1. Who we are
Xymuhao Beauty Studio (“Xymuhao”, “we”, “us”) provides beauty services in South Africa and is the responsible party or data controller for information collected through this website. Contact our privacy representative at privacy@xymuhao.com or +27 10 555 0186.
2. Information we collect
We may collect your name, email address, telephone number, service interest, enquiry content, appointment preferences, consent records and communications with us. If relevant to safely providing a requested service, we may ask you directly for limited information about allergies, sensitivities or health considerations. Please do not send unnecessary health information through the website form.
Our website may also process basic technical data such as browser type, device type, requested page, date and approximate network information in ordinary server logs. The cookie preference tool stores only your choice in your browser’s local storage.
3. Why and how we use information
We use information to respond to enquiries, arrange and deliver requested services, maintain appropriate service records, communicate operational information, keep the website secure, meet legal obligations, resolve disputes and improve our processes. Our legal bases may include consent, steps requested before entering a contract, performance of a contract, compliance with law and our legitimate interests in operating a safe, responsive business.
4. Special personal information
Where health-related information is necessary for service safety, we process it only with an appropriate legal basis, restrict access and retain no more than reasonably necessary. Our beauty services are not a substitute for medical assessment or treatment.
5. Sharing and processors
We do not sell personal information. We may share limited information with vetted providers that support hosting, email, appointment administration, professional advice or security, under appropriate confidentiality and data-processing terms. We may disclose information when legally required or to protect rights and safety.
6. International transfers
If a service provider processes information outside South Africa or the EEA, we use measures intended to ensure an adequate level of protection, such as contractual safeguards, an adequacy basis or another lawful transfer mechanism.
7. Retention
Enquiries are generally retained for up to 24 months after the last meaningful interaction. Service and transaction records may be kept longer where required by tax, consumer, safety or other applicable law. We securely delete or anonymise information when it is no longer needed.
8. Security
We use reasonable organisational and technical safeguards appropriate to the information, including access limitation, staff awareness, secure systems and service-provider review. No online system is completely risk-free. If a qualifying breach occurs, we will notify relevant authorities and affected people as required.
9. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or information about how your data is used. Withdrawal does not affect earlier lawful processing. We may need to verify your identity and may retain information where law permits or requires.
You may complain to South Africa’s Information Regulator or, where GDPR applies, your local supervisory authority. We encourage you to contact us first so we can address the concern.
10. Children
This website is not directed to children. A parent or legal guardian should contact us about services for a minor. We do not knowingly collect children’s information online without appropriate authorisation.
11. Cookies and local storage
The current site uses local storage only to remember whether you accepted or rejected the cookie notice. We do not use advertising or analytics cookies. Clearing browser storage will reset your choice.
12. Changes and contact
We may update this policy when our practices or legal requirements change. The date above shows the current version. Questions and privacy requests may be sent to privacy@xymuhao.com.