TILZA privacy notice

1. Who is responsible for your data

The salon you book with is responsible for your data as its client. TILZA is a company that provides the salon's booking and management system; it keeps and handles your data for the salon, only on its instructions, and never uses it for itself.

TILZA is responsible for the salon search, for signing in to «My bookings» with your mobile number, for your «Beauty card» if you keep one there, for reviews, and for the site’s security records.

4. Why it is kept

• To carry out the booking you asked for: to book you in, manage your appointments and contact you about them.
• Because the law requires it: invoices and payment records.
• Your allergies and health, and the form before chemical services: only with your agreement, so the salon can serve you safely, and so your agreement to the service is on record.
• Colour formulas: so the salon can give you the same colour on your next visit.
• The photo of your hair before your appointment: only with your agreement, so the salon can check the option you chose and you know the right price before you come; it is used for nothing else.
• To protect the booking page and your data from misuse.
• Reports: so TILZA’s team can follow them up and answer you on the report’s link.
• Reviews: because the law asks platforms that sell online to let their customers rate what they bought, and so others know how the service was.
• Favourite salons: because you chose to keep them, so you can find them and book again quickly; remove them whenever you like.
• Your beauty card: only with your agreement, so you can take your allergies, formulas and sizes to the salon you choose, which can then serve you safely without you telling it all again.
• The salon sends you offers only if you agree to them, and your data is never sold. If you agree, it may send you one when you’re late for your usual visit, which it knows only from your visits to it.
• The salon photographs its work on you for your file only if you agree, to follow how it turned out on you. It posts photos of its work on you, on its accounts or its booking page, only if you agree to that too, and without your name or face.

5. Who sees it

• The salon and its team, each as their work needs: a team member, for example, sees her own appointments.
• If the salon uses client badges, its owner, managers and reception see a badge next to your name, worked out from your bookings and payments at this salon only: “New”, “Regular”, “VIP” or “Frequent no-show”. No other salon sees it, the system never changes a price or stops a booking because of it, and nobody under 18 gets one.
• At the salon, only the owner, the managers, and whoever serves you on the day of your booking see your allergies and health, including the form before chemical services, and the before-and-after photos in your file. Reception doesn’t, and each time they are seen or changed is recorded in the salon’s history, without what they say.
• At the salon, only the owner, the managers and whoever serves you on the day of your booking open the photo of your hair before your appointment; reception sees that you sent it without opening it. Each time it is opened is recorded in the salon’s history, and TILZA’s team never sees it.
• Before your service, if the salon uses its summary before a visit, whoever serves you on the day of your booking, the owner and the managers see a short summary from your file at the salon: how many times you have visited and your last visit, your latest colour formula, what you like, and a reminder that it has a note about your health to read before the service, without what it says. Reception and TILZA’s team don’t see it.
• Photos of the work on the booking page are seen by anyone who opens it, without your name or face, and nothing on them says they are yours. Only the salon knows, and TILZA’s team can take down any photo reported to it.
• No salon sees your beauty card unless you share it with that salon yourself, by name, for as long as you choose: one day, or until you stop it. There, only the owner, the managers and whoever serves you on the day of your booking see what it says; reception sees only that you shared it. Each time it is opened is recorded in the salon’s history, and «My bookings» shows you how many times each salon opened it and when last. Anything the salon copies from it into your file there becomes part of your data at the salon.
• TILZA, only to run the system and help the salon. TILZA’s team looks at the salon’s dashboard only when the salon’s owner allows it, for 24 hours at most and as a look only, without allergies and health, your photos, your colour formulas, your beauty card or your private note with your review, and TILZA keeps a record of what it opened, which the salon gets if it asks in writing, and a competent public authority with an official request.
• Others see your review without your name or number. The salon you reviewed sees your name and booking number with it, and only its owner and managers read your private note to it. TILZA’s team checks it without your name, which nobody at TILZA is shown except for a competent public authority’s request, and that is recorded.
• Companies working for TILZA, each only for its job and under contracts that require them to protect the data: Render for hosting and the database, GitHub for an encrypted daily backup, and when messages are turned on, Meta for WhatsApp, Twilio for text messages and Resend for email.
• When you open a map, your device loads it from OpenStreetMap or Stadia Maps, which receive your device’s internet address, as any site you open does.
• If you tap «Google Calendar» to add your appointment to your calendar, Google’s site opens with the appointment: the salon’s name and address, the time, the services and the booking number, without your name or number, or anyone else’s name. The calendar file is saved on your device only.
• If you add your appointment to your phone’s wallet, TILZA makes its card with the salon’s name, the branch and its address, the salon’s phone, the time, the booking number and its status, without your name, number or services. An Apple Wallet card stays on your device, and in iCloud if you use it, and your device asks TILZA for its latest version if the appointment moves or is cancelled. A Google Wallet card is kept by Google in your Google account, under Google’s privacy policy.
• If someone on the salon’s team turns on booking alerts on their phone or computer, the alert about your appointment passes encrypted through their browser’s alert service (from Apple, Google, Microsoft or Mozilla), which can’t read it. It holds only the time and the services, without your name or number.
• If the salon shows its branch’s rating on Google Maps, TILZA’s server asks Google for it without any data about you, so your device doesn’t contact Google to show it. If you tap «Google Maps», Google’s site opens.
• A public authority, when the law requires it.

6. Where it is kept

Your data is kept outside the UAE: on Render’s servers in Germany (European Union), where a strict data protection law applies. Some of the companies above work from other countries, such as the United States, under contracts that require them to protect it. Your data always travels to them encrypted.

