Privacy Policy

1. Introduction

Romeo & Juliet Beauty Lounge FZ-LLC ("we," "our," or "us") is a unisex beauty salon located in Dubai, United Arab Emirates, offering professional hair care, skin care, nail care, grooming, and related beauty services to men, women, and children. We are committed to protecting the privacy and personal data of our clients, website visitors, and mobile application users.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you interact with us through our website, web application ("WebApp"), in-salon visits, or any other communication channels. This policy is designed to comply with all applicable laws and regulations of the United Arab Emirates, including but not limited to:

• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)
• Dubai Health Authority (DHA) regulations and the DHA Policy for Health Data Protection and Confidentiality 2022
• Dubai Healthcare City (DHCC) Health Data Protection Regulation No. 7 of 2013 (HDPR), where applicable
• Department of Economic Development (DED) commercial and consumer protection requirements
• Dubai Municipality health and safety guidelines for salons, barbershops, and beauty centres
• Federal Law No. 2 of 2019 on the Use of ICT in Health Fields
• Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes

By using our services, website, or WebApp, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal data as described herein.

2. Data Controller

The data controller responsible for the processing of your personal data is:

3. Personal Data We Collect

We may collect the following categories of personal data depending on the nature of your interaction with us:

3.1 Information You Provide Directly

• Full name, gender, date of birth, and nationality
• Contact details including phone number, email address, and postal address
• Identification documents (Emirates ID, passport) as required for verification or regulatory compliance
• Payment information (credit/debit card details, transaction records) processed through secure third-party payment gateways
• Appointment and booking details, service preferences, and history
• Health-related information relevant to treatments (allergies, skin conditions, medical history, pregnancy status) as required by DHA and Dubai Municipality guidelines
• Feedback, reviews, and correspondence with our team
• Emergency contact details
• Parental or guardian consent and details when services are provided to children under the age of 18

3.2 Information Collected Automatically

• Device information (IP address, browser type, operating system, device identifiers)
• Usage data from our website and WebApp (pages visited, click patterns, session duration)
• Cookies and similar tracking technologies (see Section 10)
• Location data (if enabled on your device) to facilitate service delivery

3.3 Information from Third Parties

• Referral information from other clients or partners
• Data from social media platforms when you interact with our official accounts or use social login features
• Information from regulatory or government bodies as required by law

3.4 Sensitive Personal Data

In accordance with the PDPL and DHA regulations, we recognise that certain data constitutes sensitive personal data, including health information, biometric data, and data relating to children. We process such data only when strictly necessary for the provision of our services, with your explicit consent, and in compliance with all applicable regulatory requirements.

4. Purposes of Data Processing

We process your personal data for the following lawful purposes:

• Service Delivery: To schedule appointments, provide beauty and grooming services, and manage your account on our WebApp
• Health and Safety Compliance: To conduct patch tests, allergy assessments, and treatment consultations as mandated by DHA and Dubai Municipality guidelines
• Regulatory Compliance: To meet the requirements of DHCC, DHA, DED, and Dubai Municipality, including maintaining client records, staff health cards, and product safety documentation
• Payment Processing: To process transactions securely and maintain financial records as required by UAE commercial law
• Communication: To send appointment confirmations, reminders, service updates, and respond to your enquiries
• Marketing and Promotions: To send promotional offers, loyalty programme updates, and newsletters (with your prior consent, which you may withdraw at any time)
• Quality Improvement: To analyse service feedback, conduct internal audits, and improve our offerings
• Legal Obligations: To comply with applicable laws, respond to lawful requests from authorities, and protect our legal rights
• Security: To maintain the safety of our premises, including CCTV surveillance in common areas for the protection of clients and staff
• Child Safety: To ensure appropriate safeguards and parental consent when providing services to minors

5. Legal Basis for Processing

Under the UAE PDPL and applicable regulations, we process your personal data based on one or more of the following legal grounds:

• Consent: Where you have provided clear, informed, and voluntary consent for the processing of your data
• Contractual Necessity: Where processing is necessary for the performance of a contract to which you are a party (e.g., service bookings)
• Legal Obligation: Where processing is required to comply with applicable UAE laws and regulations, including DHA, DHCC, DED, and Dubai Municipality requirements
• Legitimate Interests: Where processing is necessary for our legitimate business interests, provided these do not override your fundamental rights and freedoms
• Vital Interests: Where processing is necessary to protect your vital interests or those of another person (e.g., medical emergencies during treatment)

6. Data Sharing and Disclosure

We do not sell, trade, or rent your personal data to third parties. We may share your data with the following categories of recipients only as necessary:

• Regulatory Authorities: DHA, DHCC, DED, Dubai Municipality, and other governmental bodies as required by law or during inspections and audits
• Service Providers: Third-party processors who assist us with payment processing, IT infrastructure, cloud hosting, appointment management systems, and marketing platforms, all bound by data processing agreements
• Professional Advisors: Legal counsel, auditors, and consultants engaged for business advisory purposes, subject to confidentiality obligations
• Law Enforcement: Where required by law, court order, or to protect the safety of our clients and staff
• Insurance Providers: In connection with claims or coverage as required

All third-party service providers are contractually obligated to implement appropriate data security measures and process your data only in accordance with our instructions and applicable law.

