Privacy policy

How Luxora handles your information

The short version

We collect little. When you visit Luxora we do not ask who you are. We count visits with Google Analytics, which uses cookies to tell a returning browser from a new one, with its advertising features switched off. If you sign up for messages, we keep your WhatsApp number or email address and a record of your consent. If you are a stylist, we keep what you send us so that we can check and list you. We never sell your details. You can leave, correct or delete at any time.

In this policy, we and us mean Luxora, which is the responsible party under POPIA. You and your mean the person whose information it is.

Who is responsible

Luxora decides why and how your personal information is processed, so Luxora is the responsible party. POPIA section 18 asks us to tell you the name and address of the responsible party. We do not publish a company registration number, a street address or a person's name on this site. Those details are available on request from [email protected], and you can use the same address for anything in this policy.

What we collect, and when

The list below sets out what we collect. If we add something, we will change this page before it starts.

• When you visit: our host, Cloudflare, receives your IP address and the details of each request (such as the page you asked for) so that it can deliver the site and protect it from abuse. Cloudflare Web Analytics counts visits to our pages. Cloudflare says it does not use client-side state such as cookies or localStorage for analytics and does not track individual end users across its customers' sites. Google Analytics also counts each visit for us: the pages you view, how you arrived (for example from a search), your device, browser and screen size, and a rough location worked out from your IP address. It sets two cookies in your browser, _ga and one starting _ga_, which last up to two years and let it tell a returning browser from a new one. Counting starts when a page loads; the notice at the bottom of the page says so, and tapping Got it only hides the notice. We have switched off Google signals and ad personalisation, so this is not used to show you ads. Google Analytics does not tell us who you are.
• What stays on your device: the site remembers in your browser's local storage whether you dismissed the analytics notice. That setting sits in your browser. It does not tell us who you are. The Google Analytics cookies above also sit in your browser. You can delete or block them in your browser settings, and the site works the same without them.
• When you sign up for WhatsApp or email messages: your WhatsApp number or email address, the box you ticked to give consent (and the wording you saw), the topic you signed up for and the page you signed up on.
• When you write to us: your email address, your name if you give it, and what you write.
• When you apply as a stylist: your name, WhatsApp number, services and prices, city, suburb, how you work (your work mode), photos and your consent. We also look at the public social media accounts your photos come from, and note which account we matched. The page on how we verify stylists describes the checks.
• When you tap play on a video: your browser connects to YouTube, which is run by Google. See the section on other sites below.

What we do not collect

We do not sell anything on the site today, so we do not collect card or payment details. We do not ask for health information, religion, race or other special personal information (POPIA section 26). Please do not send it to us. A stylist's photos may show clients, and that is dealt with in the section on children and in the terms of use.

Why we use it, and the legal basis

POPIA allows processing only on a lawful ground (section 11). Ours are these.

• To send you the messages you asked for: your consent (section 11(1)(a) and, for direct marketing by electronic message, section 69(1)(a)). Consent has to be voluntary, specific and informed, and the burden of proving it is ours (section 11(2)(a)). That is why we keep a record of it.
• To list and verify a stylist: the stylist's consent.
• To answer your email: you contacted us, and we have a legitimate interest in replying (section 11(1)(f)).
• To run the site, keep it secure, and see which pages help readers: our legitimate interest (section 11(1)(f)). Google Analytics sets cookies for this, with its advertising features switched off. You can object (see Your rights) or block the cookies in your browser.
• To comply with the law, for example to answer the Information Regulator: a legal obligation (section 11(1)(c)).

Is giving it optional?

Yes. Giving us your number, email address or stylist details is voluntary. If you do not give them, you simply do not get the messages or the listing. No law requires you to give us this information. The technical details your browser sends to load a page are needed for the site to work.

Messages: how we use your WhatsApp number or email address

Under POPIA section 69, electronic direct marketing is prohibited unless you have given your consent or you are a customer of the sender, which does not apply to Luxora today. We ask for your consent once, with a tick box that you tick yourself. The amended POPIA Regulations say that opt-out does not count as consent, and we do not treat it as consent. We tell you at sign-up what you will get and about how often.

Every message says who it is from and gives you a way to stop (section 69(4)). You can reply STOP or tap unsubscribe at any time. WhatsApp's own Business Messaging Policy also says a business may message you only if you have given your number and agreed to hear from it, and must respect your request to stop.

Under section 45 of the Electronic Communications and Transactions Act, anyone who sends unsolicited commercial messages must give you the option to cancel your subscription and, on request, tell you where they got your personal information. For Luxora the answer is simple. We got your details from you, when you signed up.

Who handles your information for us

POPIA calls a person who processes information for us under a contract an operator (section 1). An operator must treat the information as confidential and use it only on our authority (section 20), and we must make sure it keeps it secure under a written contract (section 21). These are the operators and recipients. If we start using another outside service to handle your information, we will add it here first.

• Cloudflare: hosts the site (Cloudflare Pages), stores sign-ups, and provides Web Analytics. Cloudflare says it acts as a data processor for its customers' logs, and publishes a data processing addendum for customers.
• Google: runs Google Analytics, which counts visits for us as described above. Google explains how it uses information from sites that use its services on its own page, linked below.
• WhatsApp, which is part of Meta: only if we message you there. WhatsApp's own privacy policy says each business is responsible for how it handles your information, and that WhatsApp shares information with other Meta companies.
• An email service provider that sends our emails for us. Its name is available on request from [email protected].
• Where the law requires it, for example a court order or a request from the Information Regulator, we may have to disclose information. We will tell you unless the law stops us.

