Privacy Policy

Your privacy matters to us. This Privacy Policy explains what personal data HLYWD MD collects, why we collect it, how we use and protect it, and what rights you have over your data. By using the HLYWD MD platform — whether as a retail customer or a salon partner — you agree to the practices described in this policy.

1. Who We Are

HLYWD MD (referred to as "HLYWD MD", "we", "us", or "the Company") is the operator of the HLYWD MD unified commerce platform, accessible at www.hlywdmd.com and through associated mobile or partner applications. We are the Data Controller for all personal data collected through the platform.

If you have any questions about this policy or your personal data, please contact our Grievance Officer whose details are listed above. Under applicable Indian law, we are required to respond to data-related grievances within 30 days.

2. Who This Policy Applies To

This Privacy Policy applies to all individuals who interact with the HLYWD MD platform, including:

• B2C Retail Customers — individuals who purchase HLYWD MD products via the platform
• Salon Partner Leads — individuals who submit an enquiry through the Become a Partner form
• B2B Salon Partners — registered salon businesses and their authorised users (Company Admin, Branch Users, Finance Users, Order-Only Users)
• Visitors — anyone who browses the HLYWD MD website without making a purchase or registering

Where we use the word "you" in this policy, it refers to the relevant user type above. Where practices differ between user types, this is clearly noted.

3. What Personal Data We Collect

3.1 B2C Retail Customers

3.2 Salon Partner Leads (Become a Partner Form)

3.3 B2B Salon Partners (Post-Onboarding)

3.4 All Users — Automatically Collected Data

• IP address and approximate geolocation (city/region level only)
• Device type, operating system, and browser version
• Pages visited, time spent, click patterns, and session duration
• Referral source (how you arrived at the platform)
• Cookie identifiers and session tokens (see Section 9 — Cookies)

4. How We Use Your Personal Data

4.1 B2C Retail Customers

• To authenticate your identity via OTP and manage your account
• To process and fulfil your orders, including delivery coordination
• To apply referral code discounts and link your purchases to the appropriate attribution node
• To send order confirmations, shipping updates, and delivery notifications
• To maintain your order history and allow you to view past purchases
• To process refunds and handle return requests
• To detect and prevent fraud, account misuse, or manipulation of referral codes
• To improve platform performance and user experience through anonymised analytics
• To send promotional communications (only with your consent — you may opt out at any time)

4.2 Salon Partner Leads

• To verify your identity via OTP before processing your enquiry
• To push your lead data to our CRM for sales team follow-up
• To send you the HLYWD MD Partner Programme brochure via email
• To track and manage your onboarding journey

4.3 B2B Salon Partners

• To create and manage your company, branch, and user accounts on the platform
• To conduct KYC verification and maintain compliance documentation
• To operate the multi-salon rolling attribution engine and calculate referral commissions
• To process wholesale orders and manage fulfilment from our warehouse
• To generate monthly commission payout batches and integrate with Microsoft Dynamics 365 Business Central
• To calculate and deduct TDS and generate TDS statements for your records
• To maintain complete audit logs of all platform activity for governance and dispute resolution
• To configure and manage your access to the partner portal based on your assigned role
• To send account notifications, commission statements, payout confirmations, and system alerts
• To suspend or restrict access in cases of policy violation or suspicious activity

5. How We Share Your Data

HLYWD MD does not sell your personal data. We share data only as necessary and with appropriate safeguards, in the following circumstances:

5.1 Technology & Service Providers

We engage trusted third-party vendors to operate the platform. These vendors process data on our behalf and are bound by data processing agreements:

• Cloud hosting and infrastructure providers (for secure data storage)
• Payment gateway providers (for processing retail and wholesale transactions)
• SMS and OTP gateway providers (for authentication)
• Email service providers (for transactional and partner communications)
• CRM platform (for partner lead management — Become a Partner flow)
• Logistics and courier partners (for order delivery — delivery address shared only)

5.2 Microsoft Dynamics 365 Business Central

Partner commission and payout data is exported to our Business Central integration for vendor invoice processing, TDS calculation, and payment confirmation. This includes partner name, PAN, bank details, and commission amounts. This transfer is essential for executing payouts and meeting statutory TDS obligations.

5.3 Statutory & Regulatory Authorities

We may disclose personal data to government or regulatory authorities where required by law, including:

• Tax authorities (Income Tax Department, GST authorities) for TDS and GST compliance
• Law enforcement or courts in response to valid legal orders or investigations
• Regulatory bodies as required under applicable Indian law

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred to the acquiring entity as part of that transaction. You will be notified via email and/or a notice on the platform if such a transfer occurs.

5.5 What We Never Do

• We never sell your personal data to third-party advertisers or data brokers
• We never share partner financial data (bank details, commission records) with other partners
• We never share KYC documents with any party other than authorised HLYWD MD personnel and the partner's own authorised users
• We never share retail customer purchase data with salon partners beyond anonymised attribution signals

6. How Long We Retain Your Data

At the end of the applicable retention period, data is securely deleted or anonymised such that it can no longer be linked to an identifiable individual.

