This Privacy Policy explains how REMBO Site handles personal information when you visit this website, register a salon, sign in to the POS, or use a salon's public storefront. It also explains the two relationships involved: REMBO to the salon, and the salon to its own customers and staff.
1. Who is responsible for your information
REMBO Site ("REMBO", "we", "us") is the data controller for information about salon owners and staff accounts, website visitors and billing. That includes registration details, support messages, invoices, security logs and information collected when you use this website.
For the customer and staff records a salon enters into the platform, the salon is the data controller and REMBO acts as a data processor on the salon's instructions. The salon decides what it collects, why it collects it and how long it keeps it. REMBO hosts, processes and protects that data so the salon can run its bookings and till.
If you are a customer or employee of a salon and want to access, correct or delete information in that salon's records, please contact the salon first. We will help the salon respond, but we do not decide how its records are used.
This policy is published under the Kenya Data Protection Act, 2019 and its regulations. It applies to this website, the owner dashboard, the POS and the public storefronts that salons publish through REMBO.
2. Information we collect
- Owner and business details: your name, email address, phone number, business name, salon code, domain, package and billing references.
- Staff account details: names, phone numbers, email addresses, roles, login activity and records of commissions, payouts, advances, leave requests and approvals.
- Salon customer records, processed for the salon: names, phone numbers, email addresses, bookings, service history, preferences and notes, loyalty balances, receipts and payment references.
- Payment information: the payment method, amount, date, phone number or M-Pesa reference used for a subscription or a salon sale. We do not store full card numbers; card payments are handled by the payment provider.
- Messages and uploads: enquiries you send us, support conversations, and photos, logos or documents a salon uploads to its storefront or gallery.
- Technical information: IP address, browser and device type, pages requested, timestamps, session and security logs, and records of staff actions kept for audit purposes.
- Cookies and similar technologies: a session cookie used to keep you signed in and protect forms against cross-site requests. We do not currently use advertising or analytics cookies.
3. Why we use it and our lawful basis
We use personal information only for the purposes below, or for a closely related purpose that you would reasonably expect from a salon management service.
| Purpose | Lawful basis |
|---|---|
| Create and run the salon account, the POS, bookings, loyalty and reports | Performance of our contract with the salon |
| Process customer and staff records on the salon's instructions | The salon's instructions and its lawful basis; REMBO acts as processor |
| Take and reconcile subscription payments, issue invoices and recover debts | Contract, and our legitimate interest in being paid |
| Keep the service secure, prevent fraud and misuse, and audit staff actions | Legitimate interests, and legal obligations where they apply |
| Provide support and respond to enquiries | Contract, or legitimate interest in helping users |
| Comply with tax, accounting and other legal requirements | Legal obligation |
| Improve the platform using aggregated or de-identified information | Legitimate interest in improving the service |
| Send service updates or owner marketing (with an opt-out) | Consent where required, otherwise legitimate interest |
We do not sell personal information. We do not use salon customer records for our own marketing, and we do not disclose them to other salons.
4. Who receives personal information
- Authorised users of the salon, whose access is limited by their role.
- REMBO staff who need the information to support the salon, maintain the platform or investigate a security issue, under confidentiality obligations.
- Hosting, database, storage and backup providers that run the infrastructure for the platform.
- Payment and mobile money providers, including M-Pesa, to initiate, confirm and reconcile payments.
- SMS and notification providers that a salon configures, to deliver messages the salon sends.
- Email delivery, domain, security and professional advisers that help us operate the service.
- Authorities, courts or regulators where the law requires disclosure, or a successor organisation if the business is transferred, subject to appropriate safeguards.
Service providers may only process information for the purpose we engage them for. We require them to protect it and, where they handle salon records, to act only on documented instructions.
5. How we protect information
We use technical and organisational measures appropriate to the risk, including the following, which are implemented in the platform:
- Tenant isolation: records are tied to a salon's business identifier, and a signed-in staff session is cleared when it is presented against a different salon.
- Role-based access, so staff see only what their role allows.
- Passwords are stored as one-way hashes, never as readable text.
- Session cookies are HttpOnly and SameSite, and are marked Secure when the site is served over HTTPS.
- Payment gateway and SMS credentials are encrypted at rest.
- HTTPS is used on the production site, and signed-in staff actions are written to an audit log.
- Access to production systems is limited to people who need it to operate and support the service.
No system can be completely secure. If you believe an account or password has been compromised, contact us immediately so we can help you secure it.
6. How long we keep information
- Account and business information is kept while the salon is active and for about 30 days after closure, so the owner can recover the account or request a copy.
- Salon customer, booking, sale, expense, commission and staff records are kept for as long as the salon instructs us to keep them, and for any period required by Kenyan tax, accounting and employment law.
- Security, audit and access logs are kept for a limited period needed to investigate incidents and protect the service.
- Support messages and enquiries are kept for as long as needed to resolve the matter and for a reasonable period afterwards.
- Backup copies may remain until they are overwritten in the ordinary course of the backup cycle.
- After the relevant period, information is deleted or de-identified, unless we must keep it to comply with the law, resolve a dispute or protect legal rights.
7. Your rights
Under the Data Protection Act, 2019 you may ask for access to your personal information, ask us to correct information that is inaccurate, ask for deletion where the law allows it, object to or ask us to restrict certain processing, ask for a portable copy of information you provided, and withdraw consent where processing is based on consent.
To make a request, email privacy@rembo.site or use the contact page. Tell us what you want and how we can verify your identity. We will respond within the period required by law. We may need to ask the salon to confirm an instruction about salon customer or staff records, because the salon is the controller of those records.
You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) in Kenya. We ask that you contact us first so we have a chance to put things right.
8. Cookies and similar technologies
REMBO uses one essential session cookie, REMBO_POSSESSID_V2, to keep a signed-in user connected to the right salon and to protect forms against cross-site request forgery. It is a session cookie, removed when you close the browser, and it is not used for advertising.
We do not currently use analytics, advertising or social-media tracking cookies. Some pages load fonts and icons from third-party content networks (Google Fonts and Font Awesome). Those requests disclose your IP address to the provider but do not set REMBO advertising cookies.
Because we only use cookies that are necessary to provide the service, we do not show a consent banner for non-essential cookies. If we introduce analytics or marketing cookies, we will update this policy and ask for consent where the law requires it. You can block or delete cookies in your browser, but blocking the session cookie will prevent staff from signing in.
9. Processing outside Kenya
Our hosting and service providers may process information on servers outside Kenya. Where that happens, we take the steps required by the Data Protection Act, 2019 and its regulations for international transfers, including using providers that offer appropriate contractual and security safeguards.
The salon is responsible for telling its customers and staff if it uses a provider that processes their information outside Kenya, and for ensuring it has a lawful basis for the transfer.
10. Security incidents and complaints
If we become aware of a personal data breach, we investigate promptly, take steps to contain it, and notify affected salons and the ODPC where the law requires it. We will tell you what happened, what we did and what you can do.
Report a privacy or security concern to privacy@rembo.site. If you are not satisfied with our response, you may contact the Office of the Data Protection Commissioner (ODPC) through its website at odpc.go.ke or its published complaint channels.
11. Changes and contact
We may update this policy when the platform or the law changes. The current version is always on this page with its update date. If a change materially affects how we use personal information, we will notify salon owners by email or in the dashboard.
Privacy questions and requests: privacy@rembo.site. General support: support@rembo.site or the contact page. Each salon also publishes its own privacy notice for its customers and staff, which explains the information that salon collects and how to contact it.