Privacy Policy

Your trust matters. Here's how we protect your personal information and use it responsibly.

Protecting Your Privacy

Last updated 7/7/2025

At R&R Head Labs (“R&R,” “we,” “our,” or “us”), we are committed to protecting your privacy, the protection of your personal data and creating a trusted experience both in our barbershops and online. This privacy notice (“Notice”) explains how we collect, store, use, share, transfer, delete, process and protect your information that is collected from or about you, known as Personal Data (defined further below in this Notice) when you visit our website, use our mobile app, or engage with our services.

Purpose and Reach of this Privacy Notice

This Notice describes the types of Personal Data that R&R may collect or process, how we may use and disclose that Personal Data, and how you may exercise any rights you may have regarding our processing of your Personal Data.

This Notice applies to the processing of your Personal Data when you visit www.rrheadlabs.com (the “Website”) or when you visit us at our physical location and are our customer. This Notice also applies when we process your Personal Data to receive and respond to communications you make with us either online (such as by email) or offline to our physical address.

R&R may provide you with a different privacy notice in certain specific situations, in which case that privacy notice or policy will apply to the Personal Data collected or processed in that specific situation, rather than this one. If you provide us with Personal Data of anyone other than yourself, please note that you are responsible for complying with all applicable privacy and data protection laws prior to providing that information to R&R (including obtaining consent, if required).

Please review this Notice carefully. To the extent permitted by applicable law, by providing us your Personal Data or otherwise interacting with us, you are agreeing to this Notice.

Information Collected

What is Personal Data?

“Personal Data” is any information—as electronically or otherwise recorded—that can be used to identify a person or that we can link to or associate with a specific individual. Personal Data in some jurisdictions can include information that indirectly identifies a person, such as a unique display name, even absent other identifying information.

Personal Data may include information considered sensitive in some jurisdictions, such as financial account information, social security number, driver’s license, state identification card, passport number, and other similar information.

We will process any Personal Data we collect in accordance with applicable law and as described in this Notice (unless, as explained above, a separate policy or notice governs). In some circumstances, if you do not provide us with your Personal Data, the Website may be unavailable to you.

Our Customers, Website Visitors and Persons Who Communicate with Us

We may process your Personal Data when you visit us in person and are our customer, when you visit our Website, or when you communicate

with us either online (such as by email) or offline (such as by phone or to our physical address).

Examples of the types of data we process

Identity and contact information, such as:

• first and last name or unique pseudonym

• honorifics and titles, preferred form of address

• email address

• postal address

• phone number

Commercial and financial information,

such as:

• products and services purchase, obtained, or considered

• customer service records

• financial transaction history

• credit card number, expiration date, and CVV

• financial account number

Video and audio information, such as:

• Recordings of your calls with our customer service representatives

Technical Information,

• Internet Protocol (IP) addresses (which may identify your general geographic location or company)

• browser type and browser language

• device type

• advertising IDs associated with your device (such as Apple’s Identifier for Advertising (IDFA) or Android’s Advertising ID (AAID))

• date and time you use the Website

• Uniform Resource Locators, or URLs (i.e., website addresses) visited prior to arriving and after leaving the Website

• activity on the Website and referring websites or applications

• data collected from cookies or other similar technologies***

Other information, such as:

• Information about medical conditions or your health that may be useful to us providing services to you.

Deidentified Data:

• Deidentified data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Data under data protection laws

Where do we get the data?

• you directly

• those authorized to provide personal data on your behalf such as your authorized representative

• your devices

• third parties that provide access to information you make publicly available, such as social media

Why do we process the data?

• to provide services to you

• to administer the Website

• to communicate with you and respond to your requests

• to administer our relationship with your organization

• to send you updates

• to customize content for you

• to identify and authenticate you

• to detect security incidents

• to protect against malicious or illegal activity

• to ensure the appropriate use of the Website

• to improve the Website

• for short-term, transient use

• for administrative purposes

• for marketing, internal research, and development for quality assurance and to assist in training and development of our representatives*

• to comply with legal and regulatory obligations

Who receives the data?

• R&R and its affiliates

• third parties who assist us in providing the Website or helping us improve our marketing or administration

• third parties who assist with fraud prevention, detection and mitigation

• third parties who assist with our information technology and security programs and our loss prevention programs

• R&R’s lawyers, auditors and consultants**

**In limited circumstances, recipients may include, (1) in the event of a sale, assignment, merger, consolidation, corporate reorganization, or transfer, to the buyer, assignee, or transferee; and (2) government or regulatory officials, law enforcement, courts, public authorities, or others when permitted by this Notice or required by law.

