Privacy Policy

17. INTRODUCTION AND SCOPE

Underground respects customer privacy and is committed to the responsible handling of personal information collected through Trimfy.

This Privacy Policy explains how information is collected, used, stored, shared, retained, and protected when customers use the Platform.

For purposes of this Policy, "Underground" refers to the legal entity or entities identified in the final published version as responsible for the relevant processing activities.

This Policy applies to customer accounts, online bookings, Service Consent Forms, electronic signatures, appointment communications, and related interactions.

18. PERSONAL INFORMATION WE COLLECT

Depending on the services requested and features used, we may collect the following categories of information.

18.1. Personal and Contact Information

• Full name;
• Telephone number;
• Email address;
• Account identifiers;
• Date of birth, when reasonably necessary;
• Other contact details voluntarily provided.

18.2. Appointment and Service Information

• Appointment dates and times;
• Selected services;
• Preferred professionals;
• Location preferences;
• Appointment history;
• Cancellations and attendance records;
• Service preferences and relevant notes.

18.3. Purchase and Customer Relationship Information

• Services and products purchased;
• Transaction amounts recorded by the establishment;
• Membership or loyalty information, when applicable;
• Customer service interactions;
• Relevant service history.

18.4. Health and Sensitive Service-Related Information

For services requiring consultation, safety screening, or informed consent, Trimfy may collect information such as:

• Allergies and sensitivities;
• Skin, scalp, or nail conditions;
• Relevant medical conditions voluntarily disclosed;
• Previous treatments or adverse reactions;
• Potential contraindications;
• Customer responses to health and safety questionnaires;
• Other information reasonably necessary for the requested service.

18.5. Electronic Consent Records

When customers complete and sign Service Consent Forms, Trimfy may retain:

• The specific form and version presented;
• Customer responses;
• Acknowledgments and authorizations;
• Electronic signatures;
• Date and time of completion;
• Related appointment and service information;
• Available technical records supporting document integrity and signature attribution.

18.6. Technical Information

When customers access Trimfy, the Platform may collect:

• IP addresses;
• Device and browser information;
• Login and session records;
• Security logs;
• Technical error information;
• Cookies or similar technologies, where implemented.

18.7. Communication Information

We may maintain records of appointment notifications, messaging preferences, marketing consent, opt-out requests, and communication delivery status.

19. HOW WE COLLECT INFORMATION

Personal information may be collected:

• Directly from customers during account registration;
• When customers create or modify appointments;
• Through questionnaires and Service Consent Forms;
• When customers electronically sign documents;
• During interactions with Underground professionals;
• Through authorized administrative records;
• Automatically through certain Platform technologies.

Information may also be updated by authorized Underground personnel when reasonably necessary for service delivery or account administration.

20. HOW WE USE PERSONAL INFORMATION

Personal information may be used to:

• Create and maintain customer accounts;
• Schedule, confirm, and manage appointments;
• Maintain service histories;
• Support personalized customer service;
• Assist professionals in evaluating service suitability;
• Identify relevant safety precautions or contraindications;
• Document customer disclosures and consent;
• Maintain electronic signature records;
• Respond to customer requests;
• Deliver appointment-related communications;
• Manage loyalty or membership programs;
• Maintain operational and business records;
• Improve customer experience and Platform functionality;
• Prevent fraud and unauthorized access;
• Comply with applicable legal obligations.

Sensitive health-related information will not be used for unrelated promotional targeting without an appropriate lawful basis and any legally required authorization.

21. SERVICE CONSENT FORMS AND SENSITIVE INFORMATION

Certain Underground services require customers to provide information that may be considered sensitive under applicable privacy laws.

This information is collected through Service Consent Forms made available within the customer's appointment in Trimfy.

The purpose of collecting such information is to support:

• Customer safety;
• Appropriate service assessment;
• Identification of relevant contraindications;
• Informed decision-making;
• Documentation of customer consent;
• Compliance with applicable legal and professional requirements.

Only information reasonably necessary for these purposes should be requested.

Access to completed forms and sensitive information will be limited to authorized personnel with legitimate service-related, safety, administrative, or legal responsibilities.

The information will not be disclosed to unrelated third parties for independent marketing purposes.

Where applicable law requires separate consent or additional disclosures for sensitive information, these will be provided through an appropriate process.

22. ELECTRONIC SIGNATURES AND DOCUMENT STORAGE

Trimfy supports the electronic completion, execution, and storage of Service Consent Forms associated with customer appointments.

Electronic records may include the completed form, customer responses, signature, date and time of execution, and information linking the document to the relevant appointment.

