Privacy Policy

Last updated: September 2026. This page sets out our policy commitments in plain language. It is a governance doctrine, not a substitute for jurisdiction-specific legal advice — have it reviewed by counsel before relying on it in production.

FFC Fischer Fritz PBC ("Fischer Fritz," "we," "us") respects the people who come to this site — whether you're requesting support, buying from our marketplace, contributing, or just reading. This notice explains what personal data we collect, why, and what rights you have over it, in line with the EU General Data Protection Regulation (GDPR) and comparable US state privacy laws.

Who is responsible for your data

FFC Fischer Fritz PBC, incorporated in Delaware, USA, is the data controller for information collected through this site. For visitors in the European Union, we intend to designate an EU representative under Article 27 GDPR; that contact will be published here once appointed.

What we collect

Support requests

When you submit a request through our Request Support page, we collect your name, email, phone number (if provided), city/region, the details you share about what's needed, and any referral source you name. If you submit a request on someone else's behalf — for example, a child's birthday — we collect only what's necessary to evaluate and fulfil that request.

Marketplace purchases and contributions

Payments for shop purchases and contributions are processed by Stripe. We do not receive or store your full card details — Stripe handles that directly under its own privacy policy. We do receive confirmation of payment, the amount, and the email address you provide at checkout.

Makers on our marketplace

Women who list products with us provide their name (or the name they wish to display), a description of their product, and payment details required to receive their share of proceeds.

Website usage

See our Cookie Policy for details on any cookies or similar technology used on this site.

Why we process your data, and our legal basis

To respond to support requests — legitimate interest in operating our support programs, and your consent when you submit the form.
To process purchases and contributions — performance of a contract (completing your order or contribution) and compliance with financial record-keeping obligations.
To list marketplace products — performance of our agreement with the maker.
To communicate with you about a request, order, or contribution — legitimate interest and/or contractual necessity.

Who we share data with

We share data only where necessary to deliver the service you asked for: Stripe (payment processing), local partner salons and hairdressers (only the details needed to fulfil a haircut or manicure request), and, where you've asked, the family, teacher, or organisation who referred you. We do not sell personal data.

International transfers

Because Fischer Fritz is a US company, data from EU visitors may be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses or an equivalent safeguard with our processors (including Stripe) to protect that transfer.

Children's data

Our Family Fund program supports birthday and milestone celebrations for children, but requests are always submitted by an adult (a parent, guardian, or referring professional) — we do not knowingly collect personal data directly from children through this site.

How long we keep your data

We retain support-request data for as long as needed to process the request and for a reasonable period afterward for our own accountability and reporting, after which it is deleted or anonymised. Payment records are retained as required by financial and tax law. Exact retention periods will be published here once finalised with counsel.

Your rights

Subject to applicable law, you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data
Restrict or object to certain processing
Receive your data in a portable format
Lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at privacy@ffcfischerfritz.org.

Security

We use reasonable technical and organisational measures to protect the personal data we hold, including relying on Stripe's PCI-compliant infrastructure for payment data rather than handling card details ourselves.

Changes to this notice

We'll update this page as our practices evolve, and note the date of the most recent revision at the top.

Contact

Questions about this notice or your data can be sent to privacy@ffcfischerfritz.org.