PMUezy Privacy Notice

External policy or terms | Version 1.0 | 2 October 2026

This notice explains personal data use in PMUezy's websites and apps, including Professional, Client and Advertiser accounts. Managezy Ltd trading as PMUezy, company 812735, is at 46 Enterprise Centre, Lavery Avenue, Park West Business Park, Dublin 12, Ireland, D12 PP48. Contact privacy@pmuezy.com for privacy requests or support@pmuezy.com for service assistance.

1 Who is responsible

PMUezy is controller for its own account, billing, platform security, business relationship, public platform and marketing activities. A Salon is a separate controller for the client information it collects for bookings, treatment, forms, images and client communications. PMUezy stores and operates those Salon records as processor under a DPA. Ask the Salon for its own notice, lawful bases, retention periods and contact details. An artist acting under the Salon's authority does not become owner of your privacy rights.

Where the same information serves different purposes, responsibility follows the purpose. For example, we manage your Client login as controller while handling a treatment form on the Salon's instructions as processor. We help forward requests to the relevant Salon and do not decide that all treatment records are exempt from erasure.

2 Information and sources

You provide Client name, email, phone and date of birth, account choices, bookings and messages. Clients do not provide a home address at registration. Professionals and Advertisers provide personal and business names, business address, email, phone, company and tax details where applicable, logos and profile information; Salon profiles include opening hours. A Salon may provide staff invitations, appointment information, client forms, treatment records, images and signed documents. Other people may provide content reports or complaints about activity involving you.

Client sign in through Apple or Google provides the sign in identifier and account information authorised by that service, such as name and email. Stripe provides billing, transaction and subscription information. Stripe handles card details; PMUezy does not store full card numbers or CVCs. We record permissions, consents and relevant security and audit events. Optional analytics uses the information described in Cookie Settings and the Cookie Policy.

With your device permission, current location supports nearby search while you use it. PMUezy does not save precise location or search history for that feature. You may search manually. We use a push token and notification content for notifications. A token can identify an installation and is personal data when linkable to you, even if it contains no name. Network services also necessarily handle technical connection information; a policy against storing IP addresses does not mean that no provider ever processes an IP address.

3 Purposes and lawful bases for our controller activities

Account creation, sign in, requested platform features, service messages and support use Article 6(1)(b) where necessary for our contract with you. For business staff who are not themselves the contracting person, Article 6(1)(f) supports administration of our legitimate business relationship, with limited data and permissions.

Professional subscriptions, advertising orders and payment administration use Article 6(1)(b) for individual contracting traders and Article 6(1)(f) for business contacts. Accounting and tax retention uses Article 6(1)(c), including applicable Irish company and tax record obligations. We use only the information necessary for these purposes.

Security, fraud prevention, proportionate audit logs, handling ordinary complaints and establishing or defending legal claims use Article 6(1)(f): our interests in a secure service and fair resolution of disputes. A specific legal reporting or disclosure duty uses Article 6(1)(c). We assess necessity and your rights, minimise access and allow objections where the law provides. We do not treat a general interest in improvement as permission to use health records.

Optional Google Analytics and similar nonessential device access use your consent under Article 6(1)(a) and applicable ePrivacy rules. Professional and Advertiser email marketing and promotional push messages use a separate opt in under our consent based policy. We do not send Client marketing emails. Refusal or withdrawal does not affect your account. Essential service messages are not marketing and must not conceal promotional material.

Current location and optional device functions operate when requested and permitted. Where consent is the applicable basis, it can be withdrawn in device or account settings. Operating system permission alone is not a substitute for a separate marketing or cookie choice.

We may create genuinely anonymous aggregate statistics to understand and improve the service. Creating them from our controller data must itself have a lawful basis and safeguards; any use of processor data must be within the Salon's lawful instructions. Anonymous outputs must not enable reasonable reidentification.

4 Health data and treatment media

Forms may include health information and photographs revealing health information. The Salon must identify both an Article 6 basis and an Article 9 condition, often explicit consent where suitable, rather than assume every beauty treatment is healthcare. Treatment consent and data protection consent are distinct. PMUezy does not make clinical decisions, analyse images with AI, use facial recognition or send records to an AI provider.

We do not use client medical data for advertising. Images are not used in PMUezy's own marketing. Public or Salon marketing use requires separate appropriate permission. We do not routinely inspect private chat. Exceptional authorised technical access is limited, role based and logged; no claim of end to end encryption is made.

