
Administer payments, subscriptions, invoices and refunds	Payment, accounting, plan and contact data	Performance of a contract — Article 6(1)(b) GDPR; legal obligation — Article 6(1)(c) GDPR
Provide customer support and resolve complaints	Contact, communication, Account, Booking and related data	Performance of a contract — Article 6(1)(b) GDPR; legitimate interest in resolving enquiries effectively — Article 6(1)(f) GDPR
Ensure Platform security and prevent fraud and abuse	Technical, login, activity, Account, payment and incident data	Legitimate interest in protecting the Platform and its users — Article 6(1)(f) GDPR; legal obligation — Article 6(1)(c) GDPR, where applicable
Verify a Service Provider’s identity and the lawfulness of its activities	Identity, registration, contact, licence and representation data	Legal obligation — Article 6(1)(c) GDPR, where applicable; legitimate interest in maintaining a trustworthy Platform — Article 6(1)(f) GDPR
Administer reviews and other content	Review, rating, Booking verification, content and report data	Performance of a contract — Article 6(1)(b) GDPR; legitimate interest in ensuring reliable information — Article 6(1)(f) GDPR; legal obligation — Article 6(1)(c) GDPR, where applicable
Analyse and improve the Platform	Aggregated usage, technical, error and statistical data	Legitimate interest in improving the Platform — Article 6(1)(f) GDPR; consent — Article 6(1)(a) GDPR where consent-based technologies are used
Send news and marketing offers	Name, email address, telephone number, marketing preferences and interaction data	Consent — Article 6(1)(a) GDPR and applicable electronic communications rules
Comply with legal, tax and accounting obligations	Contract, payment, accounting, identity and communication data	Legal obligation — Article 6(1)(c) GDPR
Establish, exercise or defend legal claims	Date relating to a dispute, contract, Booking, payment, security or communication	Legitimate interest in protecting our rights — Article 6(1)(f) GDPR

Where we rely on legitimate interests, we assess the interest of Beautlix or a third party, the necessity of the processing and the potential impact on your rights. You have the right to object to such processing as described in Section 12.

6. DATA YOU MUST PROVIDE

Date marked as mandatory during registration, a Booking, payment or Service Provider verification is required to provide the relevant feature or comply with a legal obligation. If you do not provide it, it may not be possible to create an Account, make or confirm a Booking, enable a payment, activate a Service Provider profile or provide a specific Platform feature.

You are not required to complete optional profile fields. Consent to direct marketing is voluntary and does not affect your ability to use the Platform’s core services.

7. RECIPIENTS OF PERSONAL DATA

To the extent necessary for a specific purpose, we may disclose data to:

the Service Provider you select and its authorised professionals or employees so that the Booking can be fulfilled;
payment, banking or fraud prevention service providers;
hosting, cloud, database, backup and cybersecurity service providers;
email, SMS, notification, customer support and other communications service providers;
authentication, software, technical maintenance and analytics service providers;
accountants, auditors, lawyers, insurers and other professional advisers;
an affiliated company, investor or business successor in connection with a reorganisation, merger, financing or business transfer, subject to confidentiality and data protection safeguards;
courts, law enforcement, supervisory, tax and other public authorities where we are required to provide data or have another lawful basis;
other persons where you have given valid consent or disclosure is permitted by law.

We allow processors to use data only in accordance with our documented instructions, contractual arrangements and applicable data protection requirements.

Beautlix does not sell or rent personal data to third parties.

8. SERVICE PROVIDERS AS INDEPENDENT DATA CONTROLLERS

8.1. Only the data required to administer the Booking and provide the service is transferred to the Service Provider. This normally includes your name, contact details, selected service, time, Booking status and any Booking-related notes you provide.

8.2. After receiving the data, the Service Provider may use it to provide the service, communicate with you, maintain accounting records, comply with legal obligations and defend its rights in accordance with its own privacy notice.

8.3. A Service Provider may not use Client data obtained through the Platform for marketing unrelated to the Booking without an appropriate legal basis.

8.4. Questions about a Service Provider’s processing, retention periods or marketing should be directed to that Service Provider. Beautlix can help identify which party is responsible for a particular request.

9. INTERNATIONAL DATA TRANSFERS

We primarily seek to process data within the European Economic Area (EEA). Where a service provider or its infrastructure is located outside the EEA, or data is accessed from outside the EEA, we transfer data only where there is a lawful basis and appropriate safeguards are in place, such as:

an adequacy decision adopted by the European Commission;
standard contractual clauses approved by the European Commission and, where required, additional technical or organisational measures;
another transfer mechanism provided for in Chapter V of the GDPR.

Information about the safeguards applicable to a specific transfer, or a copy of them, may be requested at support@beautlix.com. Commercially or security-sensitive information may be reasonably redacted.

