Privacy policy.
No cookies, advertising or tracking.
The short version. The personal data collected directly by this site comes from the quote request form and its submission record. It is used to answer your enquiry and operate the form securely. It is never sold, never rented, and never used for advertising. There are no cookies, no analytics and no tracking pixels on this website.
1. Who is responsible for your data
The data controller is:
- Controller
- JJ Hairs, a wholesale supplier of human hair products
- Operating from
- Vietnam
- sales@jjhairs.com
- Website
- jjhairs.com
For any question about this policy, or about the data we hold on you, write to sales@jjhairs.com. That mailbox is monitored on working days and is the fastest route to a person. We answer privacy requests within 30 days.
Full company details on request. Our registered company name, business registration number and registered postal address are not published on this page, but they are not secret: email the address above and we will provide them. Buyers routinely ask for them as part of supplier due diligence, and formal legal notices should be served on the registered entity. In either case, just ask.
2. What we collect
2.1 Information you give us
The quote request form on the contact page asks for the following. Fields marked required are the minimum we need to return commercial terms; the rest are optional.
| Field | Required | Why we need it |
|---|---|---|
| First and last name | Yes | To address our reply to a person rather than a company inbox |
| Email address | Yes | To send the quotation |
| Business name | Yes | To identify the trade enquiry and prepare a business response |
| Business type | Yes | Salon, boutique, distributor or e-commerce. This helps us tailor the response. |
| Country | Yes | To prepare fulfilment terms for your destination market |
| Estimated quantity | Yes | To prepare current quantity guidance and pricing for the enquiry |
| Products or requirements | No | Product preferences, catalogue references or a specific question |
| Selected catalogue lines | No | The lines you added to the quote request while browsing |
Please do not put special category data (health, religion, political opinions, biometric or genetic data) in the message field. We do not ask for it and have no use for it.
2.2 Information collected automatically when you submit the form
Only after a quote request is submitted does our server also record:
- Your IP address, stored alongside the enquiry so that abusive or fraudulent submissions can be traced.
- The page you submitted from and a timestamp.
- A one-way hash of your IP address, kept in a separate short-lived file used to stop automated systems flooding the form. It cannot be reversed back to your IP and is deleted automatically within 24 hours.
Simply reading pages on this site does not create any of these records.
2.3 Server logs
Our hosting provider keeps standard web server logs (IP address, date and time, page requested, browser identification) as part of operating and securing the server. These are generated by the hosting infrastructure, not by us, and are retained under the provider's own policy.
3. Cookies and browser storage
This website sets no cookies. There is no cookie banner because there is nothing to consent to.
Two features use sessionStorage, which is storage inside your own browser tab, is never transmitted to us, and is erased the moment you close the tab:
- Your shortlist: the styles you add to a quote request, so the list survives moving between pages. It reaches us only if you choose to submit the form.
- Catalogue page cache: rendered pages of the e-catalogue, so re-opening it is not a fresh download.
Both are strictly necessary for functions you asked for, and neither is used to identify or profile you.
4. Why we use your data, and on what legal basis
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Answering your quote request and any correspondence that follows | Article 6(1)(b): steps taken at your request before entering into a contract |
| Supplying goods and managing the trading relationship if you order | Article 6(1)(b): performance of a contract |
| Preventing spam, abuse and fraudulent submissions | Article 6(1)(f): our legitimate interest in a working enquiry channel |
| Keeping records of enquiries and orders required by tax and commercial law | Article 6(1)(c): compliance with a legal obligation |
We do not send marketing email. If that ever changes we will ask for your consent first, separately, and every message will carry a working unsubscribe link.
There is no automated decision-making and no profiling. A person reads every enquiry.
5. Who else sees your data
We do not sell, rent or trade personal data. It is shared only with the service providers needed to run the site and reply to you:
| Provider | Role | What it receives |
|---|---|---|
| Hostinger International Ltd (Lithuania) | Website hosting and email | Everything you submit, plus server logs |
| Google (Google Fonts) | Serves the site's typefaces | Your IP address and browser details, when a page loads |
| jsDelivr | Delivers a scrolling library used by the site | Your IP address and browser details, when a page loads |
| WhatsApp / Meta | Messaging, only if you click the WhatsApp button | Whatever you choose to send there, under Meta's own policy |
We may also disclose data where the law requires it, or to establish or defend a legal claim.
6. International transfers
We operate from Vietnam, so data you send reaches Vietnam. Our hosting is provided from the European Union. If you are in the UK or EEA, this means your data may be transferred outside that area. Where we rely on providers outside the UK/EEA, transfers are covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard. You can ask us for details.
7. How long we keep it
| Record | Kept for |
|---|---|
| Quote requests that do not lead to an order | 24 months from your last contact with us, then deleted |
| Records relating to an actual order | As long as tax and commercial law requires, then deleted |
| Hashed IP used for spam throttling | Deleted automatically within 24 hours |
| Email correspondence | 24 months from the last message, unless it relates to an order |
You can ask us to delete your data sooner. See below.
8. Your rights
If you are in the UK or the EEA, the GDPR gives you the right to:
- Access: get a copy of the data we hold about you.
- Rectification: have anything inaccurate corrected.
- Erasure: have your data deleted, where we have no overriding reason to keep it.
- Restriction: have us pause processing while a dispute is resolved.
- Portability: receive your data in a machine-readable format.
- Objection: object to processing we base on legitimate interests.
- Complaint: complain to your national data protection authority. In Ireland this is the Data Protection Commission; in the UK, the Information Commissioner's Office. You do not have to contact us first, though we would rather you gave us the chance to fix it.
If you are in Vietnam, Decree 13/2023/ND-CP on Personal Data Protection gives you comparable rights, including access, correction, withdrawal of consent, deletion and objection.
To exercise any of these, email sales@jjhairs.com with enough detail for us to find your record, normally the email address and business name you used. We may ask you to confirm your identity so that we do not hand your data to someone else. There is no charge, and we reply within 30 days.
9. How we protect it
The site is served over HTTPS. Form submissions are validated and sanitised on the server before anything is stored or emailed. Configuration files and stored enquiries sit outside the publicly reachable part of the site and return "not found" to anyone who tries to request them over the web. Access to the mailbox and to the server is limited to people who need it.
No system is perfectly secure. If a breach ever affects your rights, we will notify the relevant supervisory authority within 72 hours and tell you directly where the law requires it.
10. Children
This is a wholesale site for businesses. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, tell us and we will delete it.
11. Changes to this policy
If we change how we handle personal data, for example by adding analytics to the site, we will update this page and change the date at the top. Material changes affecting people who have already contacted us will be notified by email.
