Skip to content
العربية
All versions

TILZA agreement with salons

Version of 21 October 2026 (fifth that day)Earlier: until 21 October 2026Draft

A draft awaiting a lawyer’s review before TILZA launches. TILZA hasn’t started yet: it takes no real salons and no money.

This is not the current version.Read the current version

What changed in this version

Compared with the version of 21 October 2026 (fourth that day).

In the data processing annex, «The data and whose it is»: each team member’s hepatitis B vaccination is now the dates of its doses, whether the course is complete and the next dose’s date, instead of a date it runs out, with the emirate that issued their health card (q29), all with their agreement. It now also lists when the residence, work permit and health insurance the salon keeps for its team run out. In «The salon’s legal duties»: a valid health card for everyone working at the salon, issued by the body the municipality of the branch’s emirate asks for, and a complete vaccination.

Colours:AddedRemoved

This agreement is between TILZA and the salon that uses it, and sets out what each side provides and commits to. The salon’s owner accepts it in the salon dashboard, and it applies from the day they accept. Its two annexes are part of it: the «Data processing annex» and «The salon’s legal duties».

1. The parties

The company that runs TILZA: its legal name, licence number, issuing authority and address will appear here once its licence is issued.

And the salon: the licensed business whose owner accepts this agreement, under its legal name and licence number as entered in the salon dashboard.

How to contact TILZA, including a number answered by a person on its team, will appear here before launch.

2. What TILZA provides

  • A booking and management system: the calendar, clients, services, team, sales and invoices, reports and change history, a booking page for the salon, and its listing in TILZA’s search.
  • Every feature is optional: the salon turns it on or off in «Settings», except what the law requires, such as the privacy notice and invoices.
  • Messages to clients by WhatsApp, text message or email, once these work in TILZA.
  • Help using TILZA and solving its problems, from «Support» in the salon’s dashboard.

3. Fees and subscription

  • The salon pays TILZA no fee except under a written offer that lists every fee and says whether it includes VAT, and that the owner accepts before paying anything. No hidden fees.
  • The subscription is monthly, with no yearly contract and no hidden renewal. It renews each month on the day it started, the day the owner accepted this agreement. The owner can cancel it whenever they want, with one month’s notice, as in «Term and ending».
  • If TILZA gives the salon free use, it shows in «Your salon’s subscription» with its end: a set date, or «until we agree with you». TILZA never moves the end of free use with a set date earlier than it gave, and ends free use with no date only with at least 30 days’ notice. After it ends, the salon pays nothing unless it accepts a written offer as in the first point, which reaches it at least 30 days before any fee, and it may leave TILZA with no fees.
  • The salon can download its data whenever it wants, free of charge.
  • TILZA takes no money from the salon’s clients and holds none of their money. If the salon later offers paying online, it will be through a licensed payment company that pays the salon directly, under a separate agreement.