***Please see the Cookies and Tracking Technologies section below for more information on how we use cookies and similar technologies.

Cookies and Tracking Technologies

To the extent permitted by applicable law, including in accordance with your consent where required by applicable law, we may collect Personal Data automatically though cookies and other technologies to provide functionality to the Website; to recognize you across devices when using the Website in each case where this is justified under applicable data protection law for our legitimate business purposes or with consent, where required. These legitimate business purposes include evaluating information about the use of the Website and identifying trends; developing or enhancing the Website; providing an experience tailored to you when you use the Website; and effecting certain security controls.

Use of Data for Research & AI

At R&R Head Labs, we believe in using data responsibly to continually improve our services. We may use aggregated, anonymized customer data to:

Analyze customer behaviors and trends
Improve our shop operations and digital experiences
Train and refine AI systems that help us understand customer needs and optimize service delivery

We do not use AI to make automated decisions about individuals without human oversight, and your personally identifiable information will never be sold or shared without your explicit consent.

Opt-out of Targeted Advertising or the Sale of Your Personal Data

Certain of R&R’s practices may be considered the use of Personal Data for targeted advertising purposes or the sale of Personal Data under certain applicable laws. You may have the right to opt-out. To exercise these rights, please see the Your Rights Regarding Your Personal Data section below.

Third Parties

Our website may contain links to other websites, applications, products, or services that are not owned or operated by R&R, such as social media websites and applications like Facebook and X. You should carefully review the privacy policies and practices of other websites, products, and services as we cannot control and are not responsible for privacy policies, notices, or practices of third-party websites, applications, products, and services.

Your Rights Regarding Personal Data

Please note that in many circumstances, we cannot effectively do business with you without processing some Personal Data about you (e.g., your contact information). For example, when you contact us, we may require you to provide information to authenticate your identity to assist you with your request. If you are unable to provide this information, we may be unable to process your request.

You may have the following rights:

• To request access to and a copy or representative summary of your Personal Data, including to provide your Personal Data directly to another organization, i.e., a right to data portability;

• To request to know about the Personal Data we process about you and who we share it with or, in other states, to request to acknowledge our processing of your Personal Data;

• To request that we correct your Personal Data;

• To request that we delete your Personal Data;

• To opt-out of processing or portions of processing of your Personal Data, including to opt-out of the sharing or sale of your Personal Data or to opt-out of targeted advertising;

• To appeal the denial of a request; and

• When we previously obtained your consent, to withdraw consent to processing

To learn if you have the other above rights in the state in which you live and to exercise any of these rights with respect to your Personal Data, please contact us at info@rrheadlabs.com. We will not discriminate against you for exercising any of the rights described above, although we may not be able to continue to provide you the Website or it may otherwise affect the way we are able to interact with you.

We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws. We may, after receiving your request, require additional information from you to honor your request and verify your identity. Please be aware that we may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so.

In the event you wish to make a complaint about how we process your Personal Data, please contact us at info@rrheadlabs.com, and we will handle your request as soon as possible. Even if you make a complaint to us, you may always lodge a complaint with the relevant authority in your location.

How Long Your Personal Data Will be Retained

We generally retain Personal Data for as long as needed for the specific business purpose or purposes for which it was collected or obtained, and as outlined in this Notice. In some cases, we may be required to retain Personal Data for a longer period of time by law or for other necessary business purposes. Whenever possible, we aim to de-identify the information or otherwise remove some or all information that may identify you from records that we may need to keep for periods beyond the specified retention period. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you; (ii) whether there is a legal obligation to which we are subject that affects the Personal Data; and (iii) whether retention is determined to be necessary or advisable for R&R due to applicable statutes of limitations, litigation, or other legal or regulatory obligations. R&R takes reasonable steps to dispose of Personal Data upon the expiration of retention periods taking into consideration these litigation, legal, or regulatory obligations.

Changes to Privacy Notice

We reserve the right to change this Notice from time to time. We will alert you when changes have been made by indicating the date this Notice was last updated as the date the Notice became effective or as otherwise may be required by law. It is recommended that you periodically revisit this Notice to learn of any changes.