10. DATA RETENTION PERIODS

We retain data no longer than necessary to achieve the relevant purpose, comply with a legal obligation or establish, exercise and defend legal claims. The main retention periods are:

Date category	Standard retention period
Account and profile data	While the Account is active and for up to 3 years after it is closed, except for data that must or needs to be retained for longer
History of Bookings, modifications and cancellations	Up to 5 years from completion or cancellation of the Booking where required for disputes, fraud prevention and evidence of service history
Customer support enquiries and complaints	Up to 3 years from final resolution or, in the event of a dispute, until its final resolution and the expiry of the applicable limitation period
Service Provider contract, verification and business Account data	For the duration of the contract and up to 10 years after it ends, to the extent necessary for legal claims or compliance with law
Payment and accounting documents	For the period required by law; where Beautlix must retain an accounting document, normally 10 years
Marketing data	Until consent is withdrawn or another lawful basis ends; evidence of consent and its withdrawal may be retained for a further 2 years
Reviews and public User content	While the content is published; after removal, a limited copy may be retained for up to 3 years for violation, dispute and rights-protection purposes
Technical, usage and security logs	Normally up to 12 months; data related to an incident, fraud or dispute is retained until the investigation and relevant legal periods have ended
Cookie data	For the periods specified in the Cookie Policy

Once a retention period expires, data is deleted, irreversibly anonymised or securely isolated until technical deletion from backups in accordance with the established backup cycle.

11. AUTOMATED DECISION-MAKING, SEARCH AND PROFILING

11.1. Beautlix does not make decisions based solely on automated processing that produce legal or similarly significant effects for you, unless you are separately informed about the specific case and your rights.

11.2. The Platform may automatically rank search results or recommendations according to the selected location, date, service category, availability, price, reviews and filters you choose. The main ranking principles are described in the Terms of Use.

11.3. Security and fraud-prevention measures may automatically flag unusual activity for additional review, but an appeal against a significant Account restriction will be reviewed with the involvement of an authorised person.

12. YOUR RIGHTS

Depending on the circumstances and the conditions set by the GDPR, you have the right to:

receive information about the processing of your data;
access the data being processed and obtain a copy;
request the correction of inaccurate data or completion of incomplete data;
request deletion of data;
request restriction of processing;
object to processing based on legitimate interests;
object to direct marketing at any time and free of charge;
receive data you have provided in a structured, commonly used and machine-readable format and, where technically feasible, transmit it to another controller;
withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
obtain human intervention, express your point of view and contest a decision where a significant decision is lawfully made solely by automated means;
lodge a complaint with a supervisory authority.

These rights are not absolute. For example, data may not be deleted where we are required to retain it by law or where it is needed to establish, exercise or defend legal claims.

You may submit a request by email to support@beautlix.com. To protect your data, we may request information reasonably necessary to verify your identity. We will respond without undue delay and no later than one month after receiving your request. In complex cases, this period may be extended by a further two months. We will inform you of the extension and explain the reasons within the first month.

If you believe that your data is being processed unlawfully, you have the right to lodge a complaint with:

State Date Protection Inspectorate
Address: L. Sapiegos St. 17, LT-10312 Vilnius, Lithuania
Email: ada@ada.lt
Website: vdai.lrv.lt

Before lodging a complaint, we suggest contacting us first so that we can examine the matter. This is not mandatory and does not restrict your right to contact the Inspectorate directly.

13. CHILDREN’S PERSONAL DATA

Only persons aged 18 or over may independently create an Account. If a service is booked for a minor, the Booking must be made by their parent, guardian or another legal representative. In such a case, please provide only the minor’s data that is necessary for the specific service and Booking.

If we learn that a minor has provided data or created an Account without the involvement of a legal representative, we may restrict the Account and delete unnecessary data.

14. DATA SECURITY

We apply technical and organisational measures appropriate to the risk to protect data against unauthorised access, loss, alteration, disclosure or destruction. Depending on the nature of the data and the risk, these measures may include:

encryption of data in transit;
management of access rights and roles;
authentication and password protection measures;
logging of activities, errors and security events;
backups, recovery procedures and system updates;
service-provider assessments, contractual obligations and employee confidentiality;
incident management and response procedures.

No electronic system can guarantee absolute security. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you as required by law.

15. COOKIES AND DIRECT MARKETING

15.1. Strictly necessary cookies are used to operate and secure the Platform. Analytics, advertising and other non-essential cookies are used only with consent where such consent is required. Detailed information about cookie names, providers, purposes and retention periods is provided in the Cookie Policy.

15.2. We send marketing emails or SMS messages only where we have an appropriate legal basis. You can withdraw consent at any time by clicking the unsubscribe link in the message, changing your Account settings or emailing support@beautlix.com.

15.3. Service and security notifications, such as a Booking confirmation, password reset or an important change to the Terms, are not direct marketing and may be sent to the extent necessary to perform a contract or comply with a legal obligation.

16. CHANGES TO THIS PRIVACY POLICY

We may update this Policy when the Platform’s features, data processing practices or applicable laws change. The latest version will always be published on the Platform together with the date of the most recent update.

Where practically and legally required, we will notify registered users by email, a Platform notification or another appropriate method before material changes that may significantly affect their rights or expectations take effect.

17. CONTACT US

For questions about this Policy, your rights or Beautlix’s processing of personal data, please contact:

Email: support@beautlix.com
Website: www.beautlix.lt