Privacy Policy

Last updated: June 28, 2026

1. Introduction

Africa SPA System ("we," "our," or "us") is committed to protecting the privacy of all users of our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our salon management platform and related services.

We serve salon and beauty businesses across 54 African countries and comply with applicable data protection laws including the Kenya Data Protection Act, 2019, the Nigerian Data Protection Regulation (NDPR), the Protection of Personal Information Act (POPIA) of South Africa, and other relevant regional regulations.

2. Information We Collect

2.1 Personal Information

We may collect the following personal information:

  • Account Information: Full name, email address, phone number, business name, business registration details, and account credentials
  • Contact Information: Billing address, physical address of your salon/business, and contact preferences
  • Financial Information: Payment method details (processed securely through our payment partners — we do not store full payment card numbers), transaction history, and invoicing information
  • Staff and Client Data: Information about your employees and clients that you choose to store in the Platform, including names, contact details, appointment history, and service preferences
2.2 Automatically Collected Information

When you access the Platform, we automatically collect:

  • Usage Data: Pages visited, features used, time spent on the Platform, and interaction patterns
  • Device Information: IP address, browser type, operating system, device type, and language preferences
  • Location Data: Approximate geographic location based on IP address
  • Cookies and Tracking Technologies: As described in our Cookie Policy section below

3. How We Use Your Information

We use the collected information for the following purposes:

  • Service Delivery: To provide, maintain, and improve the Platform and its features
  • Account Management: To create and manage user accounts, process subscriptions, and provide customer support
  • Communication: To send service updates, billing information, and respond to inquiries
  • Analytics: To analyze usage patterns and improve platform performance and user experience
  • Security: To detect, prevent, and address technical issues, fraud, and security threats
  • Legal Compliance: To comply with applicable laws, regulations, and legal processes
  • Marketing: To send promotional communications (with your consent where required by law)

4. Legal Basis for Processing

We process your personal information based on the following legal grounds:

  • Contractual Necessity: Processing required to fulfill our obligations under the Terms of Service
  • Consent: Where you have given explicit consent for specific processing activities
  • Legitimate Interests: For purposes such as improving our services, security, and fraud prevention
  • Legal Obligation: Where processing is required by applicable law

5. Data Sharing and Disclosure

We may share your information in the following circumstances:

  • Service Providers: With third-party vendors who assist us in operating the Platform (payment processors, hosting providers, analytics services). These providers are bound by contractual agreements to protect your data.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction
  • Legal Requirements: When required by law, court order, or governmental regulation
  • With Your Consent: When you have explicitly consented to sharing

We do not sell your personal information to third parties.

6. Data Security

We implement robust security measures to protect your data:

  • Encryption: All data is encrypted in transit using TLS 1.3 and at rest using AES-256
  • Multi-Tenant Isolation: Strict data isolation between tenants ensures your data is accessible only to authorized users within your organization
  • Access Controls: Role-based access control (RBAC) limits data access based on user permissions
  • Regular Audits: Security audits and penetration testing are conducted regularly
  • Monitoring: 24/7 monitoring for suspicious activity and potential security threats

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with services. After account termination:

  • Your data remains accessible for export for 30 days
  • After 30 days, personal data is permanently deleted
  • Anonymized, aggregated data may be retained for analytics purposes
  • Certain records may be retained longer if required by applicable law or for legitimate business purposes

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Right to Access: Request a copy of the personal data we hold about you
  • Right to Rectification: Request correction of inaccurate or incomplete data
  • Right to Erasure: Request deletion of your personal data, subject to legal requirements
  • Right to Restrict Processing: Request limitation of how we process your data
  • Right to Data Portability: Request transfer of your data to another service provider
  • Right to Object: Object to processing based on legitimate interests or direct marketing
  • Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us using the information in Section 14.

9. Cookie Policy

We use cookies and similar tracking technologies to enhance your experience. Types of cookies we use:

  • Essential Cookies: Required for the Platform to function properly (session management, security)
  • Functional Cookies: Remember your preferences and settings
  • Analytics Cookies: Help us understand how you use the Platform to improve our services
  • Marketing Cookies: Used to deliver relevant advertisements (with your consent)

You can control cookie settings through your browser preferences. However, disabling certain cookies may affect Platform functionality.

10. International Data Transfers

As a pan-African platform, your data may be processed in multiple African countries where we operate. Our servers are primarily located in Kenya and South Africa. When data is transferred across borders, we ensure appropriate safeguards are in place, including:

  • Standard contractual clauses for data transfers
  • Compliance with applicable cross-border data transfer regulations
  • Data processing agreements with all service providers

11. Children's Privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us with personal data, we will take steps to delete such information. If you believe a minor has provided us with their data, please contact us immediately.

12. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through our Platform.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

  • Posting the updated policy on the Platform
  • Sending an email notification (for registered users)
  • Displaying a notice when you log in after changes take effect

We encourage you to review this Privacy Policy periodically for any updates.

14. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer:

You also have the right to lodge a complaint with your local data protection authority.

Your Privacy Matters to Us

If you have concerns about your data, please reach out to our team.

Contact Us