7. How long it is kept

• Your data at the salon you book with: until you ask for it to be deleted, or until the time the salon chooses, 2 to 5 years (3 if it doesn't choose), has passed since your last booking or visit there without you coming back; then it is deleted on its own.
• Your allergies and health, including the form before chemical services: until you take back your agreement or ask for them to be deleted; then they are deleted.
• Before-and-after photos: until you take back your agreement, the salon deletes them, or your data is deleted.
• The photo of your hair before your appointment: until your visit is over or the booking is cancelled, or, if the salon doesn’t close the appointment, up to 6 hours after its end. It is deleted sooner if you or the salon delete it, or the salon stops using it.
• Your agreements and each change to them: as long as the salon has your data, as they are the proof of what you agreed to and took back.
• Invoices, payment records and your past appointments: at least 5 years, because the tax law requires it, even after your data is deleted, but without your name or number.
• If a competent public authority, such as the Public Prosecution or a court, asks in writing for your number’s data, none of it is deleted until its request ends; then the usual time applies again.
• Reports: what you wrote in them and your number or email are cleared two years after the report is closed; only its number, kind and dates stay.
• Your review and your private note with it: until you delete it, or ask the salon to delete your data, when both are deleted with it. A review TILZA’s team removes for breaking the «Reviews policy» has its words and your note cleared after 180 days, leaving only its stars and why it was removed.
• Your appointment’s card in your phone’s wallet: TILZA forgets the card and the devices that added it 3 days after your appointment, and it stops updating. A Google Wallet card stays in your Google account until you delete it.
• Your beauty card: until you delete it in «My bookings», or two years pass without you or a salon you share it with opening it; then it is deleted. Sharing it with a salon ends when its time is up, when you stop it or when you delete the card, and the record of the share stays, without anything on the card, for two years after it ends, as the proof of what you agreed to and when you stopped it.
• The site’s security records and the error log: up to 90 days. Backups: 30 days, then deleted.

8. Keeping your data safe

Your data travels encrypted, each team member sees only what their work needs, and every change and every download of client data is recorded in the salon’s history. Your allergies and health, before-and-after photos, the photo of your hair before your appointment and your beauty card are kept encrypted, with a key that is not kept in the database. If your data is breached in a way that could harm you, the salon and TILZA will tell you and inform the competent authority as the law requires.

9. If you are under 18

• The booking page asks who the booking is for, because the law protects people under 18.
• If you are 13 to 17, you can book for yourself and give your parent’s or guardian’s name and mobile number, for the salon to call if needed. Their name and number are kept with your booking, and your record at the salon says you are under 18.
• If you are under 13, please don’t book yourself: your parent or guardian books for you.
• When a parent or guardian books for a child under 18, the booking is in their name and number, the child’s name is kept with it, and so is the parent’s or guardian’s agreement: when, on which page, and which version of this notice. Once confirmation codes are on, the parent or guardian confirms their mobile number with a code, unless the salon already knows it or it was confirmed with a code on the same phone or computer before.
• Nobody under 18 gets offers from the salon or has photos of them posted, and their data is never used for advertising. Before-and-after photos in their file need their parent’s or guardian’s agreement at the salon.
• The allergies and health of anyone under 18 are kept only with their parent’s or guardian’s agreement. Their form before chemical services is filled in at the salon with their parent or guardian, who signs it.
• The beauty card is for people 18 or over only, and a salon that has recorded you as under 18 doesn’t see it.
• The hair photo before an appointment is for people 18 or over only, and is never asked for a child booked by their parent or guardian. If the salon records you as under 18, the photo of your hair is deleted at once.
• The parent or guardian can cancel the booking from its link, and ask for a copy of the child’s data, or for it to be corrected or deleted, as under «Your rights» below.
• If you see something that harms you or a child, send a report from «Report a problem» at the foot of the pages. You don’t need to write your number: follow your report from its link.

10. Your rights

• To know what is kept about you and why: this notice.
• To ask for a copy of your data: the salon sends you a link to an Excel file with everything it keeps about you, where you can also download the photos in your file, and the photo of your hair before your appointment, if it has any, which opens only with the mobile number it has for you and works for 7 days.
• To ask for anything wrong to be corrected.
• To ask for your data to be deleted: your name, number, email, notes, health, colour formulas, photos, agreements, loyalty card, waiting-list requests, your reviews of the salon and the addresses of your visits at home are deleted, and your upcoming appointments are cancelled. Your past appointments and invoices stay, without your name or number, because the law requires invoices to be kept.
• To ask for your data to stop being used, or to be used less, and to stop offers at any time.
• To take back any agreement you gave, at any time: to offers, photos, posting them, or keeping what concerns your health, from your booking link, from «My bookings», or by telling the salon. Taking one back doesn’t change your booking.
• If you take back your agreement to keeping your allergies and health, they are deleted, with your forms before chemical services. If you take back your agreement to before-and-after photos, the photos in your file are deleted.
• To delete the photo of your hair before your appointment on your booking link whenever you like, so the salon no longer sees it.
• To change or delete your review at any time, from your booking link while it works or from «My bookings».
• You see, change and delete your beauty card yourself in «My bookings» whenever you like, and stop sharing it with any salon at any time, so it no longer sees it.

Ask from your booking link or waiting-list link, under «Your data and privacy», or from «My bookings» after a code to your mobile, or call the salon. The salon checks the number is yours before it sends you anything, and TILZA asks it to answer within 30 days.

If your request is not resolved, you can complain to the UAE’s data protection authority.

11. Changes to this notice

If this notice changes, we write the new date above with «What changed in this version», with links to the sections that changed, words added marked and words removed struck through, and ask you to read it again at your next booking. Earlier versions stay, with their dates, in «Earlier versions».

This notice is in Arabic and English; if they differ, the Arabic one applies.