Privacy Policy

dolledbysrara is a lash and brow studio at 344 Molefe Street, Emfihlweni Section, Tembisa, 1632, Gauteng, operated by a registered South African company. We are the “responsible party” for your information under POPIA.

Information Officer: Srara — the person responsible for how we handle personal information. Reach her on WhatsApp at 068 288 0321 or by email at ugcbynoma@gmail.com.

When you book an appointment

Your name, phone number, email address, the service and time you choose, and any notes you add. If you choose to, reference photos of the look you want. We use these to review, confirm and manage your appointment, to contact you about it, and to take your deposit.

When you pay

Payments happen on Yoco’s secure payment page. We receive confirmation that you paid and a payment reference — never your card number.

When you order from the shop

Your name, phone number, email address, delivery address and what you ordered, so we can process, pack and deliver your order.

When you leave a review

Your star rating, your comment and the name you choose to show. It is published on the site only if you tick the box that allows it.

When you use the chat assistant

It answers automatically and does not store your messages. If you give it a booking or order reference, it looks up the status of that booking or order to answer you.

When you visit the site

Our website host keeps short-lived server logs that include your IP address, to run the site and protect it from abuse. We don’t use analytics or advertising trackers.

We use your information because it is needed for the booking or order you asked for, because you consented (health details and published reviews), because the law requires us to keep certain records (tax), or to keep the site secure.

If you tell us about allergies, sensitive eyes or other health details, that is special personal information under POPIA. We use it only to do your treatment safely, and only with the consent you give when you book. You can withdraw that consent at any time — but Srara may then be unable to do the treatment safely.

Your name, phone number and email address are needed to book, and a delivery address to order. Without them we can’t take the booking or deliver the order. Notes, photos and reviews are optional.

Srara and the staff who work with her see what they need to look after your appointment or order. These service providers handle information for us, only to provide their service:

• Supabase — stores bookings, orders and reference photos (Ireland, EU).
• Vercel — hosts the website (United States).
• Resend — sends our booking and order emails (Ireland, EU).
• Yoco — processes card payments (South Africa).
• Google— Srara’s appointment calendar, which shows paid bookings (United States), and the map on our Find Us page.
• PAXI or Uber Connect — your name, phone number and delivery address when we ship an order.

We never sell or rent your information, and we don’t share it for anyone else’s marketing. We would only disclose it otherwise if the law required us to.

Some of the providers above store information in the European Union or the United States. We only use providers that are bound — by law, such as the EU’s GDPR, or by their data protection agreements with us — to protect it to a standard at least as high as POPIA’s, and the transfer is needed to provide your booking or order.

• Reference photos — deleted 30 days after your appointment, or sooner if your request is declined.
• Booking requests and shop orders that were never paid — deleted 12 months after they were made.
• Paid bookings and orders — kept for 5 years, as tax law requires, then deleted.
• Published reviews — until you ask us to remove them.
• Server logs — kept by our website host for a few days.

You can ask us to delete your information sooner. We will, unless the law requires us to keep it — for example, records of a payment.

• The whole site uses an encrypted (HTTPS) connection.
• Card details are handled only by Yoco and never reach our systems.
• Only Srara and the staff she authorises can open the booking dashboard. They may use your information only to look after your appointment or order.
• Our database only lets each part of the site see what it needs.
• Reference photos are stored at unguessable links that are never listed publicly.

If we ever find that your information was accessed without permission, we will tell you and the Information Regulator as soon as reasonably possible.

Our pages set no tracking or advertising cookies — no cookies at all for visitors. While you fill in the booking form, your unfinished booking is kept in your browser’s session storage, so you don’t lose it if you look at the gallery; it is cleared when you submit or close the tab.

The map on our Find Us page comes from Google, which may set its own cookies. See Google’s privacy policy.

We only message you about your own booking or order: confirmations, payment links, reminders, changes, and one request for a review after your appointment. We don’t send marketing. If we ever want to, we will ask for your permission first.

Clients under 18must be booked by a parent or guardian, who consents to us using their child’s information for the appointment.

You can, at any time and free of charge:

• ask whether we hold information about you, and get a copy of it;
• ask us to correct it if it is wrong or incomplete;
• ask us to delete it;
• object to how we use it, or withdraw a consent you gave;
• refuse marketing messages.

Just WhatsApp 068 288 0321 or email ugcbynoma@gmail.com. We may ask you to confirm who you are, and we will answer within 30 days. For formal requests for records, see our PAIA manual.

Please tell us first — we would like the chance to put it right. If you are not satisfied, you may complain to the Information Regulator: POPIAComplaints@inforegulator.org.za · inforegulator.org.za.

If we change this policy, we will update it here with a new date. Our Terms & Conditions explain how bookings and orders work.