4. What the salon commits to

  • To be licensed and keep its licence valid, enter its legal name, licence number and issuing authority as TILZA asks, and tell TILZA straight away if its licence expires or is suspended.
  • To keep its details in TILZA true and up to date: service names in Arabic, prices including VAT if it is registered, durations, hours, branches and team.
  • To show in TILZA its real prices, the ones it charges at the salon, with no hidden fees: each of a service’s options has its exact price and time; a service it can price only once it sees the client is priced “after a consultation”, at the consultation’s own price or free; and a service still priced “from” is priced at its lowest real option.
  • To charge the client no more than the price booked, unless the client accepts a «price change request» on the client’s own phone before that service starts, and never to ask for that answer on the salon’s device. To check, when the client arrives, or before from the photo of the client’s hair if the client sent one, the option of each service booked with one: if it is shorter or finer, its price comes down to the right option’s at once; if it is longer or thicker, the salon sends the client the right option’s price before starting it, and starts it at the new price only once the client accepts. If the client doesn’t accept, the salon either does the service at the price booked, or doesn’t do it and takes nothing for it except a consultation price shown before booking, and never records it against the client as a late cancellation or a no-show. If nothing is left in the booking to be done, the booking is cancelled as the salon’s, and the client is told.
  • If it is registered for VAT, to enter its TRN, legal name and address as on its registration certificate, and update them if they change. TILZA’s team checks the TRN on the Federal Tax Authority’s website; if the team can’t confirm it, tax invoices and the words “prices include VAT” stop until the salon corrects it. The salon stays responsible for its tax details being correct and for its VAT.
  • If it issues invoices to companies or government bodies, to appoint an e-invoicing service provider accredited by the Ministry of Finance, and send those invoices and their credit notes as e-invoices through it, by the days the Ministry sets. The owner records the provider in «E-invoicing» in Settings, or records that the salon needs none and writes how they checked. TILZA sends no e-invoices for the salon and appoints no provider for it: it reminds the salon before the day, and puts each tax invoice made out to a company, with its details, in the sheet «Invoices to companies» in the Excel file for the salon to give its provider.
  • To show in TILZA only the services each branch’s licensed activity covers, at the prices of its approved list of services and prices where it has one, and to offer massage or spa only at a branch whose licence covers them.
  • To deliver booked services as shown, warrant them as the Consumer Protection Law requires, and answer and deal with its clients’ complaints seriously.
  • For the owner or a manager to answer, in «Complaints» in the salon’s dashboard, every complaint its clients send through TILZA within 3 days of it coming, saying what it will do and when. If it doesn’t answer in time, or the salon is paused, the complaint goes to TILZA’s team. TILZA’s team sees every complaint, and may take one up at any step and answer the client. The salon doesn’t delete a complaint, its answer doesn’t change once sent, and it doesn’t treat a client badly or refuse their booking because they complained. It uses what it reads in a complaint only to answer and solve it.
  • To write its services’ guarantee in TILZA: within how many days of the appointment it accepts a client’s word, and what it does when a service isn’t right (redoes it free, or redoes it or refunds, as the client chooses). It keeps to the guarantee the client saw before booking and on the bill. Until it writes one, TILZA shows the law’s words: if a service has a fault, the salon redoes it or refunds, and the salon keeps to them. It writes nothing in a guarantee that takes it back, such as “no guarantee” or “non-refundable”.
  • To honour confirmed appointments. If it has to cancel or move one, to tell the client as soon as possible and refund in full anything they paid in advance.
  • If the salon turns on «Off-peak offers», to hold for each offer a valid permit from the competent authority in its emirate covering the discount, its days and its times, enter its number, issuer and dates as they are on it, and stop the offer if the permit is cancelled. To charge a client the discounted price they booked at, even if it stops the offer later. TILZA shows the offer as the salon entered it; the salon is responsible for its permit and for the offer being right.
  • If the salon turns on «Loyalty card», to hold in each emirate it has a branch in a valid permit from that emirate’s economic department covering the card and its rewards, and enter its number, issuer and dates as they are on it. Outside Dubai, if the department tells it the card needs no permit, it confirms so and writes how it checked; its confirmation is accepted for a year, then it checks again. On a day none of this covers, the card is on hold: no stamps or points are added, and a client uses a reward ready as usual. For each offer it writes in «Offers», to choose whether it has a discount, a gift or a prize draw; if it has, to enter its permit from the economic department as it is on it, and the offer goes only on the permit’s days. It holds a prize draw only outside TILZA, under the supervision and conditions of the body that issued its permit, sells no tickets for it and gives no cash prizes in it. TILZA shows the permit as the salon entered it; the salon is responsible for its permit and for what it confirmed being true.
  • If the salon turns on «Home visits», to send no one from its team to a client’s home except in an emirate that allows it, with the permit it asks for; to hold for each branch a valid permit from the competent authority, enter its number, issuer and dates as they are on it, and delete it if it is cancelled; to send only those the permit covers and the law allows; and to use a client’s address for that visit only. If it sets a travel fee or a minimum amount to book for an area, it is in dirhams with VAT included like its other prices, TILZA shows it to the client before they book, and the salon never charges more on the bill than the visit was booked with. If its team hasn’t reached a client’s home 15 minutes after the time, the client may say so on their booking link, and the salon may record it: the appointment is cancelled as the salon’s miss, the salon takes nothing from the client for it and never records that they didn’t come, and it refunds in full anything they paid for it in advance. TILZA shows home visits only at the branches whose emirate allows them, as the salon entered them; the salon is responsible for its permit and for its team in clients’ homes.
  • If the salon turns on «Hair photo before the visit», to use the photo only to check the service’s option; to have it opened only by the owner, the managers and whoever serves the client on the day of the appointment; never to copy it, photograph it, keep it outside TILZA or send it to anyone; and to delete it if it shows the client’s face or anything not needed to check the option. If the option is longer, to raise the price only through a «price change request» the client accepts. Never to make sending one a condition of a booking, nor to ask for one from anyone under 18.
  • To send offers only to clients who agreed to them, from a number registered to the salon and its trade licence and never a personal one, publish a photo or video of a client or of anyone on its team only with their agreement, and keep health details only with the person’s agreement.
  • To protect its team’s accounts: no shared passwords, each person given only the role they need, and the account of anyone who leaves turned off. Its team uses two-step verification in the roles TILZA requires it of, and we recommend it for the rest of the team.
  • Not to use TILZA for anything unlawful, and not to show in it any medical treatment, such as laser, Botox, fillers, injections, thread lifts, permanent make-up, chemical peels or cupping, even if it is licensed for one: only a licensed health facility may give them, and advertising them needs the health authority’s permit, so TILZA doesn’t show them, book them or send offers for them.
  • To meet its duties in «The salon’s legal duties».

