Privacy Policy

A legal disclaimer

1. Purpose of This Privacy Policy

This Privacy Policy explains how we collect, use, store, share, and protect your personal information in accordance with the Protection of Personal Information Act (POPIA) and the Consumer Protection Act (CPA). It applies to all visitors, clients, and users of our website, booking system, WhatsApp, and in‑salon services.

2. What Personal Information We Collect

We collect the following categories of personal information:

Identity details: name, surname
Contact details: phone number, email address
Booking information: treatment history, appointment dates, preferences
Health‑related information: allergies, contraindications, skin conditions (only when relevant to treatment safety)
Payment information: proof of payment, invoices (we do not store card details)
Website data: IP address, browser type, cookies, analytics data (Google Analytics, Meta Pixel)
Communication records: WhatsApp chats, emails, consent records

3. How and Why We Use Your Information

We process your information for the following purposes:

To confirm bookings and send appointment reminders
To provide safe and personalised beauty treatments
To maintain accurate treatment records
To comply with legal obligations (invoices, tax records)
To improve our website and marketing performance
To send marketing messages only with explicit consent (POPIA requirement)

4. Consent

By using our website, booking system, or salon services, you consent to the processing of your personal information. For marketing (WhatsApp, SMS, email), we obtain separate, explicit consent via an unticked checkbox or written opt‑in. You may withdraw consent at any time.

5. Data Retention

We retain personal information only as long as necessary:

Treatment records: 3–6 years (industry standard + CPA requirements)
Financial records: 5 years (SARS requirement)
Marketing lists: until consent is withdrawn
CCTV footage (if applicable): 30–90 days

After retention periods expire, data is securely deleted.

6. Data Sharing

We may share your information with:

Website hosting providers
Email and SMS service providers
Booking system providers
Payment processors
Marketing platforms (Meta, Google)
Regulatory bodies if legally required

We do not sell personal information.

All third‑party operators are required to comply with POPIA.

7. Cross‑Border Transfers

Some service providers (e.g., Google, Meta) store data outside South Africa. We ensure these providers meet POPIA’s security requirements.

8. Your Rights Under POPIA

You have the right to:

Request access to your personal information
Ask for corrections or updates
Request deletion (where legally permitted)
Withdraw consent
Lodge a complaint with the Information Regulator

9. Security Measures

We take reasonable steps to protect your information:

SSL‑secured website (HTTPS)
Password‑protected devices
Two‑factor authentication on email accounts
Restricted access to treatment records
Secure backups and encrypted storage

10. Cookies & Tracking

Our website uses cookies, Google Analytics, and Meta Pixel to improve user experience and marketing performance. You may disable cookies in your browser settings.

11. PAIA Manual

As required by Section 51 of PAIA, we maintain a PAIA Manual describing the records we hold and how access requests may be made. This manual is available at our business premises and on our website.

12. Updates to This Policy

We may update this Privacy Policy periodically. The latest version will always be available on our website.