Effective / last updated: 1 November 2026

1. Who we are

THE ONE HAIR (“we”, “us” or “our”) operates this website and provides salon, bridal-enquiry and, where available, online-shop services. THE ONE HAIR is the business responsible for personal data processed through this website and these services.

Our salon location is Lavington Mall, 5th Floor, Nairobi, Kenya. For privacy questions or requests, contact us at admin@onehair.africa.

2. Personal data we may collect

• Salon appointment requests: your name, email address, phone number, selected service, requested date and time, booking reference and status, appointment-related messages, and any notes you choose to provide.
• Booking-fee records: the fee amount and payment status, plus the M-Pesa receipt or transaction code you enter. Staff review the code against payment records; the code you submit is not, by itself, proof that payment was received.
• Bridal enquiries: your contact details, event date, venue or area, party size, services being considered and any enquiry notes.
• Service communications: whether you opted in to WhatsApp appointment reminders, and records needed to send or administer appointment-related messages.
• Shop orders, if WooCommerce checkout is enabled: account details if you create an account, contact details, billing and delivery information, products ordered, order and fulfilment status, and payment-related references or status supplied by the checkout provider. The exact payment and delivery providers must be identified in the completed notice.
• Website and security information: technical details that may be recorded by the website or hosting/security services, such as IP address, browser/device information, request time and security-event logs.
• Cookie and consent preferences: choices recorded through CookieAdmin and essential site functions such as login, security or a shopping cart, where those functions are used.

Please do not place passwords, M-Pesa PINs, payment-card security codes, medical details or other sensitive information in appointment or enquiry notes. We do not ask you to send an M-Pesa PIN or password.

3. Why we use your information

We use personal data only for specific, lawful purposes. The intended uses for this website are:

• to receive, assess and respond to salon appointment and bridal enquiries, contact you about the request, and maintain the booking record;
• to check the M-Pesa booking-fee receipt manually, administer the booking and apply the fee toward the final salon-service total when the appointment proceeds;
• to manage and fulfil shop orders, customer support, delivery and any returns or order-related obligations, if the shop is operating;
• to send service-related email updates and reminders, and to send WhatsApp appointment messages only where you have opted in and the WhatsApp service is configured;
• to operate, protect and troubleshoot the website, prevent misuse, and maintain appropriate business, accounting and legal records; and
• to remember your consent choices and operate essential site functions.

Lawful basis: We process information when necessary to take steps at your request before a salon-service or shop-order contract, or to perform that contract; to meet legal, accounting or tax obligations; with your consent for optional WhatsApp reminders or non-essential cookies; or, where permitted, for our legitimate interests in operating and securing the website and preventing misuse, provided those interests do not override your rights.

4. Salon booking fees and appointment decisions

A salon appointment request requires a KES 1,000 booking fee per service. The fee is credited toward the final service total. You enter the receipt code from your M-Pesa confirmation message; staff verify it manually. This website does not connect to M-Pesa for automatic payment verification. A request remains pending until staff verify the payment and confirm an available appointment time after checking the booking calendar. Submitting a request or receipt code does not guarantee an appointment.

Bridal form submissions are enquiries for staff review. The salon booking fee is not collected at the bridal-enquiry stage. The booking calendar automatically displays slots using the configured services, hours and existing bookings; staff review requests and make the final appointment-confirmation decision.

5. Cookies and similar technologies

We use CookieAdmin to present and manage cookie-consent choices. WordPress and WooCommerce may use essential cookies or similar storage for security, login sessions, consent preferences, shopping-cart or checkout operation. The site may also use optional cookies only where the relevant services are enabled and in line with consent choices. [Add the current CookieAdmin scan: cookie name, service/provider, category, purpose and expiry. Remove categories or services that are not actually used.]

Use the CookieAdmin controls shown on the site to review or change available consent choices. Optional cookies should only operate in accordance with the consent choices and applicable requirements.

6. Who may receive personal data

Access is limited to staff who need the information to manage the service. We may share relevant information, only as needed for the purposes above or as permitted by law, with these categories of recipients:

• website hosting, database, backup, technical-support and security providers;
• email delivery providers used for appointment, order and staff messages;
• WooCommerce checkout/payment providers and delivery or fulfilment providers, if the shop is enabled;
• analytics, advertising, social-media or customer-management providers only if those services are active and configured on the website;
• Meta/WhatsApp, only if the official messaging integration is enabled and you opted in, for the contact details and message content needed to deliver appointment-related messages; and
• courts, regulators, law-enforcement bodies or professional advisers where disclosure is required or lawfully necessary.

We do not need your M-Pesa PIN or account password for booking-fee verification. The specific providers depend on the services active on the website; their current names and locations must be checked against the live setup.

7. Processing outside Kenya

Some hosting, email, payment, backup or messaging providers may process information outside Kenya. The location depends on the services active on the website. We will only transfer personal data outside Kenya where the transfer is permitted by applicable Kenyan data-protection law and the required safeguards or other lawful conditions are in place.

8. How long we keep information

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected. Under the approved schedule, we apply these periods, then delete or anonymise information when it is no longer required:

• Appointment and client details: 24 months after the last appointment or client contact, then delete or anonymise them, unless an active dispute or legal obligation requires relevant records to be retained longer.
• Bridal enquiries that do not become bookings: 12 months after the last contact, then delete them unless an active matter or legal obligation requires otherwise.
• M-Pesa receipt references and financial/tax records: five years from the end of the relevant tax period, or longer where required for an audit, dispute or other legal obligation. We retain only the financial information needed for that purpose.
• WooCommerce orders: tax/accounting records for five years or longer if required; other customer/order details for 24 months after the last order or contact, unless an open order, dispute or legal obligation requires relevant details to be kept longer.
• Website and security logs: up to 90 days. Backups: a rolling period of up to 30 days, after which backups are overwritten or deleted.

Where information must remain in a booking or accounting record for a longer period, we restrict it to what is needed and anonymise or remove direct contact details when appropriate. These periods are subject to implementation in the booking, hosting and backup systems.

9. Keeping information secure

We use appropriate technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse or disclosure. Access to booking and order information should be limited to authorised accounts and kept under review. No website or electronic transmission can be guaranteed completely secure.

10. Your data-protection rights

Under the Kenya Data Protection Act, 2019, and subject to applicable conditions and exceptions, you may ask to be informed about the use of your data, access it, correct inaccurate or misleading information, object to processing, or request deletion where the law permits. Where processing relies on consent, you may withdraw that consent; withdrawal does not affect processing already carried out lawfully. You may also exercise any other rights available to you under applicable law, including data portability where it applies.

To make a request, email admin@onehair.africa with the subject “Privacy request”. We may ask for reasonable information to confirm your identity and locate the relevant records. We will handle requests within the time and manner required by law. Some information may need to be retained where a legal obligation or other lawful exception applies.

If you are not satisfied with our response, you may contact the Office of the Data Protection Commissioner (ODPC). The ODPC lists complaint@odpc.go.ke for complaints.

11. Changes to this notice

We may update this notice when our services, website technologies, suppliers or legal obligations change. The current version will be published on this page with its effective or last-updated date.

Legal reference: Kenya Data Protection Act, 2019 · ODPC summary of data-subject rights.