5. What TILZA commits to

  • To run the platform with care, protect it with suitable security measures, and keep an encrypted daily backup.
  • To process the data of the salon’s clients and team only as the «Data processing annex» says.
  • To tell the salon in advance of any important change that affects its work, and of any planned downtime.
  • Never to contact the salon’s clients to market anything, or to show them other salons using its data.
  • To give the salon’s clients a place for complaints that can be followed, as the law on trading by modern technological means asks, keeping every step in it, with its team following up and answering the complaints that come to it.
  • Never to make a page for a salon that didn’t ask to join itself, show it in search, or take its name, photos or prices from Google, Instagram or anywhere else without its permission. A salon’s page shows to clients only once its owner accepts this agreement.

6. Data

  • The data of the salon, its clients and its team belongs to the salon, which is responsible for it under the Personal Data Protection Law; TILZA processes it for the salon.
  • If the salon turns on «Compare your salon with your city», its numbers go into its city’s averages without its name or its clients’ details, and with no prices or average bill in them. The comparison is of the whole of last month only, a city average shows only once at least 10 other salons take part, and each month’s average is worked out once and never changes after, so no salon’s numbers can be told. If the salon turns comparing off, its numbers go into no average worked out after that, and the average of a month worked out before stays as it was.
  • If the salon turns on «Beauty cards», it sees a client’s card, which TILZA keeps for her in «My bookings», only while she shares it with the salon, and only the owner, the managers and whoever serves her on the day of her booking open it, not reception. The card is the client’s and TILZA is responsible for it, so the salon keeps no copy of it. Anything the salon writes from it into her file there, such as her allergies or her colour formula, becomes the salon’s data and responsibility, and what concerns her health needs her agreement to the salon, as for allergies and health.
  • TILZA also keeps its own record of the salon, which it is responsible for, with nothing of its clients’ data in it: the salon’s name and licence, the versions of this agreement and who accepted them and when, its subscription, when it started and ended and why, the owner’s answer about being contacted after the last day and every contact after it, and any invoice TILZA issues to it. TILZA keeps it for its relationship with the salon and for its records, and it stays after the agreement ends, as in «Term and ending».