7. International Data Transfers

Your personal data is primarily stored and processed within the United Arab Emirates. In cases where data may be transferred outside the UAE (for instance, through the use of cloud-based services), we ensure that:

• The receiving country provides an adequate level of data protection as determined by the UAE Data Office
• Appropriate safeguards are in place, including standard contractual clauses and data processing agreements
• The transfer complies with the requirements of the PDPL and any applicable guidance from the UAE Data Office

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention periods are as follows:

• Client records and service history: Retained for a minimum of five (5) years from the date of the last service, or as required by DHA and DHCC regulations
• Health and allergy information: Retained for the duration of the client relationship plus five (5) years, in compliance with DHA health data requirements
• Financial and transaction records: Retained for a minimum of five (5) years as required by UAE commercial and tax laws
• Marketing consent records: Retained for the duration of the consent period plus one (1) year
• CCTV footage: Retained for a maximum of thirty (30) days unless required for investigation or legal proceedings
• Website and WebApp usage data: Retained for up to twenty-four (24) months

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with our data disposal procedures.

9. Your Rights

Under the UAE PDPL and applicable regulations, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you
• Right to Rectification: You may request correction of inaccurate or incomplete personal data
• Right to Erasure: You may request deletion of your personal data, subject to legal retention obligations
• Right to Restrict Processing: You may request that we limit the processing of your data in certain circumstances
• Right to Data Portability: You may request the transfer of your data to another service provider in a structured, commonly used format
• Right to Object: You may object to the processing of your data for direct marketing purposes or on grounds relating to your particular situation
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal

To exercise any of these rights, please contact us using the details provided in Section 2. We will respond to your request within thirty (30) days. We may request proof of identity before processing your request.

10. Cookies and Tracking Technologies

Our website and WebApp use cookies and similar technologies to enhance your experience, analyse usage patterns, and provide personalised content. The types of cookies we use include:

• Essential Cookies: Necessary for the functioning of our website and WebApp (e.g., session management, security features)
• Analytics Cookies: Used to understand how visitors interact with our platforms, helping us improve our services
• Marketing Cookies: Used to deliver targeted advertisements and measure campaign effectiveness (only with your consent)
• Preference Cookies: Used to remember your settings and preferences for a personalised experience

You can manage your cookie preferences through your browser settings or our cookie consent banner. Please note that disabling certain cookies may affect the functionality of our website and WebApp.

11. Data Security

We implement robust technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (SSL/TLS) and at rest
• Secure payment processing through PCI-DSS compliant third-party gateways
• Role-based access controls ensuring only authorised personnel can access personal data
• Regular security assessments, vulnerability testing, and system updates
• Staff training on data protection and confidentiality obligations
• Physical security measures at our premises, including controlled access and CCTV surveillance
• Incident response procedures for prompt detection, reporting, and remediation of data breaches

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the UAE Data Office and, where required, affected individuals in accordance with the PDPL and applicable DHA/DHCC regulations.

12. Children's Privacy

Romeo & Juliet Beauty Lounge provides services to children under the age of eighteen (18). We are committed to protecting the privacy of minors and comply with the UAE Federal Decree-Law No. 26 of 2025 on Child Digital Safety and all applicable regulations.

• We require parental or guardian consent before collecting or processing any personal data of children under the age of 18
• We collect only the minimum data necessary to provide the requested service
• We do not engage in behavioural profiling or targeted marketing directed at children
• Parents or guardians may exercise data subject rights on behalf of their children at any time

13. CCTV and Surveillance

For the safety and security of our clients, staff, and premises, we operate CCTV cameras in common areas of the salon. CCTV is not installed in private treatment rooms, changing areas, or restrooms. Appropriate signage is displayed at our premises to inform visitors of CCTV surveillance. CCTV footage is retained for a maximum of thirty (30) days and is only accessed by authorised personnel for security, investigation, or regulatory purposes.

14. Third-Party Links

Our website and WebApp may contain links to third-party websites or services. We are not responsible for the privacy practices or content of such external sites. We encourage you to review the privacy policies of any third-party sites you visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance from DHA, DHCC, DED, Dubai Municipality, or the UAE Data Office. Any material changes will be communicated through our website, WebApp, or via email. The "Effective Date" at the top of this policy indicates when it was last updated.

16. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of the United Arab Emirates, including the PDPL and all applicable emirate-level regulations. Any disputes arising from or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Dubai, United Arab Emirates.

17. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us at:

We are committed to resolving your concerns promptly and in accordance with applicable law. If you are not satisfied with our response, you have the right to lodge a complaint with the UAE Data Office.