Privacy Policy
OOO “EXITO” processes only the personal data necessary for account operation, orders, payment, delivery, support, website security, and separately consented marketing communications. Users may request information about processing, correction or deletion where provided by law, or withdraw consent.
OOO “EXITO” Personal Data Processing Policy
Data Controller: OOO “EXITO”, INN 9723109461, KPP 772201001, OGRN 1217700002684, address: 13 Akademika Koroleva St., Bldg. 1, Office 213, Moscow 129515, Russia. Email: system@injirhair.ru, phone: +7 (916) 258-89-29.
1. Personal Data We May Process
- first name, last name, and other identifying information the user provides in an account or order;
- phone number, email address, delivery address, and recipient details;
- organization details and company information where an order is placed on behalf of a company;
- order contents, SKU, price, payment and delivery status, and support/request history;
- technical data such as IP address, cookies, session data, device/browser information, and security events;
- professional-status information where the user requests a professional or partner account tier.
The store does not receive or store full bank-card details. Card details are entered in the payment provider’s interface.
2. Data Subject Categories and Processing Methods
The Controller may process data relating to website visitors, registered users, buyers and order recipients, representatives of legal entities and individual entrepreneurs, professionals, salons and partners requesting professional status, and persons contacting support.
Processing may be automated or mixed and may use the online-store systems, account systems, payment and logistics integrations, electronic correspondence, and technical logs. Paper documents are used only where required for contract performance, accounting/tax records, or another legal requirement.
3. Purposes and Legal Bases
| Purpose | Data | Legal Basis / Retention |
|---|---|---|
| Account and Authentication | Name, email, phone number, technical identifiers | User request/consent and operation of the service; until the account is deleted or the purpose ends, unless a longer retention period is required by law. |
| Order, Payment, Delivery | Contact details, address, order, payment/delivery status | Conclusion and performance of the contract and legal requirements; data and documents are retained no longer than required for the contract and mandatory recordkeeping. |
| Support, Returns, Claims | Contact details, order information, correspondence, request materials | The user’s request, contract, and applicable law; until the request is resolved and any mandatory retention period expires. |
| Security and Service Reliability | IP address, cookies, event logs | The Controller’s legitimate interest and information-system security; for the technically necessary period. |
| Marketing | Email / phone / communication channel | Only on the basis of separate prior consent; until consent is withdrawn. |
4. Processing Operations
Collection, recording, organization, accumulation, storage, updating, retrieval, use, necessary transfer, anonymization, blocking, deletion, and destruction, limited to the relevant processing purpose.
5. Recipients of Personal Data
Personal data may be provided to payment organizations, banks, delivery services, hosting/IT contractors, communication services, and other service providers only to the extent necessary for payment, delivery, support, or technical operation. If the user selects a third-party payment service such as PayPal, part of the processing takes place in that service’s interface and is also governed by that service’s terms and privacy documentation.
6. Data Localization and Security
When collecting personal data of Russian Federation citizens through the website, the Controller complies with the localization requirements of Federal Law No. 152-FZ. Organizational and technical safeguards, access controls, authentication, backups, and logging are used to the extent appropriate for the website infrastructure.
7. End of Processing and Deletion
When the processing purpose has been achieved, the legal basis ceases, or a valid data-subject request has been fulfilled, the Controller stops the relevant processing and deletes, destroys, or anonymizes the data in accordance with the applicable information system and storage medium, unless further retention is required by law, contract, or for the protection of lawful claims. Backup copies are removed through the normal backup-retention cycle.
8. Cookie
Technical cookies are used for authentication, the shopping cart, selected settings, security, and service stability. Analytics cookies may be used to evaluate website performance. Disabling essential cookies may affect the shopping cart or sign-in functionality.
9. User Rights
Where provided by law, the user may request information about processing, correction, blocking, or deletion of personal data and may withdraw previously given consent. Requests should be sent to system@injirhair.ru. Withdrawal of consent does not stop processing where the Controller has another lawful basis for processing, such as a legal obligation to retain documents relating to a completed order.
10. Separate Consents
Consent to personal data processing and consent to promotional communications are obtained separately from the Public Offer and other documents. Marketing communications are not a condition of purchase.
Revision: September 1, 2026.