Snygg Privacy Policy

3.1.1. Create an Account:

• Full name
• Email address
• Phone number
• Password (encrypted)
• Country code and location information

3.1.2. For Salon Owners:

• Salon business name
• Salon physical address and location
• Business registration details
• Owner/manager name and contact information
• Banking and payment information (for receiving payments)
• Tax identification numbers (where applicable)
• Number of staff members
• Operating hours
• Services offered and pricing
• Business category and specializations

3.1.3. For Staff Members:

• Professional profile information
• Bio and description
• Qualifications and certifications
• Specializations and expertise
• Profile photographs
• Work schedule and availability
• Services offered and pricing (if applicable)
• Employment status and relationship with Salon

3.1.4. For Customers:

• Contact preferences
• Booking history
• Service preferences
• Favorite salons and staff members
• Payment methods

3.1.5. When Making or Managing Bookings:

• Booking details (date, time, service, staff member)
• Special requests or notes
• Cancellation or modification information
• Payment and transaction details

3.1.6. When Communicating with Us:

• Messages, inquiries, and support requests
• Feedback and survey responses
• Pilot Program applications
• Complaints or dispute information

3.2.1. Device Information:

• Device type, model, and manufacturer
• Operating system and version
• Browser type and version
• Screen resolution
• Device identifiers (e.g., IDFA, advertising ID)

3.2.2. Usage Information:

• Pages or screens viewed
• Features accessed and used
• Actions taken within the Service
• Time, frequency, and duration of activities
• Search queries and filters used
• Booking flow and conversion information

3.2.3. Technical Information:

• IP address
• Browser type and settings
• Time zone and locale settings
• Referring website or application
• Click-stream data

3.2.4. Location Information:

• General location based on IP address
• Precise location (if you grant permission)
• Location used for searching salons and services

3.2.5. Communication and Notification Data:

• Push notification tokens
• SMS delivery status
• Email open and click rates
• Communication preferences

3.3.1. Payment Processors (Paystack, Stitch):

• Payment confirmation details
• Transaction status
• Payment method information (tokenized)
• Billing address
• Transaction history

3.3.2. Authentication Services:

• Email verification status
• Phone number verification status
• Two-factor authentication (2FA) codes and verification status
• Passkey authentication data

3.3.3. Communication Services (Twilio):

• SMS delivery status
• Phone number validation
• Message delivery receipts

3.3.4. Infrastructure Providers (Supabase):

• Database hosting and management
• Authentication services
• File storage
• Real-time synchronization data

3.4.1.

We use cookies, web beacons, and similar tracking technologies to collect information about your browsing activities.

3.4.2. Types of Cookies We Use:

• Essential Cookies: Required for the Service to function (e.g., session management, authentication)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how users interact with the Service
• Performance Cookies: Monitor and improve Service performance

3.4.3. Cookie Information Collected:

• Session identifiers
• User preferences
• Authentication status
• Language and locale preferences
• Analytics and usage patterns

3.4.4.

You can control cookie settings through your browser, but disabling essential cookies may affect Service functionality.

3.5.1.

We do not intentionally collect sensitive Personal Information such as:

• Health information or medical records
• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic or biometric data for identification purposes
• Sexual orientation or sexual life information

3.5.2.

If Customers voluntarily share health-related information (e.g., allergies) with Salons during service provision, such information is shared directly with the Salon and is subject to the Salon's privacy practices.

3.5.3.

We strongly advise Salons to handle any sensitive information in compliance with applicable laws and professional standards.

4.1.1. To Provide and Operate the Service:

• Create and manage user Accounts
• Facilitate booking creation, management, and modifications
• Process payments and transactions
• Display salon, staff, and service information
• Enable search and discovery features
• Synchronize data across devices
• Provide real-time updates and notifications

4.1.2. To Communicate with You:

• Send booking confirmations and receipts
• Deliver appointment reminders
• Notify you of booking changes or cancellations
• Send service updates and announcements
• Respond to inquiries and support requests
• Send administrative messages and notices
• Deliver push notifications (with your consent)
• Send SMS notifications for 2FA and booking updates

4.1.3. To Process Transactions:

• Facilitate payment processing
• Issue invoices and receipts
• Process refunds and chargebacks
• Calculate and collect platform fees
• Track transaction history
• Prevent fraud and unauthorized transactions

