Privacy Policy
Last updated: September 2026
This policy explains what personal information we collect when you use this booking platform, why we collect it, how long we keep it, and the rights you have over it. It applies to salon customers who book appointments, to salon owners who use the management tools, and to salon staff whose details are stored in the system.
1. Who is responsible for your data
This service is operated by Le Duc Cam, Simmeringer Hauptstraße 143, 1110 Vienna, Austria, trading as The Real Red Flag. We are the data controller responsible for the personal information described in this policy. If you have questions about how we handle your data, or you want to exercise any of the rights described below, contact us using the details at the end of this page.
2. Information about salon customers
When you book an appointment you give us your name and phone number, and optionally your email address, date of birth, and any notes you add to your booking. We use this to hold your appointment, to let the salon contact you about it, and to recognise you when you book again. If you complete a feedback form after a visit, we also store your ratings and any comments you write. Booking an appointment automatically creates a customer profile at that salon so your details are available for your next visit. Salon staff may also record their own notes about your visits and preferences to help them serve you better. You can ask to see or correct these notes at any time using the contact details below.
3. Information about salon owners
Salon owners have an account with a username, name, email address, phone number, and a securely hashed password. We use this to authenticate you, to secure your account, and to operate the salon management features you use.
4. Information about salon staff
Salon owners enter their staff members' names, contact details, and job titles so appointments can be assigned to them. Customer feedback may also include ratings and comments about the staff member who provided a service. If you are a staff member and want to see or correct what is stored about you, contact your salon owner or reach us directly using the details below.
5. Why we are allowed to use your information
We process booking details because they are necessary to provide the service you asked for. We process salon owner and staff records on the basis of our legitimate interest in operating the platform and the contract between us and the salon. Optional information, such as your date of birth for birthday offers, is used on the basis of your consent, which you can withdraw at any time.
6. How long we keep your information
We aim to keep customer records for no longer than three years after your most recent appointment, staff records for three years after a staff member leaves the salon, and feedback for three years. Records we are legally required to retain for accounting and tax purposes are kept for seven years, as required by law. Data that is no longer needed is removed on review, and you can ask us to delete your data sooner at any time using the contact details below.
7. Who we share your information with
We do not sell your personal information and we do not share it for advertising. We use a small number of service providers who process data on our behalf: our hosting provider, Google Cloud, which runs the platform and database within the European Union; and Gmail, which we use to send offer and reminder emails to customers who have given us an email address. Because Gmail is operated by Google, email content may be processed on servers outside the European Union; these transfers are covered by the European Commission's Standard Contractual Clauses. Each salon can also see the customer records belonging to that salon.
8. How we protect your information
Connections to this site are encrypted with HTTPS. Account passwords are stored in hashed form and are never stored in readable text. Sign-in sessions use HttpOnly cookies that cannot be read by scripts in your browser, and session tokens are stored hashed and rotated when refreshed. Access to salon data requires authentication and is limited to the salon it belongs to.
9. Your rights
Under the GDPR you have the right to ask what personal data we hold about you, to have inaccurate data corrected, to have your data deleted, to restrict or object to how we use it, and to receive a copy of your data in a portable format. You can also withdraw consent at any time where our use is based on consent. To make a request, contact us using the details below. We handle these requests manually and will respond within one month, as required by law. Where we are legally required to retain certain records, such as accounting data, we will tell you which data we cannot delete and why.
10. Supervisory authority
We are established in Austria, so our lead supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at. If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with them. If you live in another EU country, such as Germany, you may instead complain to the data protection authority in your own country or region.
11. Cookies
We only use cookies and similar storage that are necessary for the site to work. Two cookies keep salon owners and staff signed in: one lasts about 12 hours and one lasts about 30 days. A third cookie remembers your chosen display language for about a year. We also store a small flag in your browser to remember that you have dismissed our cookie notice, so it is not shown to you again. We do not use our own cookies for advertising, analytics, or tracking, and we do not share data from our own cookies with third parties. Our landing page also offers a tutorial video hosted by YouTube. Nothing is loaded from YouTube and no YouTube cookies are set unless you choose to press play. If you do press play, the video is loaded from YouTube, which may set its own cookies and process your data under Google's privacy policy. We do not store your choice, so the video stays unloaded again the next time you open the page.
12. Changes to this policy
If we change how we handle personal information, we will update this page and revise the date shown at the top.
13. Contact us
For any question about this policy, or to exercise any of the rights described above, please email us: leduccam@therealredflag.com