PERSONAL DATA PROCESSING POLICY – MY DOLL HAIR LLC

MY DOLL HAIR, LLC., a limited liability company incorporated by private document on May 1, 2023, in the State of Delaware, United States; hereby informs all clients, collaborators, employees, distributors, contractors and/or suppliers, and other individuals, who have provided or will provide their personal data to our company, that such data will be incorporated into our databases and processed in accordance with the provisions of this document.

MY DOLL HAIR, LLC., respects fundamental rights such as: the right to privacy, good name, and inviolability of private communications.

For MY DOLL HAIR, LLC., it is important to remember that “Database” is understood as any organized set of personal data that is subject to processing, concerning clients, beneficiaries, collaborators, contractors and/or suppliers, and generally any person for whom personal data is held.

With this document, MY DOLL HAIR LLC., seeks to inform all individuals who have provided or will provide us with their personal data, about their power to exercise their right to use personal data, illustrating the steps or procedures they must follow if they wish to know, update, rectify, delete, revoke, and/or oppose the data contained in our databases and/or files.

Consequently, each chapter and its development will be presented below.

FIRST: SPECIAL TREATMENT DATA.

A. Personal data of children and adolescents: The processing of personal data of these individuals will be carried out respecting the following requirements:

▪ That it responds to and respects the best interests of children and adolescents.

▪ That respect for their fundamental rights is ensured.

▪ That such processing is based on the authorization of those responsible for their parental authority and/or care, duly accredited.

 

B. Sensitive personal data established by My Doll Hair, LLC. Our company identifies any sensitive data that it may eventually collect or store, and in this regard, we commit to:

▪ Implement special attention and reinforce its responsibility regarding the processing of this type of data.

▪ Establish technical, legal, and administrative security levels to properly process this information.

▪ Increase access and use restrictions by our personnel.

 

SECOND: GUIDING PRINCIPLES OF DATA PROTECTION. Our policy complies with and recognizes, without limitation, each of the principles related to the processing of personal data, which we proceed to list:

▪ Principle of purpose. Processing must serve a legitimate purpose in accordance with the law, which must be informed to the data subject.

▪ Principle of freedom. The prior, express, and informed consent of the data subject is always required. It may not be obtained or disclosed without prior authorization or legal or judicial mandate that substitutes consent.

▪ Principle of veracity or quality. The information to be protected must be truthful, complete, accurate, updated, verifiable, and understandable.

▪ Principle of transparency. The data subject may obtain information at any time about the existence of data concerning them.

▪ Principle of restricted access and circulation. Personal data, except public information, may not be available on the internet or other means of massive dissemination or communication.

▪ Principle of security. Information subject to processing by the data controller or data processor must be handled with the technical, human, and administrative measures necessary to ensure the security of the records, preventing their alteration, loss, consultation, unauthorized or fraudulent use or access.

▪ Principle of confidentiality. Persons involved in the processing of personal data must guarantee the confidentiality of the information, an obligation that extends even after any link or relationship with the data processing ends, being able to only provide or communicate personal data when this corresponds to the development of authorized activities.

THIRD: RIGHTS OF THE DATA SUBJECT.

The data subject may, by themselves or through an authorized representative or legal representative, exercise the following rights:

a.      Know and access their personal data

b.      Update their personal data

c.      Rectify their personal data

d.      Refuse authorization for the processing of their personal data when they consider that the guiding principles of this policy were not guaranteed.

e.      Request a copy or evidence of the authorization granted for the processing of their personal data.

f.        Know the origin of their data and whether it has been transferred or not to third parties and, therefore, the identification of the transferees.

g.       Verify the accuracy and veracity and request the rectification of their personal data whenever, in their judgment, these are or result inaccurate, incomplete, generate or contain errors.

h.      Request the total or partial deletion of their personal data.

 

In the event that cancellation or deletion occurs at the request of the data subject, the company will only retain the data for those cases in which they are required by administrative or judicial authorities, and within the prescription periods provided by special rules on information archiving.

FOURTH: DATABASE CLASSIFICATION

A. Collaborator and employee databases: Those manual or automated data containing information of natural persons with whom the company has a contractual link, and its purpose is to comply with legal and regulatory provisions. This database may contain private, public, sensitive, and minor data.

B. Contractor and supplier databases: Those manual or automated data containing information of persons who have a contractual and/or commercial link, whose processing is conditioned on the execution of the conventional obligations that bind them. The processing of this data for purposes other than those indicated requires prior and express authorization from the data subject.

C. Customer databases: Those manual or automated data containing information of persons who have or intend to acquire a good or service related to the company's corporate purpose, also to disseminate topics of interest, commercial activities, educational activities, marketing material, and others.

D. Databases with general information: These are manual or automated databases that contain personal information that is not public, sensitive, or of minors. They will be occasional for the fulfillment of specific purposes of the company. The processing of this data will require prior authorization and information on the purposes of its processing.

FIFTH: PROCEDURES FOR CONSULTATION AND CLAIMS, UPDATING, RECTIFICATION, OPPOSITION AND CANCELLATION OF PERSONAL DATA.