7. Names and content

  • The salon’s name, logo, photos and content stay its own, and it allows TILZA to use them only to show the salon and its booking page in TILZA, for as long as this agreement lasts.
  • TILZA shows only what the salon entered itself or allowed. When the agreement ends, its page and its place in search stop.
  • The salon confirms it has the right to use every photo or content it uploads, and that the people in its photos agreed to them being published.
  • This agreement gives the salon no right in TILZA’s system or design other than using them while the agreement lasts, and the salon may not copy, sell or take them apart.

8. Reviews

  • The «Reviews policy» applies to the salon’s reviews on TILZA. TILZA is responsible for reviews: it checks and publishes them, and removes what breaks the policy.
  • TILZA’s reviews of the salon always show, because the law requires them, and the salon can’t turn them off or hide them, or remove or edit a review.
  • The salon can reply to a review publicly and politely, and its reply is checked before it is published. It can also object to a review, saying why.
  • The salon gives no discount, gift or anything else for a review, pressures nobody to review or to change or delete a review, doesn’t ask only for positive reviews, and doesn’t write a review, or ask anyone to write one, about a visit that didn’t happen.
  • The salon sees the name and booking number of whoever reviewed it only to understand what happened and reply, and doesn’t punish them for their review, for example by refusing their booking, treating them worse or pressuring them.
  • If the owner shows a branch’s rating on Google Maps, they pick only that same branch’s page on Google, and TILZA checks it is at the branch’s location. The rating shows as Google gives it, with Google’s name and link; TILZA doesn’t keep it, and asks Google for it with the branch’s page number only, without any client’s data. It may stop showing if Google’s service doesn’t work or TILZA reaches its monthly limit.

9. Confidentiality

Each side keeps confidential what it learns about the other that isn’t public, and uses it only to carry out this agreement, except where the law requires otherwise.

10. Responsibility

  • Each side is responsible for its own breaches of this agreement, as UAE law provides.
  • The salon is responsible for its services, its details and how it deals with its clients, and compensates TILZA for what TILZA bears because the salon broke the law or this agreement.
  • Reports, the monthly sales report among them with any share of sales it works out, are calculated only from what was recorded in TILZA. The salon checks them before relying on them or sending them to anyone, such as a mall, a bank or a partner, and is responsible for what it sends and for keeping its contracts with them. TILZA does not send reports for the salon, does not pay or collect anything between the salon and them, and is not a party to the salon’s contracts with them.
  • The VAT return summary and the tax registration alerts are there to help and are not tax advice: the summary is worked out only from the tax invoices TILZA issued, and TILZA does not know the salon’s sales outside it or its purchases. The salon files its returns, pays its tax and decides on its registrations itself or through its accountant and tax adviser, and TILZA files no return for it. The e-invoicing reminders and the sheet «Invoices to companies» are there to help too: they are not e-invoices and don’t replace the salon’s provider, and the salon stays responsible for its e-invoices and any fine on them.
  • Neither side is responsible for a delay caused by events beyond its control, as long as it tells the other side and works to limit the effect.

11. Pausing a salon

  • TILZA pauses the salon’s booking page and its listing in search at once only for a legal reason or at its request: if its licence expires or is suspended, the law or an authority requires it, it misuses TILZA in a way that harms its clients or others, or the salon itself asks. TILZA tells the salon why in the salon dashboard, and opens the page again once the reason is gone.
  • TILZA pauses it for no other reason; instead, it ends the agreement with 30 days’ notice, as in «Term and ending».
  • While it is paused, the salon dashboard keeps working, bookings made before stay, and the salon can download its data.

