Privacy policy
Privacy Policy
Last Updated: [ September 2026]
[Nailotus] (referred to in this policy as "we", "our", or "us"), trading as (ABN: 94699607470), is committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Spam Act 2003 (Cth).
This Privacy Policy explains how we collect, hold, use, disclose, and safeguard your personal information when you book an appointment, visit our salon, use our website ([Insert Website URL]), or interact with us.
1. What Information We Collect
To provide our salon services and manage bookings safely, we collect both personal information and relevant health information:
Contact & Identity Information: Your full name, mobile number, email address, and residential or postal address (if required).
Booking & Attendance History: Requested services, appointment dates and times, preferred stylists/technicians, cancellation records, and appointment notes.
Health & Treatment Information (Sensitive Information):
Known allergies, skin sensitivities, or reactions to specific cosmetic ingredients, chemicals, or nail products.
Relevant skin, nail, or medical conditions that may impact the safety or suitability of treatments.
Treatment records, patch test results, and product preferences.
Payment Details: Transaction history, deposit records, and payment confirmations. Note: We do not store credit or debit card numbers on our local systems. Card transactions are processed securely via Square.
Digital & Technical Data: IP addresses, browser types, and usage cookies when you visit our website or online booking page.
2. How We Collect Personal Information
We collect information directly from you through reasonable and lawful means, including when you:
Book Online: Enter your details through our online booking portal powered by Square Appointments.
Complete Intake or Consultation Forms: Submit pre-treatment consultation questionnaires or allergy disclosures.
Communicate With Us: Contact us via phone, SMS, email, social media, or in person at the salon.
Pay for Services: Process deposits, gift cards, or payments at checkout.
If you provide personal information about someone else (for example, booking an appointment on behalf of a friend or family member), you must ensure you have their consent to do so.
3. Purpose of Collection, Use, and Disclosure
We collect, hold, and use your personal information for the following purposes:
Appointment Management: Scheduling, confirming, rescheduling, and sending automated SMS/email reminders about upcoming bookings.
Health & Safety: Assessing your suitability for specific treatments, preventing adverse chemical or allergic reactions, and maintaining professional hygiene standards.
Payment Processing: Securely collecting booking deposits, service fees, cancellation charges, or issuing refunds.
Customer Service & Record Keeping: Tracking treatment history to maintain service consistency and manage client preferences.
Marketing Communications: Sending newsletters, special promotions, or salon announcements where you have given consent. You can opt out of marketing messages at any time using the unsubscribe link or by contacting us directly.
Legal & Regulatory Compliance: Fulfilling statutory accounting, tax, and insurance requirements.
4. Third-Party Service Providers & Square
We partner with third-party providers to deliver our booking and payment services:
Square (Block, Inc. / Square AU Pty Ltd): We use Square Appointments and Square POS to manage client schedules and process transactions. Square processes your data in line with the Square Buyer Privacy Notice. Card details are encrypted and tokenised under industry-standard PCI-DSS compliance; our staff cannot view your full card numbers.
Communications & Cloud Hosting: Third-party SMS gateways, email providers, and secure cloud storage platforms that support our day-to-day operations.
We do not sell, rent, or trade your personal or sensitive health information to third parties for marketing purposes.
5. Cross-Border Data Disclosures
Because our booking system and cloud infrastructure rely on providers such as Square, your personal information may be stored on or accessed from servers located outside Australia (including the United States and other jurisdictions).
Where data is processed overseas, we take reasonable steps to ensure that international service providers adhere to data security standards substantially similar to the Australian Privacy Principles.
6. Storage and Security of Information
We take reasonable technical and administrative precautions to protect your personal and sensitive data from misuse, loss, unauthorised access, modification, or disclosure:
Electronic Records: Secured through encrypted connections, two-factor authentication (2FA), and role-based access controls restricted to authorised salon staff.
Physical Records: Any physical consultation cards or intake notes are stored securely and digitised or shredded when no longer active.
Data Retention: We retain information only for as long as necessary to fulfil salon services, manage ongoing client care, and comply with legal, tax, or professional insurance obligations.
7. Accessing and Correcting Your Information
Under the Australian Privacy Principles, you have the right to:
Request Access: Ask to see the personal or treatment records we hold about you.
Request Corrections: Ask us to update or correct inaccurate, incomplete, or out-of-date information.
To request access or corrections, email us at [Insert Contact Email]. We will verify your identity before releasing information and aim to respond within 30 days.
8. Enquiries and Complaints
If you have questions about this Privacy Policy or wish to make a complaint regarding a potential breach of your privacy, please contact us:
Business Name: Nailotus
Attention: Jillian Swan-Eiffe
Email: Nailotus.Terrigal@gmail.com
Phone: 0481143225
Postal Address: Shop 9, 50 Terrigal Esplanade, Terrigal 2260 NSW
We take privacy concerns seriously and will investigate and respond to complaints promptly. If you are not satisfied with our response, you have the right to lodge a formal complaint with the Office of the Australian Information Commissioner (OAIC):
Website: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001