HAIRCOSYS LIMITED · Version: 13 October 2026
This notice is for people in the United Kingdom and the European Economic Area whom we contact, or who contact us, in a business capacity: staff of salons, clinics, brands, distributors and other organisations that may use or sell our products. It does not cover users of our apps.
1. Who we are
- Controller: HAIRCOSYS LIMITED, Flat/Rm DW51, 3/F, Building 2W, Hong Kong Science Park, No. 2 Science Park West Avenue, Pak Shek Kok, New Territories, Hong Kong
- Privacy contact: mail@haircosys.com · +852 9098 1850
We have not appointed a data protection officer or a representative in the UK or the EU.
2. What we hold
- Your name, job title and employer
- Business e-mail address, business phone number, business address and website
- The link to your public professional profile, where there is one
- Information about your organisation, such as its industry and size, and our own assessment and priority score of how relevant our products may be to it
- A short summary of your professional role, based on publicly available information such as your organisation’s website or your professional profile
- A record of our correspondence: when we wrote, what you replied, and whether you asked us not to contact you
We do not collect special-category personal data about business contacts.
3. Where it comes from
- Your organisation’s website
- Map listings, such as Google Maps business listings
- Company registers and business databases, such as Companies House and Key to Bavaria
- Public professional networking profiles and commercial business-contact databases
- Some e-mail addresses were inferred from your organisation’s usual address format. Before we write, we check that your organisation’s domain accepts e-mail
- Web searches for your name and organisation, when you write to us or before we write to you
- Introductions from trade associations, partners and event organisers
- You directly: business cards, trade fairs, e-mails and calls
4. Why we use it, and our legal basis
| Purpose | Legal basis (UK GDPR / EU GDPR) |
|---|---|
| Telling organisations about our AI hair, scalp and skin analysis products, and about partnerships relevant to your role | Our legitimate interests in introducing our products to businesses that may use or distribute them. Where you have given consent, your consent |
| Classifying organisations, scoring how relevant we are likely to be to them, and researching publicly available information about the organisations and people we contact or who write to us | Our legitimate interests in contacting only people for whom our products are likely to be relevant, and in replying in context |
| Replying to you, arranging meetings and managing our relationship with customers and partners | Our legitimate interests in running our business relationships |
| Keeping business records and defending legal claims | Our legitimate interests in meeting our record-keeping duties under Hong Kong law and in protecting our legal position |
| Recording that you do not want to hear from us | Our legitimate interest in respecting your objection in every later campaign |
We balance our interests against yours. We write only about matters relevant to your role, send each e-mail individually, and stop when you ask.
5. Opting out
Every marketing e-mail we send tells you how to stop. A short reply is enough, or write to mail@haircosys.com. We then stop all marketing to you. We record your objection on a do-not-contact list, holding your e-mail address or organisation, your country, the date and the reason, so that it is respected in every later campaign.
6. Who we share it with
We use these service providers. They process the data to provide their services to us:
- Microsoft (Microsoft 365): e-mail for haircosys.com
- Google (Google Workspace and Google Drive): e-mail for haircosys.ai, and storage of contact lists
- Anthropic (Claude): AI tools that help us classify organisations, score and rank contacts, research publicly available information about organisations and people (including web searches by name), sort incoming e-mails and draft e-mails. A person reviews and sends every e-mail
We do not sell business-contact data.
No decision with legal or similarly significant effects for you is made by automated means.
7. International transfers
HairCoSys is based in Hong Kong, outside the UK and the EEA. Neither the UK nor the EU has made an adequacy decision for Hong Kong. Your data is processed in Hong Kong and by our service providers in the United States and other countries where they operate.
The data processing terms of Microsoft, Google and Anthropic include the European Commission’s standard contractual clauses, which they also apply to transfers of UK data. You can ask us for a copy of these safeguards at mail@haircosys.com.
8. How long we keep it
- People we have never contacted: deleted no later than 12 months after we collected their details.
- People we have contacted: deleted 12 months after our last contact, unless we are in an ongoing conversation.
- Do-not-contact entries: kept for as long as we need them to respect your objection.
- Customers and partners: kept for the length of the relationship, then as long as Hong Kong law requires.
9. Your rights
You can ask us at any time to:
- give you a copy of your data
- correct it
- delete it
- restrict how we use it
- receive it in a portable format, where we process it on the basis of consent
You can object to our use of your data at any time, and you can always object to direct marketing. Where we rely on your consent, you can withdraw it at any time; this does not affect what we did before.
Write to mail@haircosys.com. We reply within one month.
You can also complain to a supervisory authority:
- UK: the Information Commissioner’s Office
- EU and EEA: the data protection authority in the country where you live or work
10. Changes
We update this notice when our practices change. The version date at the top shows the current version.