Skip to content

Data Protection

This page explains how Salonsphere protects the personal data you entrust to us — the safeguards we use, how we govern access to data, and how we respond if something goes wrong.

Effective date: 17 October 2026 Applies to: Salonsphere apps & salonsphere.app Operator: NextHome Labs

1. Our commitment

NextHome Labs builds and operates Salonsphere with privacy and security by design. We follow the Uganda Data Protection and Privacy Act, 2019 and its regulations, and we apply equivalent standards to all our users worldwide. Where the GDPR or UK GDPR applies to you, we honour the additional rights and protections those laws provide. Our Privacy Policy explains what we collect and why; this page explains how we keep it safe.

2. Governance and responsibilities

  • Accountability: NextHome Labs is the data controller for Salonsphere data and is responsible for demonstrating compliance with data protection law.
  • Data protection contact: privacy matters are handled by a designated team reachable at [email protected].
  • Policies: we maintain internal policies covering acceptable use, access control, incident response, vendor management and secure development, and we review them regularly.
  • Training: team members with access to personal data receive confidentiality obligations and data protection training.

3. Technical safeguards

  • Encryption in transit: all traffic between the app, the website and our backend is encrypted with HTTPS/TLS. We do not serve personal data over unencrypted connections.
  • Encryption and hashing at rest: data stored in our managed databases and object storage is encrypted at rest by our hosting providers. Passwords are stored only as strong one-way hashes using modern algorithms, never in plain text.
  • Access control: production systems use least-privilege access, individual accounts and multi-factor authentication for administrative access. Access is granted only where there is a business need.
  • Network protection: production services sit behind Cloudflare's network protection and are reachable through controlled entry points; unnecessary ports and services are closed.
  • Monitoring and logging: we log access and security-relevant events and review them for anomalies. Logs are retained for a limited period (see the Privacy Policy).
  • Backups: data is backed up through our managed database providers, with recovery procedures tested periodically.
  • Secure development: changes to production go through review, dependencies are kept up to date, and issues found in testing or reports from researchers are triaged and fixed.

4. Organisational safeguards

  • Minimisation: we collect only the data we need for the purposes described in the Privacy Policy, and we do not use it for unrelated purposes.
  • Vendor due diligence: we choose reputable infrastructure providers and require data processing agreements or equivalent contractual commitments that limit them to processing data on our instructions.
  • Confidentiality: staff and contractors are bound by confidentiality obligations that survive the end of their engagement.
  • Access reviews: access to personal data is reviewed when roles change or people leave.
  • Secure disposal: when data reaches the end of its retention period, we delete it or irreversibly anonymise it, including at our providers where applicable.

5. Payment security

Card and Mobile Money credentials are entered on the secure, hosted checkout of our payment provider (Pesapal) and are never transmitted to or stored on Salonsphere systems. We receive only transaction confirmations and references needed to manage your booking and refunds.

6. Your own controls

  • Use a strong, unique password and keep it confidential.
  • Enable your device lock and keep your operating system up to date.
  • Review your privacy settings in the app: you can opt out of usage analytics and manage notifications.
  • You can delete your account at any time, from the app or by email.
  • If you believe your account has been compromised, email [email protected] immediately so we can help you secure it.

7. Data breaches

We maintain procedures to detect, investigate and respond to personal data breaches. If a breach occurs that is likely to result in a risk to your rights, we will:

  • take immediate steps to contain and remediate the incident;
  • notify the relevant supervisory authority (such as the PDPO in Uganda, or another competent authority as required by law) without undue delay and, where required, within 72 hours of becoming aware;
  • notify affected users promptly when the breach is likely to result in a high risk to them, describing what happened, what we are doing, and the steps they can take to protect themselves.

8. International transfers

Some of our service providers operate outside your country. Where personal data is transferred internationally, we rely on providers that offer contractual protections such as standard contractual clauses, and we assess the security practices of providers before onboarding them. Contact us for more information about the safeguards relevant to your data.

9. Compliance and audits

We track our obligations under applicable data protection law, maintain records of processing as required, and cooperate fully with supervisory authorities. Our practices and safeguards are reviewed as the service grows, and material changes are reflected on this page and in our Privacy Policy.

10. Contact

For any data protection question — including access, deletion, or security concerns — email [email protected] or write to NextHome Labs, Kampala, Uganda. See also our Privacy Policy, Terms of Service and Cookies pages.