Privacy Policy
Plain-language privacy choices, practical retention and control over your data.
Last updated: 15 July 2026
This policy explains how JC Hairdressing, operated by Jade in Jukskei Park, processes personal information under South Africa’s Protection of Personal Information Act, 2013 (“POPIA”). JC Hairdressing is the responsible party for the salon website, client accounts and booking records.
What we collect
- Account and contact data: name, email address and mobile number, including an optional guest email supplied to send a private booking invitation.
- Booking data: chosen service and option, appointment time, status, price and notes you provide about your hair or visit.
- Hair planning and safety data: optional Hair Compass answers, Hair Passport details, colour and chemical history, sensitivities, goals, consultation answers and patch-test status.
- Visit-care data: Jade’s private professional formula and technical notes, plus the result summary, aftercare plan and maintenance recommendation shared with you.
- Cancellation-list data: the service, date range, suitable days, time window and notice period you choose.
- Communications: questions, contact messages and replies.
- Optional photographs: reference or current-hair photos you actively upload. A photo may include your face.
- Operational records: payment method and amount, appointment-related cash records, security logs and consent timestamps.
- Technical data: limited request, security and performance data needed to operate and protect the app.
Why we use it
We use necessary account, booking and contact information to provide requested salon services, manage appointments, send and retry transactional messages, prevent duplicate requests and double-booking, prepare safe and consistent salon services, offer compatible cancelled times, provide aftercare, keep the service secure, maintain appropriate business records and respond to legal requests. Guest invitation data is used to let the invited person claim only their own service and preparation record. Optional Hair Compass information and photos are used only to prepare for your consultation or appointment. Maintenance reminders are sent only when you actively opt in through your Hair Passport and can be turned off there at any time. Other promotional email or messaging requires a separate opt-in and is not a condition of booking.
Name, contact details, service and time are required to request and manage an appointment. Hair Passport details, cancellation-list preferences, Hair Compass answers and photos are voluntary. Relevant consultation and safety-history answers may be required before Jade can provide a colour or chemical service. If required information is not provided, Jade may need to change, postpone or decline the service.
Jade’s formula and technical observations are private professional working notes. Clients receive the result summary, aftercare and recommendation, not those private notes. Neither the Hair Passport nor the consultation is a medical record or automated diagnosis.
Reference and face photos
Uploading a photo is optional and requires an explicit consent each time. Photos are stored in a private object store and are available only to Jade through the protected Salon Desk. We do not use face recognition, create biometric templates, identify people from photos, train AI systems with them, sell them or use them in marketing. A separate written permission would be required before any client image is published.
Who processes information
Jade is the only intended Salon Desk user. Carefully selected service providers process limited information on our instructions:
- Cloudflare: website delivery, security, application processing, database storage, private photo storage and inbound email routing.
- Google Calendar: appointment timing and free/busy checks. Clients receive available times only and never calendar event titles, attendee names, notes or the reason time is blocked.
- Resend: transactional booking, sign-in and enquiry email delivery.
- Gmail: Jade’s operational mailbox once domain routing is configured.
Some providers may process data outside South Africa. We limit what is shared, use provider security and contractual protections, and only use the information for the purposes described here.
How long we keep it
| Record | Normal retention |
|---|---|
| Login codes | Until expiry, then removed by automated housekeeping. |
| Signed-in sessions | Until expiry or sign-out. |
| Uploaded photos | 180 days from upload, or sooner when you delete the photo or account. |
| Guest invitations | Invitation links expire after 14 days; accepted, expired or revoked invitation records are normally removed within 12 months. |
| Transactional email delivery records | Delivered message bodies are normally removed after 90 days; exhausted failed deliveries after 180 days. |
| Questions, messages and completed cancellation-list requests | 12 months. |
| Hair Passport, readiness steps, consultations, patch-test status and aftercare | While the account is active and normally up to 24 months after the last relevant activity, unless earlier deletion is requested or longer retention is reasonably needed for a current safety concern or dispute. |
| Identifiable appointment history | 24 months after the appointment, then de-identified unless longer retention is legally necessary. |
| Payment and expense records | Up to five years as a cash-management and supporting-record aid, then deleted. These records are not a substitute for formal accounting records. |
| Security, calendar-sync and audit entries | 24 months. |
We may restrict rather than delete a record where it is reasonably needed for proof, a dispute or a legal obligation. When retention is no longer authorised, records are deleted, destroyed or de-identified so they cannot reasonably be reconstructed as personal information.
Security
We use encrypted transport, passwordless short-lived sign-in codes, server-side access checks, a Jade-only administrator allowlist, private photo storage, input and file validation, collision-safe booking locks, audit records and provider-level security controls. No internet service can promise absolute security. If a qualifying compromise occurs, JC Hairdressing will investigate and notify the Information Regulator and affected people as required.
Your choices and rights
You may sign in to correct your Hair Passport, leave the cancellation list, download your account data, delete individual photos or request full account deletion. Full deletion is blocked while a future appointment is active; cancel it first so Jade does not lose the information needed to provide the service. On deletion, Hair Passport, consultations, waiting preferences, photos and messages are removed; past appointments are de-identified and visit notes are disconnected from your account, while limited non-identifying cash records may be retained for the period above.
You may also ask us to confirm whether we hold your information, request access or correction, object to processing, withdraw optional consent, request deletion or restriction, or complain to the Information Regulator. Withdrawing consent does not invalidate processing that was lawful before withdrawal.
Children
A parent or legal guardian must make and manage bookings and uploads for a child. Please do not create an account or upload a child’s image without the appropriate adult authority.
Cookies and analytics
The app uses an essential secure session cookie after sign-in and service-worker storage for installability and offline support. We do not use advertising cookies. If privacy-respecting analytics are enabled later, this policy will be updated before launch.
Contact and complaints
For privacy requests, contact JC Hairdressing’s privacy contact / Information Officer:
- Email: info@jchairdressing.com
- Phone: +27 61 520 6526
- Address: 7 Dolomiet Place, Jukskei Park, Randburg, 2188
You may also contact the South African Information Regulator at enquiries@inforegulator.org.za, call 010 023 5200, or use its official complaints and eServices channels.