5 Who receives information

The chosen Salon and its authorised personnel receive the information needed for your booking and records. Other Salons do not receive your private records merely because they use PMUezy. Content you choose to make public through a Professional profile, feed or advertisement is available to its public audience and may be copied by others.

Our providers include Hetzner for hosting and email, Stripe for payments, Expo for push delivery with underlying Apple and Google services, Google for maps and optional web analytics, Apple and Google for Client sign in, Sentry for technical error monitoring, and GoHighLevel for Professional and Advertiser CRM, support and marketing. Roles vary by service: some providers process on instructions and some independently determine specific purposes. Our Subprocessors and Service Providers document describes these distinctions. A Salon's own email provider handles its newsletters; it is not automatically PMUezy's subprocessor.

Push payloads are limited to a token and notification content; they must not include health forms or treatment media. Technical monitoring excludes client and health content and must be configured to remove identifiers and sensitive fields. GoHighLevel receives business contact details such as name, email and phone, not Salon clinical records. We may disclose necessary information to professional advisers, regulators, courts or a successor in a business transfer subject to law, confidentiality and appropriate notice.

6 Locations and international transfers

Core services and databases are hosted with Hetzner in Nuremberg, Germany. Connected providers may process information or provide support outside the EEA. EU hosting of the core database does not mean every integration is EEA only. Before a restricted transfer, we require a valid mechanism under GDPR Chapter V, such as an applicable adequacy decision or appropriate standard contractual clauses with assessment and supplementary safeguards as required. We do not rely on a provider's brand or a general privacy policy as proof of a valid transfer mechanism. Ask privacy@pmuezy.com for the applicable safeguards and a copy, subject to lawful redactions.

7 Retention

Client account data is ordinarily removed from active systems within 30 days after verified deletion, subject to a justified exception. We warn before deleting accounts inactive for 24 months. A Salon's separately held records may remain under its retention policy; closing a login does not automatically erase treatment documentation.

Booking history, treatment records, signed forms and documentation images use a configurable five year default, with the Salon responsible for a justified duration and trigger. Chat is normally deleted 12 months after the last message, unless information is separately incorporated into lawful treatment documentation. Marketing image permissions are reviewed after one year; PMUezy reminds the Salon and the Salon must act. A reminder does not authorise continued use after permission expires or is withdrawn.

When a Salon's service ends, a 60 day read only export period is followed by deletion from active systems. Daily encrypted backups use a 30 day rolling expiry after active deletion. PMUezy's accounting and tax records are generally kept for six years under applicable requirements, longer for a specific lawful inquiry or hold. Consent and objection records are kept only as necessary to evidence compliance and prevent unwanted marketing. Support and security records follow a justified schedule reviewed for necessity; ask us for details relating to a particular record. Cookie and analytics durations are stated in Cookie Settings.

Where a legal claim, tax inquiry or legal obligation requires restricted retention, we retain only necessary records, restrict their use and review the hold. Deletion deadlines do not override a person's right to a timely response.

8 Your rights

Depending on the circumstances, you can request access and a copy, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You can object to direct marketing at any time; we stop that processing. Consent may be withdrawn as easily as it was given, without affecting earlier lawful processing. There are no solely automated decisions producing legal or similarly significant effects in the stated service model and no behavioural advertising profiles.

Send requests to privacy@pmuezy.com or the responsible Salon. We may ask for proportionate information to verify identity, not routine excessive identification. We normally respond within one month; a complex or numerous request may permit up to two additional months, with reasons given within the first month. Requests are normally free. We explain any lawful refusal and your complaint rights. A missing download button does not prevent access or portability where applicable.

You can complain to the Irish Data Protection Commission at www.dataprotection.ie, Hungary's NAIH at www.naih.hu, or the supervisory authority where you habitually live, work or believe an infringement occurred. You may also seek a judicial remedy.

9 Security and updates

We use HTTPS/TLS, encrypted database and storage, encrypted backups, bcrypt password hashing, Professional two factor authentication, role based access and audit logging. No system can guarantee absolute security. Suspected incidents can be reported to privacy@pmuezy.com. We update this notice when processing changes and give additional notice where a change materially affects you; new optional purposes require an appropriate fresh choice.