What other people see

Anything a stylist sends us for their listing is shown publicly once they are listed: name, photos, services and prices, city, suburb, how they work and a way to reach them on WhatsApp. We never show a street address. Sign-up details are never shown publicly. We never sell personal information.

Sending information outside South Africa

Cloudflare, Google and Meta run services in many countries, so your information may be processed outside South Africa, including in the United States. POPIA section 72 allows a transfer to a recipient in a foreign country if, among other grounds, the recipient is bound by a law, binding corporate rules or a binding agreement that gives an adequate level of protection, with rules on further transfer that are substantially similar to POPIA's.

Cloudflare says that for transfers it complies with the EU-U.S. Data Privacy Framework and uses standard contractual clauses. Those are European instruments, not South African ones. We rely on them as binding agreements that require the recipient to protect your information and to apply rules to onward transfers, which is what section 72(1)(a) looks for. If that worries you, you can ask us to remove the details we hold.

How long we keep it

POPIA section 14 says we must not keep a record longer than needed for the purpose it was collected for, unless the law, a contract or your consent allows it, or we reasonably need it for lawful purposes. When the time is up, we delete it or de-identify it as soon as reasonably practicable. For Luxora that means:

• Sign-up details: kept while you are signed up. When you unsubscribe or ask us to delete them, we delete them as soon as reasonably practicable. We keep a minimal record that you opted out (your number or email address and the date), only so that we do not message you again.
• Stylist details: kept while you are listed. We re-check prices every 90 days. If you withdraw your consent or ask us to remove your listing, we take the listing down and delete your submission and photos as soon as reasonably practicable. We keep a note that you asked, in case we need to show that we did.
• A stylist application we decline: deleted once it is no longer needed to answer questions about our decision.
• Emails to us: kept as long as needed to deal with your request and for a reasonable time after in case you follow up.
• Visit records: Cloudflare's request logs are held by Cloudflare under its own privacy policy. Google Analytics keeps the visit-level data it collects for us for 2 or 14 months, depending on how the property is set, and then deletes it. Totals in its standard reports are kept.

How we protect it

POPIA section 19 requires us to take appropriate, reasonable technical and organisational measures against loss, damage and unlawful access. Sign-ups are stored in Cloudflare, and we limit access to sign-up and stylist details to the people who need them to run Luxora. If we have reasonable grounds to believe that someone unauthorised has accessed your information, section 22 requires us to tell the Information Regulator and you as soon as reasonably possible.

Your rights

POPIA section 5 gives you these rights. You can use any of them by emailing [email protected].

• Ask whether we hold information about you, free of charge, and ask for a copy (section 23). We will ask you to prove who you are, usually by writing from the number or email address you signed up with. If a fee ever applied to a copy, we would give you a written estimate first.
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or to delete a record we are no longer allowed to keep (section 24). The Regulations say this is free of charge, and we must tell you in writing what we did within 30 days of the outcome.
• Withdraw your consent at any time (section 11(2)(b)). That does not affect what we did before you withdrew.
• Object to processing that rests on our legitimate interest, on reasonable grounds relating to your situation (section 11(3)(a)). Once you object, we may no longer process the information for that purpose (section 11(4)). To stop marketing messages, withdraw your consent or unsubscribe.
• Complain to the Information Regulator (section 74), and, if you suffer harm, bring a civil claim (section 99).

How to use your rights

Email [email protected] and say what you want. The POPIA Regulations ask for a form substantially similar to the Regulator's Form 1 (objection) or Form 2 (correction or deletion), and allow it to be sent by email, SMS or WhatsApp. An email with the same information is what we expect. If you are not sure what to include, tell us what you want and we will send you the form. You do not pay to object, correct or delete.

Complaints

Please tell us first, so that we can put it right. You can also complain at any time to the Information Regulator, the body POPIA set up to enforce the Act. You can use the Regulator's eServices portal or email [email protected], and you can phone 010 023 5200 or 0800 017 160. The Regulator's contact page has its current details, and its POPIA forms page lists the complaint form.

Children

POPIA treats anyone under 18 who cannot act without a competent person's help as a child, and generally prohibits processing a child's personal information unless, for example, a competent person such as a parent or guardian consents beforehand (sections 34 and 35). Luxora's sign-ups and stylist applications are for people aged 18 and over, and we do not knowingly collect information about children. If a child has given us their details, a parent or guardian can email us and we will delete them.

Stylists must not send us photos that show a child's face unless a parent or guardian has agreed to it. The terms of use say so.

Other sites, stores and video

Luxora links to stores. When you follow a link, the store's own privacy policy applies, not this one. Videos on Luxora are embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com), and they load only when you tap them. YouTube says that views in that mode are not used to personalise your YouTube experience, and that any ads shown are not personalised. Once you play a video, Google's privacy policy applies to what it collects.

Changes to this policy

The date at the top shows when this policy last changed. If we change what we collect or why, we will update this page and its date before the change starts. If a change needs your consent, we will ask for it again.