The data subject may submit their request through the email address honduras@mydollhairshop.com, stating their request and the reasons for it. In the event that the data subject decides to act through an intermediary, the latter must be duly accredited by attaching a copy of the special power of attorney conferred by the data subject, clearly indicating the powers granted, and a copy of the identity document of the data subject and their representative. Non-observance of what is prescribed herein will result in the petition being considered not submitted, of which the applicant will be informed so that they may proceed to fulfill the requirements as indicated in this policy.

In the case of children and adolescents, the request must be submitted by their legal representative and accredited in accordance with the law, whether through identity documents, certifications, court rulings, among others.

In the event that the data subject or their duly accredited representative requires to make inquiries about the information contained in the database managed by the company, they must send their request to the email address indicated herein, for which the company will have a period of fifteen (15) business days to expressly respond to it; however, in cases where it is not possible to comply with said term, the company must inform the applicant of the reasons before the expiration of said term, and will have an additional five (5) business days.

For claims, the data subject or their duly accredited representative, when they consider that the information contained in one of the databases should be corrected, updated, deleted, or its processing is carried out in contravention of the law and this policy, may make their request, which will be processed following these steps:

a) Submit the request to the email honduras@mydollhairshop.com, with the identification of the data subject, indicating the place where they will receive the response notification, describing the facts on which their request is based, and providing the evidence they deem appropriate.

 

If the claim is incomplete, the interested party will be informed of the reasons within ten (10) business days following, so that they may proceed to rectify what is required. If after the request, the interested party does not rectify and more than 30 business days have passed, it will be understood that they have withdrawn their request.

c) When the request is complete and has been evaluated by the company, the request will be processed accordingly, within a period not exceeding eight (08) business days, which must be informed to the data subject in writing.

 

MY DOLL HAIR, LLC., commits to ensuring that all information provided to the personal data subject will be timely, accurate, and verifiable.

SIXTH: DATABASE SECURITY MECHANISMS.

Among the security measures employed by the company, the following stand out:

a) Access to the databases is limited solely to the manager, and the information may only be used for activities directly related to the development of the company's corporate purpose.

b) It is prohibited to use electronic equipment, programs, and electronic means to which employees, contractors, or collaborators have access, to obtain copies of the information contained therein, without the express consent of the manager.

c) Strict compliance with the confidentiality agreement signed by all employees, contractors, and collaborators.

d) Express prohibition of using information that is part of the databases without the authorization of the data subject or that does not originate from public records. When personal data comes from public records, prior authorization from the data subject is not required for its processing, but all other provisions of the law and this document must be observed.

 

MY DOLL HAIR LLC., commits that when it carries out any type of event or activity (workshop, contest, survey, giveaway, etc.) through which personal data is collected, it must obtain the respective prior and express authorization from the data subject, using the digital or physical forms adopted by the company.

In the event that the company takes or publishes images of minors in events, activities, or workshops organized by the company, the express authorization of the minor's responsible party, duly accredited in accordance with the law, must be obtained. When it is intended to use images of minors in publications, commercial videos, and others, the following must be observed:

 

a) Take into account the level of knowledge, maturity, motivations, and interests of the target audience.

b) Advertisements cannot generate unrealistic expectations regarding the good or service being advertised.

c) No improper expressions may be used.

d) No advertisements may be broadcast with scenes that violate the moral, psychological, or physical integrity of minors, nor that incite violence or glorify criminal or contraventional acts.

e) No sexual acts may be staged, nor scenes that violate the dignity and honor of the minor.

f) Children should not act in advertisements that present situations which, objectively, in a real situation constitute a risk or danger to life.

 

The publication or dissemination of images of minors in public places will be legitimate, provided that the minors appear casually or accessorily to the main information. The image of the minor may under no circumstances be linked to places or people that could negatively affect the minor's image.

Issued on June 03, 2024.

 

CONSENT FOR THE HANDLING OF PERSONAL DATA MY DOLL HAIR LLC.

In accordance with the provisions of My Doll Hair LLC., which sets forth general provisions for the protection of personal data, by means of this document, I AUTHORIZE the company MY DOLL HAIR LLC. to administer and manage my personal data, including both private and sensitive data, and consequently to process them in accordance with the law and its personal data processing policy, which I declare to know by signing this document.

By virtue of the foregoing, I authorize the company to process, collect, store, use, circulate, delete, share, update, transmit, and transfer my personal data, in accordance with the terms and conditions of the processing policies, in order to enable the provision of services inherent to the corporate purpose, reports to control and surveillance authorities, and for use for administrative, commercial, advertising, and contact purposes with the data subjects.

I also authorize that in the event that images of me are captured (videos, photographs, recordings, etc.), these may be uploaded to the company's website and social networks for commercial and advertising purposes, without generating any economic compensation for this.

Finally, I declare that I have been informed by MY DOLL HAIR LLC. of my right, in accordance with the law, to access, consult, correct, delete, revoke, or claim for infringement of the guiding principles of the aforementioned policy, by simply submitting a reasoned request, addressed in writing to the email honduras@mydollhairshop.com, and highlighting in the subject the right I wish to exercise.

Acceptance of this document is given by merely providing contact details and any other information or personal data required by the company to address the data subject's or client's request; however, if you do not agree, you must express it.