Privacy Policy

This is the privacy notice on the processing of personal data pursuant to articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). It applies to the website johnbarber.it and to online purchases. It does not apply to the websites of third parties to which we link.

Last updated: 12 October 2026.

Who is the data controller

The controller is JB Men's Club SRL, Via Nino Bixio 12, 20129 Milano, VAT number IT11620540960, REA MI-2615192.

For any request about your data, write to amministrazione@jbclub.it or to the certified email jbclub@pec.it.

What data we process, why, and on what legal basis

Browsing the website

Data: IP address, date and time of the request, page requested, type of browser and device. These are recorded by the systems that run the website (Cloudflare).
Purpose: to show you the website, keep it secure and protect it from abuse.
Legal basis: our legitimate interest in operating and protecting the website (art. 6.1.f GDPR).
Limit on repeated requests: when you submit a form, open the payment or load the catalogue, we count the requests arriving from your IP address (for IPv6 addresses, from your network) to stop automated programs. These counters delete themselves automatically after about two days.
Cart: products you add to the cart remain in your browser's memory and are not sent to us until you go to payment.

Contact form

Data: first name, surname (optional), email, message and the page from which you write. The message also arrives by email to our team.
Purpose: to reply to you.
Legal basis: your request (art. 6.1.b GDPR).
Retention: 24 months from the message.

Withdrawal from a purchase

Data: name, email, order number and, if you write them, the details of the request, with the date and time of its arrival.
Purpose: to manage the withdrawal and the refund and to be able to prove when it arrived.
Legal basis: a legal obligation (art. 6.1.c GDPR, Consumer Code).
Retention: 10 years, like the orders to which it refers.

Application "Lavora con noi" (Work with us)

Data: first name, surname, email, presentation and, if you attach it, the CV (PDF or Word). The CV is in a private archive, not accessible to the public.
Purpose: to assess the application and contact you.
Legal basis: your request to be assessed (art. 6.1.b GDPR). The box you tick in the form confirms that you have read this notice.
Retention: 12 months from the application.
A suggestion: in your CV, write only what is relevant to the job. Data on health, religion, political opinions or sex life are not needed.

Data: email, the consent wording you accepted, the page and the date.
Purpose: to send you news and promotions.
Legal basis: your consent (art. 6.1.a GDPR), which you may withdraw at any time. Withdrawal does not affect what was done before.
Retention: until you unsubscribe. To unsubscribe, write to amministrazione@jbclub.it.

Online purchase of gift cards, vouchers, subscriptions and cosmetics

Data: name, email and telephone number, which you enter on the Stripe payment page; the billing address, if Stripe asks for it; the contents of the order, the amount, the salon for collection you choose and the payment details. We do not receive and do not store your card or account details: these are processed only by Stripe.
Purpose: to conclude and carry out the purchase, to send you by email the order number, the secret code and the voucher in PDF, and the confirmation, to manage withdrawals, assistance and refunds, and to keep accounts.
Legal basis: the purchase contract (art. 6.1.b GDPR) and tax and accounting legal obligations (art. 6.1.c GDPR).
Retention: orders and invoices 10 years, as required by tax law.
Mandatory nature: without these data we cannot complete the purchase or send you the voucher.

Use of vouchers and gift cards in the salon

When you use a voucher or a gift card, our staff record it with their personal code. The voucher code, the amount or uses, the salon, the barber, the date and time, and any note remain stored. They serve to perform the contract and to prevent the same voucher from being used twice or beyond its value (art. 6.1.b and 6.1.f GDPR). These data are kept together with the order to which they refer (10 years).

The staff-only area is protected by a personal code or password. To stop anyone trying to guess them, we count failed attempts by IP address and by code; the counters delete themselves automatically after about two days.

Cookies and measurement tools

Technical: cookies and browser memory that the website needs and that do not require consent (for example the cart, your cookie choice and staff access to the staff-only area).
Statistics and advertising: Google Tag Manager, Google Analytics 4, Google Ads and the Meta pixel are activated only if you accept them in the cookie banner. If you refuse, they do not start.
Legal basis: your consent (art. 6.1.a GDPR and art. 122 of the Privacy Code).
Where to see and change your choice: in the cookie button at the bottom left or in the link "Cookie preferences" at the bottom of each page. The list of cookies, their durations and the providers are in our Cookie Policy.

