Privacy Policy
Plain-language privacy choices, practical retention and control over your data.
Last updated: 21 September 2026
This policy explains how JC Hairdressing, operated by Jade in Jukskei Park, processes personal information under South Africa’s Protection of Personal Information Act, 2013 (“POPIA”). JC Hairdressing is the responsible party for the salon website, client accounts and booking records.
What we collect
- Account and contact data: name, email address and mobile number, including an optional guest email supplied to send a private booking invitation.
- Booking data: chosen service and option, appointment time, status, price and notes you provide about your hair or visit.
- Preparation and safety data: colour and chemical history, sensitivities, goals, appointment preparation answers and patch-test status for relevant colour or chemical services.
- Visit-care data: Jade’s private professional formula and technical notes, plus result, aftercare and future-service recommendations recorded for continuity.
- Cancellation-list data: the service, date range, suitable days, time window and notice period you choose.
- Communications: questions, contact messages and replies.
- Optional appointment photograph: one current-hair or reference photo you actively attach to a relevant colour or chemical preparation form. A photo may include your face.
- Operational records: payment method and amount, appointment-related cash records, security logs and consent timestamps.
- Technical data: limited request, security and performance data needed to operate and protect the app.
Why we use it
We use necessary account, booking and contact information to provide requested salon services, manage appointments, send and retry transactional messages, prevent duplicate requests and double-booking, prepare safe and consistent salon services, offer compatible cancelled times, keep the service secure, maintain appropriate business records and respond to legal requests. Guest invitation data is used to let the invited person claim only their own service and preparation record. An optional appointment photo is used only to prepare for that consultation or appointment. Promotional email or messaging requires a separate opt-in and is not a condition of booking.
Name, contact details, service and time are required to request and manage an appointment. Cancellation-list preferences and photos are voluntary. Relevant preparation and safety-history answers may be required before Jade can provide a colour or chemical service. If required information is not provided, Jade may need to change, postpone or decline the service.
Jade’s formula and technical observations are private professional working notes. The preparation form is not a medical record or automated diagnosis.
Reference and face photos
Uploading a photo is optional, is offered only inside relevant appointment preparation, and requires explicit consent. Only one current photo is kept for an appointment; attaching a replacement deletes the previous one. Photos are stored in a private object store and are available only to Jade through the protected Salon Desk. We do not use face recognition, create biometric templates, identify people from photos, train AI systems with them, sell them or use them in marketing. A separate written permission would be required before any client image is published.
Who processes information
Jade is the only intended Salon Desk user. Carefully selected service providers process limited information on our instructions:
- Cloudflare: website delivery, security, application processing, database storage, private photo storage and inbound email routing.
- Google Calendar: appointment timing and free/busy checks. Clients receive available times only and never calendar event titles, attendee names, notes or the reason time is blocked.
- Resend: transactional booking, sign-in and enquiry email delivery.
- Gmail: Jade’s operational mailbox once domain routing is configured.
Some providers may process data outside South Africa. We limit what is shared, use provider security and contractual protections, and only use the information for the purposes described here.
How long we keep it
| Record | Normal retention |
|---|---|
| Login codes | Until expiry, then removed by automated housekeeping. |
| Signed-in sessions | Until expiry or sign-out. |
| Appointment reference photos | 180 days from upload, or sooner when you replace or remove the photo or delete the account. |
| Guest invitations | Invitation links expire after 14 days; accepted, expired or revoked invitation records are normally removed within 12 months. |
| Transactional email delivery records | Delivered message bodies are normally removed after 90 days; exhausted failed deliveries after 180 days. |
| Questions, messages and completed cancellation-list requests | 12 months. |
| Preparation answers, readiness steps, patch-test status and visit-care records | While the account is active and normally up to 24 months after the last relevant activity, unless earlier deletion is requested or longer retention is reasonably needed for a current safety concern or dispute. |
| Identifiable appointment history | 24 months after the appointment, then de-identified unless longer retention is legally necessary. |
| Payment and expense records | Up to five years as a cash-management and supporting-record aid, then deleted. These records are not a substitute for formal accounting records. |
| Security, calendar-sync and audit entries | 24 months. |
We may restrict rather than delete a record where it is reasonably needed for proof, a dispute or a legal obligation. When retention is no longer authorised, records are deleted, destroyed or de-identified so they cannot reasonably be reconstructed as personal information.
Security
We use encrypted transport, passwordless short-lived sign-in codes, server-side access checks, a Jade-only administrator allowlist, private photo storage, input and file validation, collision-safe booking locks, audit records and provider-level security controls. No internet service can promise absolute security. If a qualifying compromise occurs, JC Hairdressing will investigate and notify the Information Regulator and affected people as required.
Your choices and rights
You may sign in to update preparation for an upcoming relevant appointment, leave the cancellation list, remove its current reference photo, download your account data or request full account deletion. Full deletion is blocked while a future appointment is active; cancel it first so Jade does not lose the information needed to provide the service. On deletion, preparation answers, waiting preferences, photos and messages are removed; past appointments are de-identified and visit notes are disconnected from your account, while limited non-identifying cash records may be retained for the period above.
You may also ask us to confirm whether we hold your information, request access or correction, object to processing, withdraw optional consent, request deletion or restriction, or complain to the Information Regulator. Withdrawing consent does not invalidate processing that was lawful before withdrawal.
Children
A parent or legal guardian must make and manage bookings and uploads for a child. Please do not create an account or upload a child’s image without the appropriate adult authority.
Cookies and analytics
The app uses an essential secure session cookie after sign-in and service-worker storage for installability and offline support. We do not use advertising cookies. If privacy-respecting analytics are enabled later, this policy will be updated before launch.
Contact and complaints
For privacy requests, contact JC Hairdressing’s privacy contact / Information Officer:
- Email: info@jchairdressing.com
- Phone: +27 61 520 6526
- Address: 7 Dolomiet Place, Jukskei Park, Randburg, 2188
You may also contact the South African Information Regulator at enquiries@inforegulator.org.za, call 010 023 5200, or use its official complaints and eServices channels.