12. Stopping a feature

  • TILZA may stop an optional feature for all salons or for one salon, such as offers or showing in search, if it is misused, draws complaints, or needs fixing. The salon sees why under the feature in Settings.
  • The salon’s own choice is kept, and the feature comes back as the salon chose it when the stop ends. The stop and its end are recorded in the change history.
  • TILZA never turns a feature on for the salon without its choice, and never stops what the law requires or what protects the salon and its clients, such as the change history.

13. Term and ending

  • The agreement starts on the day the owner accepts it and lasts until either side ends it.
  • The salon can end it whenever it wants with the «Cancel subscription» button in «Settings» › «Your salon’s subscription», with one month’s notice: its last day on TILZA is a month after the day it asks, everything works as usual until then, and it pays nothing for any time after it. It can take the end back until the last day.
  • When cancelling, the owner picks why from a list, or writes it in their own words in «Other», to help TILZA improve its service. The reason changes nothing about the cancelling.
  • The owner is also asked whether TILZA may contact them after the last day with its news and offers. The answer is optional, the box stays empty unless they tick it, it changes nothing about the cancelling, and they can change it whenever they want in «Your salon’s subscription» while their account is open.
  • If they agree, TILZA contacts them alone, by email only, from 9 AM to 6 PM UAE time and at most once a week, and every message says who it is from, why it came and how to stop it. They can stop it whenever they want in «Your salon’s subscription», by replying STOP to any of its messages, or by asking TILZA’s team; TILZA records the stop and sends them no more of its news and offers.
  • TILZA can end it with at least 30 days’ notice to the salon, saying why. Before the last day, it pauses the salon’s booking page only for a legal reason, as in «Pausing a salon».
  • The salon’s owners are emailed when an end is asked or taken back or its last day changes, and reminded 30 days, 7 days and 1 day before the last day.
  • After the last day, TILZA takes no new bookings for the salon and doesn’t show it in search, and its booking page still shows its phone number until it is paused. The salon finishes, free, in TILZA its bookings up to 10 days after the last day; so in the notice month, no booking later than that is taken online.
  • The salon tells its clients who have bookings after the last day, and TILZA helps with a list of them and a message to them once messages work in TILZA. The salon can download its data, free, until its account closes, and its clients’ data while it is kept there.
  • The day after those 10 days, 11 days after the last day, TILZA pauses the salon instead of erasing it: it has no booking page and doesn’t show in search, nothing can be booked in it, and nothing is sent from it to its clients but what concerns their requests about their data. Its set-up stays as it is: its services, prices, hours, branches, settings, team and their roles, and pictures.
  • On the day it pauses, whatever the owner chose, its clients’ health information, with their forms before chemical services, and its team’s health cards and vaccination dates are deleted, and «Beauty card» shares with it end. Its clients’ names, numbers and the rest of their data are erased that day too, as the salon erases them with «Delete her data», unless the owner chose «Keep my clients» before the pause, a box that stays empty unless they tick it. Its owners are emailed 7 days and 1 day before the pause, and on the day it pauses.
  • The salon stays paused for a year at most, and pays nothing for it. In that time only the owner can enter it, to read what is in it, download its data and answer its clients’ requests about their data; nothing else in it changes, and its team can’t enter it. If the owner kept their clients, their data is kept only for the salon’s return, as above; the owner can erase it whenever they want, and the keeping time the salon chose still runs, so the data of anyone it passes is deleted.
  • From the day after the last day, in those 10 days and all through the pause, the owner can bring the salon back with one tap on «Bring the salon back» in «Your salon’s subscription»: it comes back as it was, with all its set-up and with its clients if they were kept, and the agreement goes on as if it had never been ended. A salon whose agreement TILZA ended comes back only through TILZA’s team, if both sides agree. A salon doesn’t come back once its owner has asked to close its account for good.
  • The day after the year of the pause ends, or within the hour of the owner asking for it with «Close the account for good» in «Your salon’s subscription», TILZA closes the salon’s account, and it can’t come back after that: everyone with a sign-in to it is taken out of it, sign-ins that belong to no other salon are deleted, the names, numbers and the rest of the data of the clients it kept are erased as a deletion request erases them, each member of its team keeps a number instead of their name, such as «Team member 1», and everything in the account but its invoices and their records is deleted, as in the «Data processing annex». Its owners are emailed when closing is asked for, 30 days, 7 days and 1 day before the year of the pause ends, and on the day it closes.
  • The salon’s invoices, receipts and credit notes, and the records of sales, bookings, cash and commission behind them, stay without its clients’ names or numbers. TILZA keeps them for the salon until the end of the eighth year after the year its account closed, because the Tax Procedures Law requires VAT records to be kept 5 years after the end of their tax period, and the Corporate Tax Law requires its records to be kept 7 years after the end of the financial year they belong to, and this covers the salon’s last financial year. Then TILZA deletes them.
  • If the salon has a tax refund claim the Federal Tax Authority hasn’t decided, it must tell TILZA’s team, and its invoices and their records are kept two more years, as Cabinet Decision No. 17 of 2026 requires, and until it tells TILZA’s team the claim has ended.
  • Until they are deleted, the salon can ask TILZA’s team for a copy of them, which the team sends free once it has checked that whoever asks is the salon’s owner or acts for them.
  • TILZA’s own record of the salon, as in «Data», stays until 7 years have passed from the end of the year of its last day, the period for keeping records in the Corporate Tax Law; then the names and details of people and the licence number are removed from it, leaving only the salon’s name, when it left TILZA and why, and numbers that point to no one. TILZA keeps the owner’s email or phone after the account is closed only while their yes to being contacted stands.
  • TILZA doesn’t pause the salon, close its account, or delete any of the above, while a competent public authority’s request covering the salon’s data or one of its clients’ is open, as in «Requests from public authorities», and carries on with what waited once it ends.