The Platform may maintain additional technical information reasonably necessary to support authentication, record integrity, security, and verification of the signing process.

Completed Service Consent Forms may be accessed by authorized Underground personnel for legitimate service-related, safety, compliance, or legal purposes.

Customers may request copies of their completed documents through the relevant Underground location.

Electronic records will be retained in accordance with applicable law and documented retention procedures.

23. SHARING OF PERSONAL INFORMATION

Personal information may be shared, when reasonably necessary, with:

• The Underground location providing the requested service;
• Authorized service professionals;
• Authorized administrative and customer support personnel;
• Technology and hosting providers supporting Trimfy;
• Email and SMS service providers;
• Security and technical support providers;
• Professional advisers and authorities where legally required.

Access to sensitive information will be restricted according to legitimate operational needs.

Personal information will not be sold to unrelated third parties for independent advertising purposes.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Information will not be shared between Underground locations beyond legitimate operational, customer service, administrative, or other legally permitted purposes.

24. DATA SECURITY

Underground will use reasonable administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, disclosure, alteration, destruction, or loss.

Safeguards may include authentication controls, access permissions, secure hosting, activity monitoring, and other measures appropriate to the nature of the information.

Sensitive information and electronically signed documents should be subject to access restrictions consistent with their confidentiality and operational purpose.

Although reasonable security measures are used, no electronic system can guarantee absolute security.

25. DATA RETENTION AND DELETION

Personal information will be retained for as long as reasonably necessary to provide services, maintain business records, comply with applicable legal obligations, address disputes, and protect legitimate legal interests.

Completed Service Consent Forms may be retained for periods appropriate to the type of service, applicable professional requirements, and potential legal obligations.

Customers may request deletion of eligible personal information.

Certain records, including signed consent forms, may need to be retained even after an account is closed where required or otherwise permitted by applicable law.

Retention periods will be established through documented policies based on the relevant categories of information.

26. CUSTOMER PRIVACY RIGHTS

Depending on applicable law, customers may have rights to:

• Request access to their personal information;
• Request correction of inaccurate information;
• Request deletion of eligible information;
• Obtain information about applicable data processing practices;
• Withdraw consent where legally permitted;
• Opt out of certain promotional communications.

Requests may be submitted through the contact channels provided below.

Identity verification may be required before information is disclosed, corrected, or deleted.

Requests will be evaluated and processed in accordance with applicable law.

27. MARKETING COMMUNICATIONS AND CUSTOMER CHOICES

Underground may use Trimfy to send appointment-related communications and authorized marketing messages.

Marketing communications may include promotions, service announcements, loyalty offers, and customer reactivation campaigns.

Where required by law, marketing messages will be sent only after obtaining appropriate consent.

Consent to receive promotional text messages is optional and is not required to book appointments or purchase services.

Customers may withdraw marketing consent through available unsubscribe mechanisms or by contacting Underground.

Withdrawal of marketing consent does not necessarily prevent legally permitted transactional or service-related communications.

Service Consent Forms do not constitute consent to receive marketing messages.

28. CHILDREN AND MINORS

Trimfy is not intended for independent account registration by children under 13.

Parents or legal guardians may schedule services for minors and provide information reasonably necessary for the requested service.

Where required by law, parental authorization will be obtained for the collection, use, or disclosure of a minor's personal information.

Service Consent Forms for minors must be completed or authorized by a parent or legal guardian when required by applicable law.

29. COOKIES AND SIMILAR TECHNOLOGIES

Trimfy may use cookies and similar technologies to support authentication, account sessions, security, user preferences, and Platform performance.

If nonessential tracking or advertising technologies are implemented, appropriate disclosures and privacy choices will be provided as required by law.

30. THIRD-PARTY TECHNOLOGY PROVIDERS

Trimfy may rely on third-party providers for hosting, communications, technical support, security, and other necessary services.

These providers may process personal information only as permitted by applicable agreements and law.

Appropriate contractual and security measures should be maintained for providers that access personal or sensitive information.

31. SECURITY INCIDENTS

If a security incident affects personal information, reasonable steps will be taken to investigate, contain, and mitigate the incident.

Affected individuals and relevant authorities will be notified when required by applicable law.

32. CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be updated to reflect changes in technology, operations, legal requirements, or information processing practices.

The current version will be made available through https://trimfy.io.

Material changes will be communicated when required by law.

33. CONTACT INFORMATION

For questions regarding Trimfy, appointments, Service Consent Forms, electronic records, or personal information, please contact: