Controller and Processor
GDPR distinguishes between a data controller (who decides why and how personal data is processed) and a data processor (who processes data on a controller’s behalf). Hathor plays both roles, depending on the data.
- For your account and business data — the information you give us to open and run your Hathor account — we act as the controller.
- For End-Client Data — the personal data about your own clients and prospects that you upload to or generate within the Service — you are the controller and we act as your processor, handling that data only on your documented instructions under our Data Processing Agreement (DPA).
The controller/processor split is set out in full in our Privacy Policy and DPA. If there is any conflict on End-Client Data, the DPA governs.
Lawful Bases for Processing
Where we act as controller, we rely on one or more of the following lawful bases under Article 6 GDPR:
- Performance of a contract — to provide the Service you have subscribed to.
- Legitimate interests — to secure, maintain, and improve the Service, and to prevent fraud and abuse, balanced against your rights.
- Legal obligation — to meet accounting, tax, and other legal requirements.
- Consent — for optional communications, which you can withdraw at any time.
Your Rights
If you are in the EU or the UK, you have the following rights over your personal data, which you can exercise free of charge:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have your data deleted where there is no overriding reason to keep it.
- Restriction — limit how we process your data in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where processing is based on consent, without affecting prior processing.
To exercise any of these rights over data we control, contact us at support@hatthor.online. If your request concerns data held by a salon that uses Hathor (End-Client Data), we will refer you to that salon as the controller, or assist them in responding.
If you have a Hathor account, you can act on these rights yourself right away: sign in and open Settings → Privacy & data to export a copy of your account data or to permanently delete your account. If you signed in with a social account such as Facebook, you can also request deletion from that platform’s app settings, or follow the steps at our data-deletion page (/legal/data-deletion). We respond to requests within one month, as the GDPR requires.
Hosting and International Transfers
We host the Service and store personal data on infrastructure located in the European Union. Where a limited number of sub-processors (such as payment and communications providers) process data outside the EU/EEA, we rely on appropriate safeguards recognised under GDPR, such as the European Commission’s Standard Contractual Clauses.
We maintain a Data Processing Agreement with each customer for End-Client Data, and we flow equivalent obligations down to our sub-processors.
Contact and Complaints
For any data-protection question, or to raise a concern, contact support@hatthor.online. The data controller for account and business data is NEXEMA Group SASU, 38 Rue des Mathurins, 75008 Paris, France, governed by the law of France.
You also have the right to lodge a complaint with your local data-protection supervisory authority if you believe your rights have not been respected. We would appreciate the chance to address your concern first.