Who is responsible for your information

TEST 1 is the data controller for the information you give us when you book, visit or buy from us, and for the records we keep about our staff. We decide why that information is collected and how it is used.

REMBO Site is the platform provider and processes salon records as a data processor on our instructions: it hosts the booking page, the till, client records, loyalty balances and staff commission records. REMBO does not use your information for its own marketing and does not share it with other salons.

REMBO's own privacy notice, which covers the platform, billing and this website, is published at https://pos.rembo.site/privacy.

If you work for this salon, the salon is your employer and is responsible for your staff records. If you are a client, contact the salon first about any request concerning your records.

What we collect

• Contact details: your name, phone number and, if you give it, your email address.
• Appointment details: the service, stylist or table, date and time, notes you ask us to record, and changes or cancellations.
• Visit and service history: what was done on each visit, the products used, preferences and any notes a stylist needs next time.
• Loyalty information: points earned and redeemed, if the salon runs a loyalty programme.
• Payment information: the amount, date, method and mobile money reference for a sale, and the receipt number. We do not store your M-Pesa PIN or full card details.
• Messages: enquiries, booking requests, cancellation notices and any other message you send us, including through this website.
• Technical information: your IP address, browser and device type, pages visited and the time of the visit, which the website logs for security and to keep it working.
• Staff records, where you work for the salon: your role, contact details, bookings assigned to you, sales and commission earned, advances, leave requests and payouts.

Why we use it and our lawful basis

• To take, confirm, change and remind you about appointments. Basis: performing our service to you and your request.
• To provide the treatment and keep a service history so the next visit is safe and consistent. Basis: performing our service and our legitimate interest in good care.
• To take payment, issue a receipt and reconcile mobile money or cash. Basis: performing our service and our legal duty to keep financial records.
• To run the loyalty programme, where you join it. Basis: the terms of the programme, and consent where we send you marketing.
• To send booking confirmations and reminders. Basis: the booking itself. Marketing messages are sent only with the consent required by law and can be stopped at any time.
• To keep the website, booking page and records secure, and to investigate misuse. Basis: our legitimate interest in protecting the salon, its staff and its clients, and legal obligations where they apply.
• To compute staff commission, payouts, advances and leave. Basis: the employment or engagement relationship and our legal obligations as an employer.
• To meet tax, accounting, health and safety and other legal requirements. Basis: legal obligation.

Who receives it

• Authorised staff of TEST 1, limited by role: reception and managers see bookings and client records, while a stylist sees the appointments and commission that concern them.
• REMBO Site, as the platform processor, and the hosting, storage and backup providers it uses to run the service.
• The mobile money or payment provider used to take your payment, so the transaction can be confirmed and reconciled.
• An SMS or messaging provider, where the salon sends you a confirmation or reminder.
• Professional advisers, insurers or authorities where the law requires disclosure, or a successor business if the salon is sold or transferred.

We do not sell your information. We do not share it with other salons. A provider may only use it for the purpose it was engaged for and must protect it.

How long we keep it

• Booking and service records are kept while you remain a client and for a reasonable period afterwards, so we can handle a query about an earlier visit.
• Sales, payment and expense records are kept for the period required by Kenyan tax and accounting law.
• Loyalty balances are kept while the programme is active and your record exists. Points may expire under the programme rules.
• Staff records are kept during employment and for the period required by employment and tax law afterwards.
• Security logs are kept for a limited period and then deleted or de-identified.
• When a record is no longer needed, we delete it or remove the details that identify you. Backup copies may remain until they are overwritten in the ordinary backup cycle.

Your rights

Under the Kenya Data Protection Act, 2019 you may ask to see the personal information we hold about you, ask us to correct it, ask us to delete it where the law allows, object to or restrict certain processing, ask for a portable copy of information you gave us, and withdraw consent where we relied on consent.

To make a request, the contact page on this website. Tell us what you want and how we can verify that you are the person the record concerns. We will respond within the period required by law. Some financial records must be kept even after a deletion request, because the law requires it.

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC) in Kenya at odpc.go.ke. We ask that you contact us first so we can try to resolve it.

Cookies on this website

This website uses one session cookie to keep the booking form working and to protect it against cross-site requests. It does not track you across other websites and it is not used for advertising.

The site loads fonts and icons from third-party content networks, which receive your IP address when the page loads. The salon does not use advertising or analytics cookies on this website. You can block or delete cookies in your browser, but blocking the session cookie may stop the booking form from submitting.

How we protect it

• Access to salon records is limited by staff role, and each salon's records are isolated from every other salon on the platform.
• Passwords are stored as one-way hashes. Payment and messaging credentials are encrypted at rest.
• The production website uses HTTPS, and staff actions in the system are recorded in an audit log.
• Staff are expected to keep their logins private and to report a suspected compromise immediately.

No system is completely secure. If you believe your information has been exposed, the contact page on this website so we can investigate and protect your record.

Processing outside Kenya

The platform and its hosting or messaging providers may process information on servers outside Kenya. Where that happens, the salon and REMBO rely on the safeguards required by the Data Protection Act, 2019 and its regulations for international transfers.

Contact and changes

Questions about this notice or your information: the contact page on this website.

We may update this notice when our records or the law change. The current version is always on this page with its update date.

This salon uses REMBO Site. The platform's own privacy notice is at https://pos.rembo.site/privacy and its terms are at https://pos.rembo.site/terms.