4.1.4. To Personalize Your Experience:

• Remember your preferences and settings
• Display relevant salons and services
• Suggest favorite salons and staff members
• Customize content and recommendations
• Pre-fill forms with saved information

4.1.5. For Authentication and Security:

• Verify your identity
• Process two-factor authentication (2FA)
• Manage passkey authentication
• Prevent unauthorized access
• Detect and prevent fraud, abuse, and security incidents
• Monitor for suspicious activity

4.2.1. To Improve the Service:

• Analyze usage patterns and trends
• Monitor Service performance and reliability
• Identify and fix bugs and technical issues
• Conduct research and development
• Test new features and functionality
• Optimize user experience and interface design

4.2.2. For Analytics and Reporting:

• Generate business analytics and insights
• Track booking conversion rates
• Measure user engagement and retention
• Create aggregated and anonymized reports
• Evaluate marketing effectiveness

4.2.3. For Customer Support:

• Respond to support requests
• Investigate and resolve complaints
• Troubleshoot technical issues
• Provide guidance and assistance
• Document support interactions

4.2.4. For Marketing and Promotional Purposes (with consent):

• Send promotional offers and updates
• Inform you about new features
• Conduct surveys and request feedback
• Market pilot program opportunities
• Send newsletters and updates

5.1.1. Between Customers and Salons/Staff Members:

When a Customer makes a Booking, relevant information (name, contact details, booking details) is shared with the Salon and assigned Staff Member to facilitate service delivery. Salons and Staff Members can view Customer booking history with their establishment.

5.1.2. Between Salons and Staff Members:

Salon Owners can view Staff Member profiles, schedules, bookings, and performance data. Staff Members can view salon information, policies, and relevant business details.

5.1.3.

Such sharing is essential to the functioning of the Service and is limited to information necessary for service delivery.

5.2.1. Payment Processing:

Paystack: For processing card payments, managing payment methods, and handling transactions. Stitch: For processing instant bank transfers and EFT payments. We share transaction details, payment amounts, and necessary billing information. Payment processors operate under their own privacy policies and security standards.

5.2.2. Communication Services:

Twilio: For sending SMS notifications, 2FA codes, and appointment reminders. We share phone numbers and message content necessary for delivery.

5.2.3. Infrastructure and Hosting:

Supabase: For database hosting, authentication, real-time data synchronization, and file storage. We share all data necessary to operate the Service.

5.2.4. Analytics and Performance Monitoring:

Analytics providers to understand usage patterns and improve the Service. We share anonymized or aggregated data where possible.

5.2.5. Customer Support Tools:

Support platforms to manage and respond to customer inquiries.

5.2.6. Email Services:

Email delivery providers for sending transactional and marketing emails.

5.2.7.

Third-party service providers are contractually obligated to protect your Personal Information and use it only for the purposes for which it was disclosed.

6.1.1.

We retain Personal Information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

6.1.2. Retention periods are based on:

• The nature and sensitivity of the information
• Legal and regulatory requirements
• Business and operational needs
• Potential risks from unauthorized use or disclosure
• The purposes for which we collected the information

6.2.1. While Your Account is Active:

We retain your Account information, profile data, booking history, and transaction records. This allows us to provide ongoing Service and maintain accurate records.

6.2.2. Account Activity:

Accounts that remain inactive for extended periods may be flagged for review or deletion.

6.3.1. Upon Account Deletion:

Most Personal Information is deleted or anonymized within thirty (30) days of account deletion. Some information may be retained in backup systems for up to ninety (90) days.

6.3.2. Exceptions to Deletion:

• Financial records and transaction data may be retained for up to seven (7) years to comply with tax, accounting, and regulatory requirements.
• Information necessary for legal, audit, or compliance purposes may be retained as required by law.
• Anonymized or aggregated data may be retained indefinitely.
• Information subject to legal holds, ongoing disputes, or investigations will be retained until resolution.

6.4.1. Booking history and transaction records are retained for:

• Customers: Up to seven (7) years for tax and accounting purposes.
• Salons: Up to seven (7) years for business, tax, and regulatory compliance.

6.4.2.

Payment information is tokenized and stored by payment processors according to their retention policies.

