This is a translation. In the event of any discrepancy, the French version prevails. View the French version

iara Platform Privacy Policy

Version: 31 July 2026

1. Who are we?

The iara platform (the iarabeauty.com website and iara mobile application, hereinafter the “Platform”) is published by Wiara Beauty, a simplified joint-stock company with share capital of EUR 61,000, registered with the Paris Trade and Companies Register under number 885 119 370, whose registered office is located at 55 rue des Francs Bourgeois, 75004 Paris, France (hereinafter “iara” or “we”).

iara is the controller of personal data collected through the Platform within the meaning of Regulation (EU) 2016/679 (the “GDPR”) and amended French Law No. 78-17 of 6 January 1978.

Contact for any questions concerning your personal data: tech@iarabeauty.com, or by post at the registered-office address indicated above.

2. What data do we collect?

Depending on how you use the Platform, we collect the following categories of data:

• Identification data: surname, first name, date of birth and gender;

• Contact data: email address and telephone number;

• Account data: login credentials, preferences and booking history;

• Data specific to Professionals: company name and identifiers (SIREN), business address, diplomas and qualifications, identity document and bank details;

• Payment data: processed directly by our payment service provider (Stripe); iara does not retain bank card numbers;

• Content: photographs, reviews, messages exchanged through the Platform’s messaging system, and supporting documents submitted in connection with a request for assistance or iara Protection;

• Technical data: IP address, device identifiers, connection logs and geolocation data (with your permission, to search for nearby Professionals);

• Usage data: pages viewed and interactions with the Platform, measured on an anonymised basis (see Section 9).

3. Why do we process your data and on what legal basis?

4. Who receives your data?

Your data is accessible only to persons who need it:

• Professionals with whom you book (solely the information needed for the Service) and, reciprocally, Clients in respect of public information on a Professional’s profile. The Professional processes the Client data transmitted to them as a separate controller, solely for the purposes of preparing, performing and invoicing the Service; the Professional is responsible for complying with the regulations applicable to their own processing;

• Our technical service providers, acting on our behalf and on our instructions, in the following categories: hosting and infrastructure, content delivery, payment services (Stripe Payments Europe Ltd.), email and text-message delivery, content storage, audience measurement and maintenance tools. Some act as processors within the meaning of Article 28 of the GDPR;

• The tax authorities, in cases prescribed by law (the DAC7 scheme);

• Judicial or administrative authorities, upon request or where required by law.

Processing carried out on behalf of Professionals. For certain features, iara acts not as controller but as a processor for Professionals, on their instructions: sending their communication campaigns to their clients and managing the client files they import onto the Platform (including persons who do not have an iara account). For such processing, the Professional is solely responsible for ensuring that the collection is lawful and that the data subjects are informed; iara does not use this data for its own purposes. Data subjects may exercise their rights with the Professional or through tech@iarabeauty.com, which will forward the request. iara does not sell your personal data to any third party.

5. Is your data transferred outside the European Union?

Some of our technical service providers are located outside the European Economic Area. In such cases, transfers are governed by appropriate safeguards in accordance with Articles 44 et seq. of the GDPR (including the European Commission’s Standard Contractual Clauses or an applicable adequacy decision). You may obtain information about these safeguards by writing to tech@iarabeauty.com.

6. How long do we retain your data?

• Account data: for the entire period during which the Platform is used, followed by deletion or anonymisation within one (1) month after deletion of the Account, subject to the retention periods below. Data may remain temporarily in our secure backups, which are purged according to their normal cycle, without being used for any other purpose;

• Invoices and transaction data: ten (10) years (accounting obligations);

• Data needed to defend our rights: for the applicable statutory limitation periods (in principle, five (5) years);

• Direct-marketing data: three (3) years from your last contact;

• Technical logs and connection logs: twelve (12) months;

• Messaging and dispute-supporting documents: for the period required to handle the dispute, followed by limited archiving for the defence of our rights;

• Data reported under DAC7: for the periods prescribed by tax regulations.

7. Minors

Registration as a Client is open to persons aged at least fifteen (15). In accordance with Article 45 of amended French Law No. 78-17 of 6 January 1978, a minor aged at least fifteen (15) may independently consent to the processing of their personal data in connection with the Platform’s services.

Registration of minors under fifteen (15) is not permitted. Holders of parental responsibility for a Client who is a minor may at any time exercise the rights referred to in Section 8 on behalf of the minor, including requesting deletion of their Account, by writing to tech@iarabeauty.com.

8. What are your rights?

Under the GDPR, you have the following rights in relation to your data: the rights of access, rectification, erasure, restriction of processing, portability and objection (in particular to direct marketing), the right to withdraw your consent at any time, and the right to define instructions concerning the handling of your data after your death.

You may exercise these rights by writing to tech@iarabeauty.com or by post to the registered office. You will receive a response within one (1) month, which may be extended under the conditions set out in the GDPR. If there is reasonable doubt as to your identity, you may be asked to provide proof of identity.

You also have the right to lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés — www.cnil.fr — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).

9. Cookies, trackers and audience measurement

This Section applies both to the iarabeauty.com website and the iara mobile application, including trackers and measurement tools integrated into the application (SDKs).

The Platform uses:

• Strictly necessary cookies for operation of the service (login, booking and security): these do not require consent;

• Preference cookies (language and country);

• A self-hosted audience measurement tool, configured to produce anonymised statistics without tracking the User beyond the Platform, under the consent-exemption conditions set out in the CNIL guidelines.

Where a cookie or tracker requiring consent is used—on the website or within the mobile application, including usage analytics tools integrated into the application—your consent is obtained in advance and may be withdrawn at any time through the settings of the Platform or your device. You may also configure your browser to reject cookies; some Platform features may then be impaired.

10. Security

iara implements appropriate technical and organisational measures to protect your data against unauthorised destruction, loss, alteration, disclosure or access (encryption of communications, access controls, logging, and hosting of Account data within the European Union). In the event of a data breach likely to result in a high risk to your rights, you will be informed in accordance with Article 34 of the GDPR.

11. Amendments to this Policy

This Policy may be amended at any time, in particular to reflect legal developments or changes to the Platform’s services. The version in force is the version published on the Platform, together with its update date. In the event of a material amendment, you will be informed by any appropriate means.

Privacy Policy — iara