Policy on privacy
How we collect, use and keep your data on ilovemy.hair.
- In force from: 1 September 2026
We protect your privacy
On behalf of DTM Duck Retail d.o.o., we undertake to protect the privacy of all customers, visitors and partners of the ilovemy.hair website. We collect only the necessary, basic customer/user data and the data needed for doing business and informing users in line with good business practice and in order to provide a quality service. We give customers a choice, including the option to decide whether or not they want to be removed from the mailing lists used for marketing campaigns.
All user/customer data is kept strictly confidential and is available only to employees who need it to do their work. All employees of DTM Duck Retail d.o.o. (and business partners) are responsible for respecting the principles of privacy protection.
Personal data are processed in accordance with the Law on Personal Data Protection of the Republic of Serbia and the General Data Protection Regulation (GDPR). This policy informs you about the purpose, scope and conditions of processing.
Who processes the data
When sending an e-mail, please write “DATA PROTECTION” in the subject line so that we can act faster. For any questions about the protection of your personal data, you can contact us using the contact details provided.
Given the scope of our activities, we are not legally required to appoint a separate data protection officer (DPO, Art. 56 ZZPL), but you can send any questions about privacy, exercising your rights or objections to the contact provided. We will reply within 30 days, and for more complex requests within 3 months at the latest, with prior notice.
Purpose and legal basis of processing
Online shopping and services
We process your personal data to the extent necessary to conclude and perform the sales contract, including:
- receiving and processing orders in the webshop
- payment processing and delivery of goods through authorised partners
- viewing your own orders after confirming your e-mail address with a one-time code
- handling complaints and returns in accordance with the Consumer Protection Law
- sending order status notifications
- ensuring the security, functionality and stability of our services
Legal basis: Art. 12(1.2) and 12(1.6) of the Law on Personal Data Protection of the Republic of Serbia and Art. 6(1)(b) and 6(1)(f) GDPR – performance of the contract, prevention of abuse and protection of legal claims.
Enquiries and partner programme
We use data from the contact form and partner programme applications to:
- reply to your enquiry through the channel you chose (WhatsApp, Viber or e-mail)
- process applications from hairdressers, salons or companies for partnership
Legal basis: your consent given in the form (Art. 12(1.1) ZZPL and Art. 6(1)(a) GDPR) and taking steps at your request prior to entering into a contract (Art. 12(1.2) ZZPL and Art. 6(1)(b) GDPR).
Site analytics and product display
Your data is used for:
- analysis of visits and use of the site through cookies (Google Analytics, Yandex Metrika)
- tailoring the display of products and content to your interests
Legal basis: consent (Art. 12(1.1) ZZPL and Art. 6(1)(a) GDPR) given through the cookie banner; technically necessary cookies operate on the basis of legitimate interest (Art. 12(1.6)).
Advertising and market research
We use data for:
- assessing the effectiveness of marketing campaigns
- collecting aggregate data on interests and purchasing habits
- planning promotional campaigns
Legal basis: exclusively your consent (Art. 12(1.1) ZZPL and Art. 6(1)(a) GDPR) – given through the cookie banner or in a form on the site.
Site development and security
The data are used for:
- developing site functionality
- choosing the site language by the country you visit from (based on the IP address)
- preventing fraud, protecting forms against abuse and ensuring the security of IT systems
- speeding up order processing and delivery
Legal basis: legitimate interest (Art. 12(1.6) ZZPL and Art. 6(1)(f) GDPR) with a data protection impact assessment where required (Art. 54 ZZPL).
Service optimisation
The data are processed for:
- improving communication with users through the Customer Service
- respecting consumer rights (e.g. returns within 14 days, with the statutory rules for hygiene products in sealed packaging)
- fulfilling legal obligations (e.g. tax records)
- demonstrating compliance with the Data Protection Law and the Consumer Protection Law
Legal basis: legitimate interest (Art. 12(1.6)) and legal obligations (Art. 12(1.3) ZZPL and Art. 6(1)(c) GDPR).
What data we process?
- For purchases: first name, last name, e-mail, phone number, address (street, number, postcode, city, country), tax number (if an invoice is required)
- For viewing orders: e-mail address and one-time confirmation code
- For the contact form and partnership application: who you are (customer, hairdresser, salon or company), name of the salon or company, first and last name, phone number, country and city, chosen communication channel, e-mail address and message text
- For promotional messages (e-mail and/or phone): e-mail address and/or phone number
- For refunds: bank account number (if you did not pay by card) and ID card or passport number, required for the refund fiscal receipt
- For phone contact: first name, last name, transaction data, contact details. Calls are recorded only with your explicit consent at the start of the conversation (“Do you agree to the call being recorded for quality purposes?”). Recordings are kept for no longer than 90 days.
- Automatic data: IP address, device data, behaviour on the site through cookies – details in the Cookie Policy
Your rights
- the right of access to data and to information about its processing
- the right to rectification of inaccurate or completion of incomplete data
- the right to erasure (“right to be forgotten”)
- the right to restriction of processing
- the right to data portability – you will receive them in a structured, commonly used and machine-readable format (e.g. CSV)
- the right to object to processing (in particular for direct marketing – in that case we stop immediately; we consider an objection to legitimate interest within 30 days and will inform you of the outcome)
- the right to withdraw consent at any time without any consequences (where consent was the basis for processing)
- the right to request erasure of all your data by sending a request to [email protected]
- the right to be informed about the processing of your data
Requests are handled free of charge and within 30 days at the latest (in exceptional cases up to 3 months, with notice). If you believe your rights have been violated, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Bulevar kralja Aleksandra 15, Belgrade, www.poverenik.rs).
Means of communication
For questions about your data:
- e-mail: [email protected]
- phone: +381 60 6000 856
- contact form on the site
- address: DTM Duck Retail d.o.o. Beograd, Drinčićeva 26, 11108 Belgrade
How long we keep the data
To whom do we transfer the data
We share data with:
- Delivery partners (e.g. courier services) – only name, address and phone number, for delivery and transactional notifications (including Viber/WhatsApp/SMS messages about the shipment status)
- Payment institutions and payment service providers – to process payments
- Analytics services (Google Analytics, Yandex Metrika) – only with your consent
- Technical service providers – website hosting and protection of forms against abuse (Cloudflare Turnstile)
Data is transferred outside Serbia/the EEA only with appropriate safeguards: an adequacy decision, standard contractual clauses + TIA, or the Data Privacy Framework (for the USA). The list of processors and recipients is available upon written request to [email protected].
Messages and notifications
We use e-mail, Viber, WhatsApp, Telegram and SMS for:
- transactional notifications about delivery and order status (without consent – necessary to perform the contract, Art. 12(1.2) ZZPL)
- promotional messages, offers, discounts and news – only with your explicit consent given in a form on the site or at purchase (Art. 12(1.1) ZZPL), to the channel where you can be reached
You can withdraw your consent to promotional messages at any time without any consequences:
- by clicking the unsubscribe link in the message (if there is one)
- by replying STOP or ODJAVA to our message (in most cases the service stops automatically)
- by sending a request to [email protected]
We respect the national “DO NOT CALL” register kept by RATEL under the Consumer Protection Law and the Advertising Law. We will not make promotional calls or send promotional SMS/Viber messages to persons whose number is in that register. Before every promotional call or SMS we check the number through the official RATEL service.
Cookies and analytics
We automatically collect technical data (IP address, device type, behaviour on the site) through cookies. Technically necessary cookies operate on the basis of legitimate interest (Art. 12(1.6) ZZPL). Analytical and marketing cookies operate only with your explicit consent (Art. 12(1.1) ZZPL) – details in the Cookie Policy.
Google Analytics
We use Google Analytics to analyse visits to the site. IP addresses are anonymised, and data are transferred to Google servers under standard contractual clauses. You can disable tracking at: Google opt-out.
Yandex Metrika
We use Yandex Metrika to analyse user behaviour on the site, including recording of on-page movement (Webvisor). Data are processed with your consent through cookies. For more information: Yandex privacy policy.
Changes to the policy
The policy may be updated. The new version will be published on the site. Updated: 1 September 2026.