Privacy Policy | Wax On Wax Off, Sea Point

1. Who we are

Wax On Wax Off is a waxing and grooming studio at 13 Regent Road, Sea Point, Cape Town, 8005, South Africa. We are a brand of Dream Merchant Group.

For the purposes of POPIA we are the responsible party for the personal information described below. Our information officer can be reached using the contact details in section 10.

2. What we collect

When you book a treatment

Bookings are taken through Fresha, our salon booking platform, and in some cases by WhatsApp, phone or in person. To make and honour a booking we collect your name, mobile number, email address, the services you booked, and your appointment history.

Where a treatment requires it, we take a short intake note covering skin sensitivity, allergies, recent sun exposure, and medications or conditions that affect waxing safety. This is health information and is treated as special personal information under POPIA. We collect it only to perform the treatment safely, we keep it to the minimum needed, and we never use it for marketing.

When you message us

If you contact us on WhatsApp, Instagram, Facebook or email, we hold the content of that conversation and the profile name and number or handle attached to it, so we can answer you and keep a record of what was agreed.

When you buy a gift voucher

Voucher purchases are processed by Paystack. We receive your name, email address, the amount and the reference. We never see or store your full card number, CVV or PIN. That data goes directly to Paystack and its acquiring banks.

When you visit this website

We use two things that involve your device:

Meta Pixel. A small piece of Meta (Facebook) code that records page views and actions such as clicking through to book. We use it to measure whether our advertising works and to show ads to people who have visited the site. It sets cookies and shares an identifier with Meta. The same Pixel may also run on our Fresha booking pages, so that we can tell which adverts lead to a real booking rather than only a click. It records that a booking was completed and its value. It does not send Meta the name of the treatment you booked.
Standard server logs. Our host records your IP address, browser type and the pages requested, for security and troubleshooting.

You can switch the Pixel off at your end by blocking third-party cookies in your browser, by using a tracker-blocking extension, or through your Meta ad settings. The site works normally either way.

4. Why we use it, and on what basis

To deliver the service you asked for: making, confirming, rescheduling and honouring your appointment, and performing the treatment safely. Basis: performance of a contract with you, and your consent for health information.
To reduce no-shows: booking confirmations and reminders by WhatsApp, SMS or email. Basis: performance of a contract.
To answer you: replying to enquiries across our channels. Basis: your request.
To market to you: offers, promotions and studio news, only where you have opted in. Basis: consent. Every marketing message carries a way out.
To measure and target advertising: understanding which ads produce bookings. Basis: our legitimate interest in running a viable business, balanced against your right to opt out as described in section 2.
To meet our legal obligations: tax, accounting and consumer-protection record keeping. Basis: law.

6. How long we keep it

Client and booking records: for as long as you are an active client and five years after your last visit, which is the period we need for tax and liability purposes.
Treatment and skin-sensitivity notes: five years after your last treatment, then deleted.
Marketing consent records: until you withdraw consent, plus a record of the withdrawal so we do not contact you again by mistake.
Payment records: five years, as required by South African tax law.
Website and Pixel data: retained by Meta under its own retention schedule; our server logs are kept for up to 90 days.

7. How we protect it

Access to client records is limited to the therapists and managers who need it. Our booking, payment and messaging platforms are accessed over encrypted connections with individual staff accounts. Card data never reaches our systems. Where we hold credentials, they are kept in a secured store and rotated when a staff member leaves.

No system is perfect. If a breach occurs that creates a real risk to you, we will notify you and the Information Regulator as POPIA requires.

8. Your rights

Under POPIA you may, at any time:

Ask what personal information we hold about you, and get a copy of it.
Ask us to correct anything that is wrong or incomplete.
Ask us to delete information we no longer have a lawful reason to keep.
Withdraw your consent to marketing, with no effect on your ability to book.
Object to processing based on legitimate interest.
Complain to the Information Regulator of South Africa.

We answer requests within 30 days and we do not charge for a reasonable request. We may ask you to confirm your identity first, so that we do not hand your records to somebody else.

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
complaints.IR@justice.gov.za · inforegulator.org.za

9. Deleting your data

You can ask us to delete your information at any time and we will do it, apart from the records we are legally required to keep, such as invoices for tax. Full instructions, including how to remove data associated with your Facebook or Instagram account, are on our data deletion page.

10. Contact us

Wax On Wax Off · a Dream Merchant Group brand 13 Regent Road, Sea Point, Cape Town, 8005 WhatsApp · +27 83 340 1274 Email · privacy@waxonoff.co.za

Please put “POPIA request” in the subject line so it reaches the right person quickly.

11. Changes to this policy

We update this page when our practices change. The date at the top is always the date of the current version. If a change materially affects how we use your information, we will tell you directly before it takes effect.