7. How We Protect Your Data

HLYWD MD implements a multi-layered security framework to protect your personal data:

7.1 Technical Safeguards

• All data in transit is encrypted using TLS (Transport Layer Security) protocols
• Data at rest is stored on encrypted servers hosted with reputable cloud infrastructure providers
• Passwords and authentication tokens are stored using industry-standard hashing — plain-text passwords are never stored
• OTP-based authentication for retail customers with time-limited validity
• Optional Two-Factor Authentication (2FA) for B2B partner accounts
• Payment data is processed through PCI-DSS compliant payment gateways — HLYWD MD does not store full card details

7.2 Access Controls

• All partner portal access is role-based — users can only access data relevant to their assigned role
• KYC documents are stored in a private, access-restricted storage environment — not publicly accessible
• Access to partner financial data is restricted to Company Admin and Finance roles
• Internal HLYWD MD admin access to partner data is logged and auditable
• Database-level role enforcement ensures access controls cannot be bypassed at the application layer

7.3 Audit & Monitoring

• All significant user actions within the partner portal are logged with timestamp, user identity, and action type
• Commission changes, payout batch creation, KYC verifications, user role changes, and suspension events are all part of the audit trail
• Security monitoring is in place to detect unusual access patterns or potential data breaches

7.4 Breach Response

In the event of a personal data breach that poses a risk to individuals, HLYWD MD will:

• Notify affected users without undue delay (and within 72 hours where required by applicable law)
• Report the breach to the relevant authority as required under the Digital Personal Data Protection Act, 2023
• Take immediate steps to contain the breach and mitigate harm

While we take all reasonable measures to protect your data, no system is completely secure. We encourage you to use strong passwords, enable 2FA (for partner accounts), and notify us immediately if you suspect any unauthorised access to your account.

9. Cookies & Tracking Technologies

9.1 What We Use Cookies For

HLYWD MD uses cookies and similar tracking technologies on the platform for the following purposes:

9.2 Managing Cookies

• You can manage cookie preferences through the cookie banner displayed on your first visit to the platform
• You can also control cookies through your browser settings — please note that disabling essential cookies may impair platform functionality
• Third-party analytics providers (such as Google Analytics, if used) operate under their own privacy policies — links to these are available in our cookie preference centre

10. Children's Privacy

The HLYWD MD platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

11. Third-Party Websites & Links

The HLYWD MD platform may contain links to third-party websites (for example, logistics tracking portals or payment gateway pages). These websites operate under their own privacy policies, and HLYWD MD has no control over or responsibility for their data practices.

We encourage you to review the privacy policy of any third-party site you visit through a link on our platform. HLYWD MD is not liable for the privacy practices of third-party websites.

12. CRM & Marketing Communications

12.1 Partner Leads

When you submit the Become a Partner form, your data is pushed to our CRM platform for sales team follow-up. By completing OTP verification and submitting the form, you consent to:

• HLYWD MD contacting you via phone, email, or WhatsApp to discuss the Partner Programme
• Receiving the HLYWD MD Partner Programme brochure by email
• Being added to the partner prospect list in our CRM for follow-up communications

You can request removal from our CRM at any time by emailing privacy@hlywdmd.com.

12.2 Retail Customers

If you opt in to marketing communications at registration or at any point during your customer journey, we may send you:

• Promotional offers and discount codes
• New product announcements
• Seasonal campaigns and curated recommendations

You can unsubscribe from marketing emails at any time using the unsubscribe link in any email, or by updating your preferences in your account settings. Transactional emails (order confirmations, shipping updates, OTPs) are not affected by marketing opt-out.

12.3 Partner Communications

Active salon partners will receive the following communications as part of the partnership relationship (these are operational, not marketing, and cannot be opted out of while the partnership is active):

• Commission statements and payout confirmations
• TDS deduction notices and downloadable statements
• Platform updates, policy changes, and system notifications
• KYC expiry reminders and document renewal alerts

13. Data Localisation & Cross-Border Transfers

HLYWD MD is an India-based platform. All personal data is stored on servers located within India, in compliance with applicable data localisation requirements.

In limited circumstances, data may be processed by third-party service providers whose infrastructure is partially located outside India (for example, global cloud hosting providers or email service platforms). Where such transfers occur, we ensure:

• The receiving party provides an equivalent or higher level of data protection
• Appropriate contractual safeguards (Data Processing Agreements) are in place
• Transfers are limited to what is strictly necessary for the service to function

Your KYC documents and financial data (PAN, bank details, commission records) are never transferred outside India.

14. Changes to This Privacy Policy

HLYWD MD reserves the right to update this Privacy Policy at any time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify registered retail customers and active salon partners via email
• Display a prominent notice on the platform for a minimum of 30 days following the change

Your continued use of the platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree to the changes, you must discontinue use of the platform and may request account closure.

16. Contact Us

For any privacy-related queries, data rights requests, or to withdraw consent, please reach out to us through any of the following channels:

By using the HLYWD MD platform, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein.