Effective as of: June 8, 2026
1. Purpose
1.1. The purpose of this Privacy Policy is to inform the users, customers and visitors of C.16 Beauty Studio about the way in which their personal data is collected, used, stored, retained, transferred, communicated and protected when they interact with the website c16beauty.com, make purchases, create accounts, use the virtual assistant Arthur or make use of any of the services offered by C.16 Beauty Studio.
1.2. This Privacy Policy is issued in accordance with the Organic Law on Personal Data Protection (Ley Orgánica de Protección de Datos Personales, LOPDP), its General Regulations and other applicable regulations. Its purpose is to guarantee transparency regarding the processing of personal data and to provide information about the rights of data subjects, the purposes of the processing, the applicable legal bases and the mechanisms to exercise their rights.
2. Data controller
2.1. The controller of the personal data processing is:
- Controller: José Gregorio Loyo Ybáñez
- RUC (taxpayer ID): 1761401130001
- Address: Luxemburgo N34-359 and Portugal intersection, Cosmopolitan Parc Building, Block T1, 3rd floor, office 307, Iñaquito, Quito, Ecuador
- Privacy email: soporte@c16beauty.com
2.2. C.16 Beauty Studio will determine the purposes and means of processing the personal data collected through the store, except for processing carried out directly by independent third parties, such as the payment gateway, in accordance with their own policies and contracts.
2.3. Certain services provided through the Website may involve the participation of technology providers or third-party processors acting on behalf of the controller, as well as third parties acting as independent controllers with respect to their own processing of personal data, in accordance with their privacy policies and applicable legal obligations.
3. Scope
3.1. This Privacy Policy applies to the processing of personal data of visitors to the Website, users who create or maintain an account, customers who make purchases, people who communicate with C.16 Beauty Studio through its service channels, users who interact with the AI-based virtual assistant "Arthur", whether by text or voice when that functionality is enabled, as well as users who accept, reject or configure cookies and similar technologies used on the Website.
3.2. This Policy exclusively governs the processing of personal data for which José Gregorio Loyo Ybáñez acts as data controller.
3.3. This Policy does not substitute or replace the privacy policies, terms of use or conditions applicable to third parties involved in the provision of certain services, including payment providers, financial institutions, couriers, hosting and technology infrastructure providers, artificial intelligence services, voice processing services, social networks and other external providers. Where appropriate, users may consult the privacy policies of those third parties to learn about the processing they carry out on their personal data.
4. Personal data we collect
4.1. C.16 Beauty Studio may collect and process different categories of personal data, including identification data such as first and last names; contact data such as email address, telephone number and shipping address; account data such as access credentials protected by appropriate security mechanisms, account creation date and order history; data related to purchases and transactions, including products purchased, amounts, purchase dates, order status, delivery address and sales receipts; and limited payment-related data, such as transaction status, payment identifiers, approved or declined amounts and other information necessary for reconciliation, invoicing and customer service. C.16 Beauty Studio does not store full credit or debit card numbers.
Likewise, data related to shipments may be collected, including the recipient's name, delivery address, contact telephone number, delivery references, waybill number and shipment status; data derived from communications made by email, WhatsApp, contact forms, support requests, claims and conversations held with the virtual assistant Arthur; technical data such as IP address, device identifiers, browser type, operating system, access logs and security events; data obtained through cookies and similar technologies in accordance with the Cookie Policy; and data voluntarily provided by users related to purchase preferences, hair type, product interests or hair-care needs.
4.2. C.16 Beauty Studio does not intentionally request special categories of personal data or sensitive information. Users must refrain from providing medical information, diagnoses, severe allergies, data of minors, passwords, full payment card numbers or other information that is not necessary for the provision of the services offered.
4.3. In the event that the user voluntarily provides sensitive or delicate information through Arthur or the service channels, C.16 Beauty Studio will only process it to the extent strictly necessary to handle the corresponding request, guarantee the provision of the service, comply with legal obligations or exercise legitimate rights, and may also proceed to delete, anonymize or minimize it where appropriate.
5. Purposes and legal bases
Personal data will only be processed when there is an applicable legal basis, such as consent, contractual or pre-contractual performance, legal obligation, legitimate interest or another basis provided for by the LOPDP.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage the user account | name, email, telephone, order history, credentials | performance of pre-contractual/contractual measures; legitimate interest in managing the account |
| Process purchases | identification, contact, order, address, payment status | contractual performance |
| Manage payments through PayPhone | transaction data, amount, payment identifier | contractual performance; legal obligation; payment operation |
| Coordinate shipments by courier | name, telephone, address, order data | contractual performance |
| Issue receipts and comply with tax obligations | billing and purchase data | legal obligation |
| Customer service, claims, exchanges and returns | purchase data, contact, communications | contractual performance; legal compliance; legitimate interest |
| Operation of Arthur | conversations, communicated preferences, necessary technical data | pre-contractual/contractual performance; consent where applicable; legitimate interest in customer service |
| Site security and fraud prevention | logs, IP, technical data, transactions | legitimate interest; legal compliance |
| Sending commercial communications | email, telephone, preferences | data subject's consent or applicable legal basis; the user may withdraw it |
| Analytics and site improvement | analytics cookies, browsing, metrics | consent or legitimate interest, depending on configuration and cookie type |
| Handling personal data rights requests | identification and request data | legal obligation |
6. Payments and PayPhone
6.1. Payments made by credit or debit card are processed through the PayPhone platform. C.16 Beauty Studio does not store full card numbers, security codes (CVV), banking credentials or other financial credentials used to authorize payments.
6.2. Payment processing may involve the processing of personal data by PayPhone and the financial institutions involved in the transaction, in accordance with their respective privacy policies, terms of service and applicable legal obligations.
6.3. Before using this payment method, the user may consult the policies, terms and conditions published by PayPhone to learn how that platform processes information related to transactions.
6.4. C.16 Beauty Studio may receive limited transaction-related information from PayPhone, including its status, payment identifiers, date, amount and other data necessary to confirm payments, process orders, issue sales receipts, manage returns, handle claims, prevent fraud and comply with legal obligations.
7. Shipments and couriers
7.1. To manage the delivery of orders, C.16 Beauty Studio may share with the corresponding courier or logistics provider the personal data strictly necessary for the provision of the service, including the recipient's name, delivery address, telephone number, location references, order number and any other information required to carry out the delivery.
7.2. The logistics providers involved in the delivery of orders will process personal data in accordance with the applicable legal obligations, the contractual agreements entered into with C.16 Beauty Studio and the confidentiality and security measures that may be required.
7.3. Where applicable in accordance with the relevant regulations, C.16 Beauty Studio will adopt the necessary contractual and organizational measures to ensure that providers acting on its behalf process personal data only for the authorized purposes and with adequate levels of protection.
8. AI virtual assistant "Arthur"
8.1. Arthur is an artificial intelligence-based virtual assistant that allows users to make inquiries and receive general guidance about products, hair-care routines, product availability, the operation of the Website and purchase processes.
8.2. When interacting with Arthur, the user may provide messages, inquiries, preferences, hair-care needs and any other information they voluntarily decide to communicate by text or, when enabled, through voice functionalities.
8.3. C.16 Beauty Studio may process the information exchanged with Arthur to answer inquiries, provide indicative product recommendations, improve the customer service experience, document requests or claims, maintain the security of the service and prevent misuse, fraudulent activities or behavior that affects the proper functioning of the platform.
8.4. Users must not use Arthur to communicate sensitive data, medical information, diagnoses, severe allergies, data of minors, passwords, full payment card numbers or other information that is not necessary for handling their inquiry.
8.5. Arthur is an informational support and customer service tool. The answers provided are indicative in nature and do not replace the judgment of professionals in health, dermatology, cosmetology, professional hairstyling or any other specialized advice that may be necessary.
8.6. External technology providers may be involved in providing Arthur's functionalities, including Google Gemini for language processing and artificial intelligence, and ElevenLabs for functionalities related to voice synthesis or processing, when those functionalities are enabled. These providers may process information necessary to provide their respective services, in accordance with the applicable agreements and the security measures implemented.
8.7. Conversations held with Arthur and the information associated with its operation may be processed or stored outside Ecuadorian territory. Such processing and international transfers will be carried out in accordance with this Privacy Policy and the applicable personal data protection regulations.
8.8. Arthur does not make automated decisions that produce legal effects or significantly affect users. Should profiling mechanisms or automated decisions subject to specific regulation be implemented in the future, C.16 Beauty Studio will provide the corresponding information and adopt the measures required by the applicable regulations.
9. Cookies and similar technologies
9.1. C.16 Beauty Studio uses cookies and similar technologies that are necessary for the operation of the Website, including those related to session management, user authentication, shopping cart operation, platform security and the provision of the services requested by users.
9.2. Likewise, C.16 Beauty Studio may use analytics, performance, measurement or additional functionality cookies for the purpose of understanding the use of the Website, improving the user experience and optimizing the services offered, when there is a valid legal basis for doing so and, in the cases required by the applicable regulations, with the user's prior consent.
9.3. Detailed information about the categories of cookies used, their purposes, duration, providers, configuration mechanisms and consent management is available in the Cookie Policy.
10. Commercial communications
10.1. C.16 Beauty Studio may send commercial communications, promotions, news, product recommendations and information related to its services only when there is a valid legal basis, including the data subject's consent or any other legal basis provided for in the applicable regulations.
10.2. The user may at any time request exclusion from commercial communications, withdraw their consent or exercise their right to object through the cancellation or unsubscribe mechanisms included in each communication, by writing to soporte@c16beauty.com or by using any of the contact channels enabled by C.16 Beauty Studio.
10.3. In accordance with the applicable regulations, commercial communications sent by electronic means will include reasonable and accessible mechanisms that allow the recipient to confirm their subscription, update their preferences or request their exclusion from distribution lists or databases used for promotional purposes.
10.4. Exclusion from commercial communications will not affect the sending of communications necessary for the management of orders, payments, invoicing, shipments, returns, customer service, account security, compliance with legal obligations or any other communication related to the contracted services.
11. Data retention
11.1. C.16 Beauty Studio will retain personal data only for the time necessary to fulfill the purposes stated in this Policy, meet legal obligations, handle claims, exercise or defend rights and comply with requirements of competent authorities.
11.2. Personal data will be retained according to the following general criteria:
| Data category | Retention period |
|---|---|
| User account | While the account remains active and up to two (2) years after its closure or last activity, unless a legal obligation or legitimate interest justifies a longer period. |
| Order history | Up to seven (7) years from the last purchase or for the period required by the applicable tax, accounting or commercial regulations, whichever is longer. |
| Receipts and invoicing | For the period required by the applicable tax and accounting regulations. |
| Shipping data | Until the effective delivery of the order and for the time necessary to handle claims, returns or logistical incidents, up to two (2) additional years. |
| Customer service communications | Up to three (3) years from the last interaction related to the request or claim. |
| Conversations with Arthur | Up to two (2) years from the last interaction, unless it is necessary to retain them for security, customer service or legal compliance reasons. |
| Marketing data | While a valid legal basis exists and until the user withdraws their consent or opts out of receiving such communications. Exclusion records may be retained for as long as necessary to honor that decision. |
| Cookies | In accordance with the periods established in the Cookie Policy and the specific duration of each cookie. |
| Security records and logs | Up to five (5) years or for the time necessary to prevent fraud, investigate security incidents or comply with legal obligations. |
11.3. Once the applicable retention periods have elapsed, personal data will be deleted, anonymized, blocked or retained only when there is a legal obligation, a requirement from a competent authority or a duly justified legitimate need.
12. Security
12.1. C.16 Beauty Studio implements reasonable technical, organizational, physical and legal measures aimed at protecting personal data against loss, unauthorized access, alteration, disclosure, destruction, misuse or any other form of unauthorized processing.
12.2. Security measures may include, among others, encryption mechanisms, secure access credentials, access controls based on authorized profiles, backups, security incident management, system monitoring, confidentiality agreements, controls over technology providers, periodic review of permissions and other measures appropriate to the nature of the data processed.
12.3. C.16 Beauty Studio will review and update its security measures when necessary, considering the nature of the personal data processed, the risks associated with the processing, the state of technology and the obligations set out in the applicable personal data protection regulations.
13. Recipients and third parties
13.1. C.16 Beauty Studio may communicate or allow access to personal data, only to the extent necessary to fulfill the purposes described in this Policy, to the following categories of recipients:
a) Payment service providers and financial institutions involved in transaction processing, including PayPhone.
b) Couriers, logistics operators and transportation providers in charge of delivering orders.
c) Providers of web hosting, technology infrastructure, data storage, databases, cloud services, email, technical support and IT security, including Vercel and Supabase.
d) Technology providers used for the provision of the virtual assistant Arthur, including Google Gemini for artificial intelligence services and ElevenLabs for voice processing or synthesis functionalities when those functions are enabled.
e) Providers of analytics, monitoring, performance and digital service improvement used by C.16 Beauty Studio.
f) Legal, accounting and tax advisors, auditors and other professionals subject to confidentiality obligations.
g) Administrative, judicial, tax or control authorities, or any other competent entity when there is a legal obligation, valid order or legitimate requirement.
13.2. C.16 Beauty Studio does not sell, rent or trade its users' or customers' personal databases.
13.3. When a third party processes personal data on behalf of C.16 Beauty Studio, reasonable measures will be adopted to require compliance with confidentiality, security, purpose-limitation and other applicable obligations in accordance with the regulations in force and the corresponding contractual agreements.
14. International transfers
14.1. In connection with the provision of its digital services, C.16 Beauty Studio may carry out transfers or communications of personal data, or allow international access to it, when necessary for the operation of the Website, database management, payment processing, provision of the virtual assistant Arthur, information hosting, systems security, technology support or any other legitimate purpose described in this Policy.
14.2. The personal data processed by C.16 Beauty Studio may be stored, processed or accessible from servers located outside Ecuadorian territory, including the United States of America, through technology providers involved in the provision of the services. Such providers may include Vercel, for web hosting and infrastructure; Supabase, for data storage and database management; Google Gemini, for artificial intelligence functionalities used by Arthur; ElevenLabs, for voice processing or synthesis functionalities when enabled; and other technology providers reasonably necessary for the operation of the platform.
14.3. C.16 Beauty Studio will endeavor to ensure that international transfers of personal data are carried out in accordance with the provisions of the Organic Law on Personal Data Protection and other applicable regulations, adopting the legal, contractual, organizational or technical measures reasonably necessary to guarantee an adequate level of protection of personal data.
14.4. International transfers may be based, as applicable, on the performance of the contractual relationship with the user, the data subject's consent, the need to provide the requested services, the use of specialized technology providers or any other legal basis permitted by the applicable regulations.
14.5. By using the Website, creating an account, making purchases or interacting with Arthur, the user acknowledges that certain personal data processing operations may require the involvement of providers located outside Ecuador, in accordance with the provisions of this Privacy Policy.
15. Data subject rights
15.1. Data subjects may exercise the rights recognized by the Organic Law on Personal Data Protection and other applicable regulations, including the right to information, access, rectification, updating, deletion, objection, portability, suspension of processing, as well as the right not to be subject to decisions based solely on automated processing where applicable. They may also submit inquiries, complaints or requests to the competent personal data protection authority in accordance with the legislation in force.
15.2. To exercise any of these rights, the data subject may submit a request via email to soporte@c16beauty.com or through the contact channels enabled by C.16 Beauty Studio, attaching the information necessary to verify their identity and properly process the request.
15.3. C.16 Beauty Studio will handle requests related to data protection rights within the periods and in accordance with the procedures established in the applicable regulations.
15.4. When there are reasonable doubts about the identity of the requester or when the request is submitted by a representative, C.16 Beauty Studio may require additional information or documentation to verify the legitimacy of the request and protect the rights of the data subject.
16. How to exercise rights
16.1. To exercise any of the rights provided for in this Policy and in the applicable regulations, the data subject must send a request to soporte@c16beauty.com, indicating at least: (i) the requester's first and last names; (ii) sufficient information to verify their identity; (iii) the right they wish to exercise; (iv) a clear and precise description of the request; (v) a means of contact to receive the response; and (vi) any relevant supporting documentation, where applicable.
16.2. In order to protect personal information and prevent unauthorized access, C.16 Beauty Studio may request additional information or documentation to verify the identity of the data subject or their legal representative before processing the request.
16.3. Requests will be handled within the periods and in accordance with the procedures established in the applicable regulations. In the cases permitted by law, C.16 Beauty Studio may require additional information, request clarifications or totally or partially deny the request when there is a legal cause that justifies it.
16.4. When the request is submitted by a representative, proxy or authorized person, C.16 Beauty Studio may require documentation evidencing such representation before providing access to the personal data or executing the requested action.
17. Complaints before the authority
17.1. Without prejudice to any other available service or complaint mechanism, the data subject may submit inquiries, reports, complaints or requests to the competent authority when they consider that the processing of their personal data violates their rights or breaches the applicable regulations.
17.2. In the Republic of Ecuador, the Superintendence of Personal Data Protection (Superintendencia de Protección de Datos Personales) is the authority in charge of promoting, regulating, supervising and guaranteeing compliance with personal data protection regulations.
17.3. C.16 Beauty Studio recommends that, before turning to the competent authority, the data subject use the service channels established in this Policy to try to resolve their request or complaint directly, without this constituting a mandatory requirement for the exercise of their rights.
18. Data of minors
18.1. The products and services offered by C.16 Beauty Studio are aimed at adults with legal capacity to contract in accordance with Ecuadorian legislation. C.16 Beauty Studio does not intentionally collect personal data of children or adolescents, nor does it specifically direct its services at this group of people.
18.2. If C.16 Beauty Studio detects or becomes aware that it has collected personal data of a minor without the authorization or legal representation required under the applicable regulations, it may suspend the corresponding account, restrict access to certain services and adopt the necessary measures to delete or anonymize such data, unless there is a legal obligation to retain it.
18.3. Parents, legal representatives or guardians who believe that a minor has provided personal data to C.16 Beauty Studio may contact us through the channels indicated in this Policy to request a review of the case and, where appropriate, the adoption of the pertinent measures.
19. Changes to this Policy
19.1. C.16 Beauty Studio may update or modify this Privacy Policy when necessary due to legal, regulatory, technological, operational, commercial or security changes, or any other circumstance affecting the processing of personal data.
19.2. The current version of the Privacy Policy will be available on the Website and will include the date of its last update.
19.3. Modifications will take effect upon their publication on the Website, unless a different date is expressly indicated or the applicable regulations require an additional notification or consent mechanism.
20. Contact
For inquiries related to privacy, personal data protection or the exercise of rights recognized by the applicable regulations, data subjects may contact the data controller, José Gregorio Loyo Ybáñez, identified with RUC No. 1761401130001, domiciled at Luxemburgo N34-359 and Portugal, Cosmopolitan Parc Building, Block T1, 3rd floor, office 307, Iñaquito sector, Quito, Ecuador, via email at soporte@c16beauty.com.