Bookings on Treatwell and links to other sites

The website refers to the Treatwell booking pages. If you book there, the data you enter is processed by Treatwell, as an independent controller, according to its notice: we do not receive it from this website. The same applies to the links to Google Maps, Instagram, Facebook, TikTok and WhatsApp: until you open them, the website does not exchange data with those services.

To whom we disclose the data

We do not sell your data. The following providers may process it on our behalf and under contracts that bind them to confidentiality:

Cloudflare, Inc. (USA): hosts the website, makes it fast and protects it.
Supabase (Supabase Inc., USA): our database and the CV archive. The servers are in Germany (Frankfurt).
Stripe (Stripe Payments Europe, Ltd., Ireland, and group companies in the USA): collects payments and refunds them. For its own legal obligations (for example anti-money laundering and anti-fraud), Stripe also processes data as an independent controller, according to its privacy notice.
Resend (Resend, Inc., USA): sends the order and voucher confirmation emails and those with which the website alerts our team. Resend stores the data in the United States.
GitHub (Microsoft, USA): keeps an encrypted nightly security copy of orders, vouchers and staff users. The copies are deleted after 90 days.
Google (Google Ireland Limited and Google LLC): Tag Manager, Analytics 4 and Ads, only with your consent.
Meta (Meta Platforms Ireland Limited and Meta Platforms, Inc.): the pixel, only with your consent.
CookieYes (CookieYes Limited, United Kingdom): the cookie banner and the recording of choices (date, anonymous consent identifier, anonymised IP address).

The data are also processed by the staff of our salons who are authorised to do so and, where necessary, by consultants who assist us on tax, accounting and legal matters. We may disclose them to public authorities if the law requires it.

We use an artificial intelligence service (Claude, by Anthropic) only to translate the texts we write, such as descriptions of salons, products and articles. We do not send it data of customers or visitors.

Transfers outside the European Union

Some of the providers above are based in the United States or process data there. These transfers take place with the safeguards provided by the GDPR:

Cloudflare, Stripe, Google and GitHub adhere to the EU-US Data Privacy Framework, which the European Commission considers to ensure an adequate level of protection. Cloudflare also uses the standard contractual clauses.
Supabase and Resend rely on the European Commission's standard contractual clauses, included in their data processing agreements. Our database data remain in Germany; Resend's data are in the USA.
Meta indicates the safeguards it uses for transfers in its own privacy notice.

You may ask us for a copy of the safeguards used by writing to amministrazione@jbclub.it.

How long we keep the data

Orders, invoices and vouchers: 10 years.
Contact form messages: 24 months.
Withdrawal requests: 10 years.
Applications and CVs: 12 months.
Newsletter: until unsubscription.
Security copies: 90 days.
Anti-abuse counters (IP address): about two days.
Technical website logs: the period set by Cloudflare.
Cookies: the duration indicated in the Cookie Policy.

At the end of the period we delete the data or make them anonymous (an automatic check runs every month, so at the latest within a month of the expiry), unless the law requires us to keep them or we need them to defend ourselves in court.

Your rights

You may ask us at any time:

to know whether we process data concerning you and to obtain a copy of it (art. 15);
to correct or complete it (art. 16);
to erase it (art. 17);
to restrict its processing (art. 18);
to receive it in a format readable by a computer, or to have it transferred to another controller (art. 20);
to object to processing based on our legitimate interest (art. 21);
to withdraw consent, where processing is based on consent (art. 7).

To exercise them, write to amministrazione@jbclub.it or to the certified email jbclub@pec.it. We reply within one month. If the request does not allow us to understand who you are, we may ask you for a document to identify you.

We do not take decisions based solely on automated processing that produce effects on you. Apart from the advertising tools you activate from the cookie banner, we do not carry out profiling.

If you believe the processing violates the law, you have the right to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it), or with the authority of the country where you live or work.

How we protect the data

The connection to the website is encrypted. The database is not accessible to the public. Staff log in with personal codes or passwords, and security copies are encrypted.

Changes

If the processing or the providers change, we update this page and the date at the top.