7.2.1. Encryption:

• All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS/SSL) protocols.
• Passwords are hashed and encrypted using industry-standard cryptographic algorithms.
• Sensitive data at rest is encrypted using AES-256 encryption.

7.2.2. Authentication and Access Control:

• Multi-factor authentication (2FA) required for all user accounts.
• Passkey authentication support for enhanced security.
• Role-based access controls limit access to Personal Information.
• Session management and automatic logout features.

7.2.3. Secure Infrastructure:

• Data hosted on secure, SOC 2 compliant infrastructure (Supabase).
• Regular security updates and patch management.
• Firewall and intrusion detection systems.
• DDoS protection and rate limiting.

7.2.4. Payment Security:

• PCI-DSS compliant payment processing.
• Tokenization of payment information.
• We do not store full credit card or banking details on our servers.
• Payment data handled exclusively by certified payment processors (Paystack, Stitch).

7.3.1. Access Controls:

• Limited access to Personal Information on a need-to-know basis.
• Background checks for employees with access to sensitive data.
• Confidentiality agreements for all employees and contractors.
• Regular access reviews and revocation of unnecessary permissions.

7.3.2. Security Training:

• Regular security awareness training for employees.
• Policies and procedures for data handling and protection.
• Incident response training and protocols.

7.3.3. Third-Party Vendor Management:

• Due diligence and security assessments of third-party service providers.
• Contractual requirements for data protection and security.
• Regular audits of vendor security practices.

7.5.1. Security Monitoring:

• Continuous monitoring for suspicious activity and security threats.
• Automated alerts for unusual access patterns.
• Regular security audits and vulnerability assessments.
• Penetration testing (periodic).

7.5.2. Incident Response:

• Documented incident response procedures.
• Rapid response to security incidents and data breaches.
• Notification to affected users as required by law.
• Post-incident analysis and remediation.

7.7.1. You are responsible for:

• Maintaining the confidentiality of your Account credentials.
• Using strong, unique passwords.
• Enabling two-factor authentication (2FA).
• Not sharing your Account with others.
• Logging out of shared or public devices.
• Reporting suspected security incidents to support@snyggbooking.com.

7.7.2.

We are not responsible for unauthorized access resulting from your failure to protect your Account credentials.

8.4.1. You have the right to request deletion of your Personal Information in certain circumstances:

• The information is no longer necessary for the purposes for which it was collected.
• You withdraw consent on which processing was based.
• You object to processing and there are no overriding legitimate grounds.
• The information was unlawfully processed.
• Deletion is required to comply with a legal obligation.

8.4.2. How to Request Deletion:

• You can delete your Account through Account settings.
• Alternatively, contact privacy@snyggbooking.com to request deletion.

8.4.3. Exceptions to Deletion:

• We may retain information where required by law (e.g., tax records, transaction history).
• Information necessary for legal claims, compliance, or ongoing disputes.
• Anonymized data that no longer identifies you personally.

8.4.4.

Upon deletion, your Account and associated data will be permanently removed within thirty (30) days, subject to backup retention periods.

8.5.1. You have the right to request restriction of processing of your Personal Information in certain circumstances:

• You contest the accuracy of the information.
• Processing is unlawful, but you prefer restriction over deletion.
• We no longer need the information, but you need it for legal claims.
• You have objected to processing pending verification of legitimate grounds.

8.5.2.

To request restriction, contact privacy@snyggbooking.com with details of your request.

8.7.1.

You have the right to object to processing of your Personal Information based on legitimate interests or for direct marketing purposes.

8.7.2. Objection to Direct Marketing:

You can opt-out of marketing communications at any time by:

• Clicking "unsubscribe" in marketing emails.
• Adjusting notification preferences in Account settings.
• Contacting support@snyggbooking.com.

8.7.3. Objection to Other Processing:

You may object to processing for other purposes by contacting privacy@snyggbooking.com. We will cease processing unless we have compelling legitimate grounds that override your interests.

8.9.1. If you believe we have processed your Personal Information unlawfully or violated your privacy rights, you have the right to lodge a complaint with:

• Snygg: privacy@snyggbooking.com
• Information Regulator (South Africa): The supervisory authority for data protection in South Africa.

8.9.2. Information Regulator Contact Details:

• Website: www.justice.gov.za/inforeg/
• Email: inforeg@justice.gov.za
• Phone: +27 (0)10 023 5200

8.9.3.