14. Changes to this agreement

TILZA publishes each new version of this agreement with its date and «What changed in this version», with links to the sections that changed, words added marked and words removed struck through. Every earlier version stays, with its dates, in «Earlier versions».

A big change, one that changes what the salon or TILZA commits to, either side’s rights, or what the salon pays, is announced to the salon in the salon dashboard at least 30 days before it starts, and until that day the salon stays on the version it accepted. The owner can accept the new version before it starts; if they don’t accept it, they can cancel the subscription, and the salon stays on the version it accepted until its last day, with no fee the change brings.

A small change that changes none of these, such as correcting a word or making a sentence clearer, starts on the day it is published. A change that the law or an authority requires starts when they require it, and TILZA tells the salon when it is published.

Either way, the owner is asked to accept the new version in the salon dashboard.

15. Law and language

  • This agreement is governed by the laws of the United Arab Emirates. The parties first try to settle any disagreement amicably; otherwise the competent UAE courts hear it.
  • The agreement is in Arabic and English; if they differ, the Arabic applies.

Annex 1

Data processing annex

This annex is part of the agreement, and sets out how TILZA processes the data of the salon’s clients and team for the salon.

1. Roles

  • The salon is responsible for its clients’ and team’s data (the controller), and TILZA processes it for the salon (the processor), under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
  • TILZA is responsible itself for the data of people who search TILZA or use «My bookings», for the «Beauty card» a client keeps there and shares with the salon, for reviews, for the complaints and suggestions clients send from «Complaint or suggestion», and for the platform’s security records, as the «Privacy notice» and the «Reviews policy» explain.
Changed

