Privacy Policy

Effective Date: 1 June 2026 | Last Reviewed: 2 June 2026

The Glow Up Society (“we”, “us”, “our”, “the Organisation”) respects your privacy and is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African laws.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, book appointments, use our services, or interact with us online or in‑studio.

By engaging with The Glow Up Society – whether by using our website, booking a treatment, or contacting us – you acknowledge that you have read and understood this policy.

1. What Personal Information We Collect

We may collect the following categories of personal information:

Identity & Contact Details: name, surname, email address, phone number, physical address (if required).
Health & Skin Information: relevant medical history, skin concerns, allergies, medications, and treatment preferences (necessary for safe delivery of aesthetic, laser, and skincare services).
Appointment & Transaction Data: appointment history, services received, payment records, and communications with us.
Technical & Usage Data: IP address, browser type, device information, pages visited, and referral source (via cookies and analytics tools – see section 7).
Marketing Preferences: your choices regarding receiving promotional materials, newsletters, or special offers.

We do not intentionally collect special personal information (e.g., biometric data, trade union membership) unless required for a specific service and with your explicit consent.

2. How We Collect Your Information

We collect personal information in the following ways:

Directly from you: when you complete a consultation form, book an appointment (online, by phone, or in person), send us an email, fill out our contact form, or subscribe to our newsletter.
Through our booking partners: we use Fresha as our third‑party appointment booking system. Fresha collects certain personal information on our behalf under a data processing agreement. Please also review Fresha’s privacy policy.
Automatically via our website: using cookies and similar technologies (see section 7).
From third parties: where you have given consent, or where it is necessary for the performance of a service (e.g., referral from a healthcare professional).

3. Why We Process Your Personal Information (Lawful Purposes)

We will only process your personal information for legitimate purposes, including:

To provide our services – schedule and manage appointments, deliver treatments, and follow up on your care.
Health and safety – assess suitability for treatments, manage contraindications, and ensure safe delivery of aesthetic procedures.
Communication – respond to enquiries, send appointment confirmations and reminders, notify you of changes.
Billing and administration – process payments, issue invoices, maintain accounting records.
Legal and regulatory compliance – maintain records as required by health, safety, or financial laws.
Marketing (with consent) – send you promotional offers, beauty tips, and news. You may opt out at any time.
Improving our services – analyse anonymised data to enhance client experience and treatment outcomes.

We rely on one or more lawful grounds under POPIA: consent, performance of a contract, legitimate interest, or legal obligation.

4. Sharing Your Personal Information

We will not sell, rent, or trade your personal information to third parties for their own marketing purposes.

We may share your data with:

Service providers who help us operate our business, such as Fresha (booking system), email marketing platforms, payment gateways, IT support, and cloud storage providers. All such providers are contractually bound to protect your data.
Professional advisors (lawyers, accountants, insurers) where necessary for legal or financial compliance.
Law enforcement or regulators if required by South African law, or to protect the rights, property, or safety of The Glow Up Society, our clients, or others.
Other parties only with your explicit consent.

Any international transfer of personal information will only occur if adequate protection mechanisms are in place.

5. How We Secure Your Information

We take reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, alteration, or disclosure. These include secure storage of paper records, password‑protected devices, encrypted digital storage, regular staff training on POPIA, and limited access to authorised staff only.

While no system is 100% secure, we continuously review our security practices. In the event of a data breach that poses a risk to your rights, we will notify you and the Information Regulator as required by POPIA.

6. Your Rights Under POPIA

As a data subject, you have the following rights:

Right of access: request a copy of the personal information we hold about you.
Right to correction: ask us to update or correct inaccurate or incomplete information.
Right to deletion: request that we delete your personal information where it is no longer needed or where you withdraw consent (subject to legal retention periods).
Right to object: object to processing for direct marketing or based on our legitimate interests.
Right to restrict processing: request that we limit how we use your information while we resolve a complaint.
Right to data portability: where technically feasible, request a copy of your information in a structured, machine‑readable format.
Right to withdraw consent: you may withdraw any previously given consent at any time.

To exercise any of these rights, please contact us using the details in section 12. We will respond within a reasonable time (usually 30 days).

If you are not satisfied with our response, you have the right to lodge a complaint with the South African Information Regulator.

7. Cookies and Tracking Technologies

Our website uses cookies to enhance your browsing experience and analyse site traffic. We use essential cookies (necessary for functionality), analytics cookies (anonymised data), and preference cookies. You can manage cookie preferences through your browser settings. Disabling certain cookies may affect website functionality.

8. Retention of Personal Information

We will retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including to provide services, comply with legal obligations (e.g., health records typically 5–7 years after your last treatment), and resolve disputes. After the retention period, we will securely delete or anonymise your information.

9. Children’s Privacy

Our services are not directed to children under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information, please contact us, and we will delete it promptly.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Effective Date” at the top indicates when the policy was last revised. If we make material changes, we will notify you via email or through a prominent notice on our website.

11. Third‑Party Links

Our website may contain links to third‑party websites (e.g., Fresha, Instagram). This Privacy Policy does not apply to those external sites. We are not responsible for their privacy practices.

12. Contact Us (Information Officer)

For any questions, requests, or concerns regarding this Privacy Policy or your personal information, please contact our designated Information Officer:

The Glow Up Society
Email: glowupsocietyza@gmail.com
Phone: 064 650 8247
Address: The Golf Place Fourways, Johannesburg, South Africa

13. Lodging a Complaint with the Information Regulator

If you believe we have violated POPIA, you have the right to complain to the Information Regulator of South Africa:

Postal Address:
Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: inforeg@justice.gov.za (enquiries) or complaints.IR@justice.gov.za (complaints)
Website: www.justice.gov.za/inforeg