We encourage you to contact us first so we can address your concerns directly.

8.10.1. How to Submit Requests:

• Email: privacy@snyggbooking.com
• Subject line: "Privacy Rights Request – [Type of Request]"
• Include: Your full name, email address, Account details, and description of your request.

8.10.2. Identity Verification:

We may request additional information to verify your identity before processing requests. This protects your Personal Information from unauthorized access.

8.10.3. Response Timeline:

We will respond to verified requests within thirty (30) days. If we need more time, we will inform you of the extension and the reasons.

8.10.4. No Fee:

We do not charge a fee for processing rights requests unless the request is manifestly unfounded, excessive, or repetitive.

11.1.1. Our Service integrates with third-party service providers, each with their own privacy practices:

11.1.2.

We encourage you to review the privacy policies of these third-party services.

11.1.3.

We are not responsible for the privacy practices of third-party service providers.

12.1.1. Transactional Communications (cannot opt-out):

• Booking confirmations and receipts
• Appointment reminders
• Cancellation and modification notices
• Payment confirmations
• Two-factor authentication (2FA) codes
• Security alerts
• Account-related notices
• Service updates affecting your bookings
• Responses to your inquiries

12.1.2. Marketing Communications (can opt-out):

• Promotional offers and discounts
• New feature announcements
• Newsletters and updates
• Pilot Program invitations
• Surveys and feedback requests
• Tips and best practices

12.3.1. Email Marketing:

• Click the "unsubscribe" link in any marketing email.
• Adjust email preferences in your Account settings.
• Contact support@snyggbooking.com to opt-out.

12.3.2. Push Notifications:

• Disable push notifications in your Account settings.
• Disable notifications in your device settings.

12.3.3. SMS Marketing (if applicable):

• Reply "STOP" to any marketing SMS.
• Contact support@snyggbooking.com to opt-out.

12.3.4.

Opting out of marketing communications does not affect transactional communications necessary for Service operation.

13.1.1. Consent:

You have provided explicit consent for processing (e.g., marketing communications, push notifications). You may withdraw consent at any time.

13.1.2. Contract Performance:

Processing is necessary to perform our contract with you (Terms of Use). This includes creating Accounts, processing bookings, facilitating payments, and providing customer support.

13.1.3. Legal Obligation:

Processing is necessary to comply with legal obligations (e.g., tax laws, financial regulations, court orders).

13.1.4. Legitimate Interests:

Processing is necessary for our legitimate business interests, such as:

• Improving the Service
• Fraud prevention and security
• Analytics and research
• Customer support
• Marketing (where not requiring consent)

We balance our legitimate interests against your rights and freedoms.

13.1.5. Vital Interests:

Processing is necessary to protect vital interests (e.g., safety and security).

13.1.6. Public Interest:

Processing is necessary for tasks carried out in the public interest (rarely applicable).

Information Collected:

Business information, owner details, banking information, salon services and pricing, staff management data, booking and customer data, financial and transaction records.

Purposes of Processing:

• Provide salon management tools
• Process customer bookings and payments
• Calculate and collect platform fees
• Provide analytics and reporting
• Facilitate communication with customers
• Support pilot program participation

Lawful Basis:

Contract performance, consent, legitimate interests, legal obligation.

Sharing:

With Customers (for bookings), Staff Members (for management), payment processors, infrastructure providers.

Information Collected:

Profile information, qualifications, schedule and availability, booking data, earnings information, communication records.

Purposes of Processing:

• Manage staff profiles and schedules
• Facilitate customer bookings
• Track earnings and performance
• Enable communication with customers and salons
• Provide analytics and insights

Lawful Basis:

Contract performance, consent, legitimate interests.

Sharing:

With Customers (for bookings), Salon Owners (for management), payment processors (for earnings), infrastructure providers.

Information Collected:

Contact information, booking history, payment information, preferences, communication records.

Purposes of Processing:

• Facilitate service bookings
• Process payments
• Send confirmations and reminders
• Provide customer support
• Personalize recommendations
• Deliver marketing communications (with consent)

Lawful Basis:

Contract performance, consent, legitimate interests.

Sharing:

With Salons and Staff Members (for service delivery), payment processors, communication services, infrastructure providers.