2. The data and whose it is

  • Clients, including people under 18 and their parents or guardians: name, mobile, email and language, appointments, sales and invoices, notes, colour formulas, loyalty card and badges, agreements and requests, allergies and health with the person’s agreement, including the last patch test and the form before chemical services with its signature, before-and-after photos in the client’s file with her agreement, and the photo of her hair before her appointment, with her agreement, until her visit is over.
  • The salon’s team and owners: name, mobile and email, sign-ins and roles, hours and time off, commission and tips, added text: when the health card added text: runs out and added text: the emirate that issued it, the dates of the hepatitis B removed text: dates, added text: doses, whether the course is complete and the next dose’s date, when the residence, work permit and health insurance run out, their agreement to their photos being posted, their devices’ alert addresses if they turn booking alerts on there, and what they tick in the hygiene log and when, deleted 400 days after its day.
  • Appointment cards in the phone’s wallet, if a client adds one: the card’s number and language, and the number of each Apple device that added it so its updates reach it, deleted 3 days after the appointment.
  • Photos of the salon’s work it puts on its booking page: the photo and the service, and the client or team member in it, with their agreement.
  • Records of changes, downloads and sign-ins, and «Support» requests and their pictures.

3. Purpose and duration

TILZA processes this data only to provide its services to the salon, for as long as the agreement lasts, and then as «End of processing» says.

4. Instructions

TILZA processes the data only on the salon’s instructions: its use of TILZA and its settings, and what it asks in writing. If TILZA believes an instruction breaks the law, it tells the salon before acting on it.

5. Confidentiality

Only those on TILZA’s team who need the data to run the platform or help the salon can see it, and they are bound to confidentiality.

6. TILZA’s team looking at the salon’s dashboard

  • TILZA’s team looks at the salon’s dashboard only when the owner allows it from «Support», for 24 hours at most, and the owner can stop it sooner at any time.
  • It is a look only: the team changes nothing, doesn’t see allergies and health, health card dates or a client’s file of formulas and photos, and opens no files and downloads nothing.
  • TILZA keeps a record of every page the team opens and who opened it. In «Support» the salon sees when the team was allowed and who allowed it, and the pages don’t show in its dashboard. The salon gets a copy of the record, with the pages and their times, if it asks in writing from «Support», and TILZA gives it to a competent public authority on an official request.
  • TILZA keeps what is written in «Support» requests for 2 years after a request closes, and the pictures sent with them for 30 days after it closes, then deletes them. The error log keeps nothing anyone typed and no client data, and is deleted after 90 days.

7. Security

  • Data is encrypted in transit.
  • Allergies and health, before-and-after photos and the hair photo before a visit are encrypted with a key that isn’t kept in the database, seen only by those who need them, and every view of them is recorded.
  • Each person at the salon has a role, and sees only what their work needs.
  • Two-step verification is available on every salon account, and TILZA requires it of the roles it sets for every salon (the salon sees them under «Security»); signing in with a fingerprint or face counts as both steps. Sign-out is automatic after a time the salon sets.
  • Every change and every download of client data is recorded in the salon’s history.
  • An encrypted daily backup is kept for 30 days, then deleted.

8. Companies working for TILZA

  • Render: hosting and the database, in Frankfurt, Germany (European Union).
  • GitHub: keeping the encrypted daily backup.
  • When messages are turned on: Meta for WhatsApp, Twilio for text messages and Resend for email.
  • When wallet cards are turned on: Apple and Google for appointment cards in Apple Wallet and Google Wallet, without the client’s name, number or services.
  • Booking alerts to the team’s devices pass encrypted through each device’s browser alert service (Apple, Google, Microsoft or Mozilla), which can’t read them, and they hold no client’s name or number.

Each of them is bound by a contract that protects the data. TILZA tells the salon 30 days before adding or changing one, and the salon can object; if its objection isn’t resolved, it can end the agreement at no charge.

9. Where the data is kept

The data is currently kept outside the UAE, in Germany, and some of it reaches the companies above in other countries, including the United States, under contracts that require them to protect it and as the law allows. TILZA tells the salon before any change in where it is kept.

10. Breaches

If TILZA learns of a breach that may affect the salon’s data, it tells the salon without delay, and within 24 hours of learning of it at most, with what it knows: what happened, roughly which data and people are affected, what it has done and what it advises. It helps the salon tell the competent authority and its clients as the law requires.

11. Helping the salon

TILZA gives the salon tools to answer its clients’ requests about their data: a copy, a correction or deletion. If TILZA receives a request about the salon’s data, it passes it to the salon within 5 working days. It helps the salon with any data protection impact assessment or request from a competent authority.

12. Requests from public authorities

If a competent public authority, such as the Public Prosecution or a court, asks TILZA in writing for the salon’s data, TILZA gives only what the request covers and as the law requires, and records what it gave, to whom and when. It tells the salon what of its data was given, unless the law or the request itself forbids it. None of the data the request covers is deleted while the request is open.

13. Records and information

TILZA keeps a record of its processing, and gives the salon the information it needs to check TILZA meets this annex, when the salon asks in writing.

14. No use beyond the salon

TILZA never uses the salon’s data for itself, never sells it, never shows its clients other salons, and never trains any AI system with it.

15. End of processing

When the agreement ends, the salon can download its data, free, until its account closes. 11 days after its last day TILZA pauses the salon, deleting that day its clients’ and team’s health information, and its clients’ data unless it chose to keep it, as in «Term and ending». While it is paused, TILZA keeps the rest of its data for it as it is: nothing is booked with it, and nothing is sent from it to its clients but what concerns their requests about their data. Then TILZA closes its account a year after the pause, or when it asks, and deletes its data from its systems as in «Term and ending», and from backups when their 30 days are up. Only its invoices and their records stay, without its clients’ names or numbers: TILZA keeps them for the salon only as long as the tax law requires, uses them for nothing else, and its team opens them only to give the salon a copy or for a competent public authority’s request; then TILZA deletes them.

Annex 2

The salon’s legal duties

These duties are the salon’s own under the laws of the UAE and its emirate. TILZA may remind it of some of them, but meeting them is the salon’s responsibility.

Changed

The duties

  • A valid trade licence, whose type (women’s or men’s) matches who works at the salon.
  • VAT: registering once it reaches the threshold, prices including VAT, and tax invoices and returns on time.
  • E-invoicing: a provider accredited by the Ministry of Finance on time, and invoices to companies and government bodies sent as e-invoices through it from the day they start; it may also need the provider to receive its suppliers’ invoices.
  • Corporate tax: registering, filing and paying on time.
  • Arabic in prices, invoices and everything shown to clients, and the same price for cash or card.
  • removed text: Health cards for workers and the hepatitis B vaccine, where the authorities require them.
  • added text: A valid health card for everyone working at the salon, issued by the body the municipality of the branch’s emirate asks for, and a complete hepatitis B vaccination, where the authorities require them.
  • Sterilised tools, single-use tools used once, no wax stick dipped back into the pot, and cleanliness as the municipality requires. TILZA’s hygiene log helps with this and doesn’t replace it; what is recorded in it is the salon’s and its team’s responsibility.
  • Medical treatments, such as laser, Botox, fillers and injections, given only in a licensed health facility, and advertising them only with the health authority’s permit.
  • Clear, real prices with no hidden fees, and the client knowing the final price before the service starts (Consumer Protection Law).
  • Service guarantee: the salon warrants its service free of faults for a period suited to it, the client knows the guarantee’s terms before booking, and the salon redoes the service or refunds as its guarantee says (Consumer Protection Law and its Executive Regulations).
  • Only services within the licensed activity, prices as on the approved list of services and prices where the emirate requires one, and massage and spa offered only under a licence that covers them.
  • Permits where required: for offers, discounts and the loyalty card, for working after midnight, and for services at home.
  • Clients’ agreement to offers and marketing messages and the hours they are sent, and clients’ and the team’s agreement before they are photographed or their photos and videos are posted.
  • Protecting its clients’ and team’s data, as the one responsible for it.
  • Workers’ contracts, their pay through the Wage Protection System, and working and rest hours.