1. Introduction & Scope
Liya's Beauty Boutique ("we", "us", "our") is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) — POPIA — and all applicable South African data protection laws.
This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, book appointments, create an account, or interact with our services.
2. Information We Collect
2.1 Information You Provide Directly
- Account Registration: First name, last name, phone number, email address, password (hashed)
- Appointment Booking: Name, phone, email, service preferences, special requests, preferred staff member
- Reviews & Feedback: Name, rating, comment, service details
- Contact Forms: Name, email, phone, message content
- Loyalty Program: Purchase history, visit frequency, points balance, tier status
2.2 Information Collected Automatically
- Technical Data: IP address, browser type, operating system, device information, referring URLs, pages visited, time spent
- Cookies & Similar Technologies: Essential, analytics, and marketing cookies (see Cookie Policy below)
- Usage Data: Interaction with chatbot, booking flow, service selections
3. Lawful Basis for Processing (POPIA)
We process your personal information only where we have a lawful basis under POPIA:
- Consent: Where you have given explicit consent (e.g., marketing communications, cookie preferences, booking chatbot)
- Contract Performance: To fulfil our contract with you (appointment booking, service delivery, loyalty rewards)
- Legitimate Interest: Improving our services, fraud prevention, security, analytics (where not overridden by your rights)
- Legal Obligation: Compliance with tax, health & safety, and consumer protection laws
4. Purposes of Processing
- Creating and managing your client account
- Processing and confirming appointment bookings
- Sending appointment reminders and confirmations (SMS, email, WhatsApp)
- Delivering beauty services and personalised recommendations
- Managing loyalty programme points, tiers, and rewards
- Responding to enquiries and customer support requests
- Processing payments (via PayFast, SnapScan, Yoco — we do not store full card details)
- Sending promotional offers and newsletters (only with your consent)
- Improving our website, services, and customer experience
- Compliance with legal and regulatory obligations
5. Sharing Your Information
We do not sell your personal information. We may share data only in the following circumstances:
- Service Providers: Payment processors (PayFast, Yoco, SnapScan), SMS/email gateways, hosting providers — all bound by data processing agreements
- Staff Members: Your assigned therapist/technician receives only the information necessary to provide your service
- Legal Requirements: When required by law, court order, or regulatory authority
- Business Transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the business (with notice)
6. Data Retention
We retain personal information only as long as necessary for the purposes outlined above, or as required by law:
- Client Account & Booking History: 7 years from last interaction (tax & consumer law)
- Marketing Consent Records: 3 years after last consent or until withdrawn
- Cookie & Analytics Data: 26 months (Google Analytics default)
- Payment Data: Not stored by us; processed by certified payment providers per PCI DSS
- Consent Logs: 5 years for POPIA compliance evidence
7. Your Rights Under POPIA
You have the following rights regarding your personal information:
- Right of Access: Request a copy of all personal data we hold about you
- Right to Rectification: Request correction of inaccurate or incomplete data
- Right to Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal retention requirements)
- Right to Restrict Processing: Limit how we use your data
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Object: Object to processing based on legitimate interests or direct marketing
- Right to Withdraw Consent: Withdraw consent at any time (does not affect lawfulness of prior processing)
- Right to Complain: Lodge a complaint with the Information Regulator (South Africa)
To exercise any right: Use the "Data Privacy" section in your Client Dashboard, email privacy@liyasbeauty.co.za, or call +27 12 345 6789. We respond within 30 days as required by POPIA.
8. Cookie Policy
8.1 What Are Cookies?
Cookies are small text files stored on your device when you visit our website. They help us remember your preferences, understand how you use our site, and improve your experience.
8.2 Types of Cookies We Use
- Essential (Strictly Necessary): Enable core functionality — security, session management, booking flow, cart. Cannot be disabled.
- Analytics: Help us understand visitor behaviour (Google Analytics, anonymised IP). Require your consent.
- Marketing/Preference: Personalise content, remember preferences, show relevant offers. Require your consent.
8.3 Managing Cookies
You can change your cookie preferences at any time via the Cookie Settings link in the footer, or by clearing browser cookies. Disabling essential cookies will break core functionality (booking, login).
9. Data Security
- All data transmitted over HTTPS (TLS 1.2+)
- Passwords hashed with bcrypt (cost factor 10+)
- Database access restricted to authenticated application servers
- Regular security updates and vulnerability scanning
- Staff trained on POPIA compliance and data handling procedures
- Payment data handled exclusively by PCI DSS Level 1 certified providers
10. International Transfers
Your personal information is processed and stored within South Africa. If we use cloud services with servers outside SA (e.g., Google Analytics), we ensure adequate protection through standard contractual clauses or adequacy decisions as required by POPIA Section 72.
11. Children's Privacy
Our services are not directed at children under 18. We do not knowingly collect personal information from minors without verifiable parental consent. If you believe we have collected data from a child, please contact us immediately.
12. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email and a prominent notice on our website. The Effective Date at the top of this page indicates the latest revision.
13. Contact Us
For any questions, concerns, or to exercise your rights under POPIA:
- Data Protection Officer: Liya Beauty
- Email: privacy@liyasbeauty.co.za
- Phone: +27 12 345 6789
- Address: Daan De Wet Nel Drive, Pretoria North, 0182, South Africa
- Information Regulator (SA): inforegulator.org.za
14. Consent Declaration
By using our website, creating an account, or booking an appointment, you acknowledge that you have read and understood this Privacy Policy. You consent to the processing of your personal information as described herein.
You may withdraw consent for non-essential processing at any time via your Client Dashboard or by contacting us.