Crystal Beauty Lounge FZCO, of Unit F113, Red Diamond Building, Jumeirah Lakes Towers, Dubai, United Arab Emirates, is the data controller responsible for the personal data described in this policy.

This policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and what rights you have. It applies to our website (crystalbeautyjlt.ae), our salon, our booking system, and our messaging and marketing channels.

We handle personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and other applicable United Arab Emirates law.

• Directly from you when you book, complete a consultation or consent form, visit the salon, message us, or buy a product.
• Automatically when you use our website, through cookies and similar technologies.
• From our booking system, payment providers, and messaging platform when you interact with them.
• From third parties such as review platforms, referral partners, or a person purchasing a gift voucher for you.

Some of the data we hold, such as health information on your consultation and consent forms, is sensitive personal data. We collect it only where it is necessary to deliver a treatment safely, we collect it with your explicit consent, we limit access to the team members who need it, and we do not use it for marketing.

We send marketing messages only where you have given consent. Every marketing message includes a way to stop receiving them. You can also opt out at any time by replying STOP to a WhatsApp or SMS message, by emailing hello@crystalbeautyjlt.ae, or by telling any member of our team.

Opting out of marketing does not stop service messages such as appointment confirmations, reminders, and changes to your booking.

We maintain an opt out register. When we change or upgrade a messaging or booking platform, opt out records are carried across so that your preference continues to be respected.

Our website uses cookies and similar technologies to make the site work, to remember your preferences, to measure how the site is used, and to support advertising. Strictly necessary cookies are required for the site to function. All other cookies are set only with your consent, which you give through the cookie banner when you first visit.

You can change or withdraw your cookie consent at any time through the cookie settings on the website or through your browser settings. Blocking some cookies may affect how the site works.

We do not sell your personal data. We share it only where necessary, and only with parties who are required to protect it:

• Our booking and client management software provider, which hosts appointment and client records.
• Our messaging platform provider, which delivers WhatsApp and SMS communications.
• Payment providers and banks, which process card, digital, and instalment payments.
• Our accountants, auditors, tax advisers, and insurers.
• Our marketing agency, for campaign delivery and website support, under written confidentiality terms.
• Professional advisers, including lawyers, where necessary to establish or defend a legal claim.
• Government authorities and regulators, including the Federal Tax Authority and the Dubai Multi Commodities Centre Authority, where we are required to do so by law.
• A prospective purchaser or their advisers, in the event of a sale, merger, or reorganisation of the business, subject to confidentiality terms and only to the extent necessary for that transaction.

Some of our service providers store or process data outside the United Arab Emirates. Where personal data is transferred outside the country, we take steps to ensure an adequate level of protection, including contractual safeguards with the provider, in line with the requirements of Federal Decree-Law No. 45 of 2021.

• Access to client records is limited to team members who need it for their role.
• Systems are protected by individual user accounts and passwords.
• Paper consultation and consent forms are stored in a locked location and are digitised where possible.
• Team members sign confidentiality terms as part of their employment or service agreement.
• Payment card data is handled by regulated payment providers and is not stored on our systems.
• We review access rights when a team member joins or leaves.

Under Federal Decree-Law No. 45 of 2021, you have the right to:

• Be informed about how your personal data is used.
• Request a copy of the personal data we hold about you.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to delete your data, where we are not required to keep it by law.
• Ask us to restrict or stop certain processing.
• Object to processing based on our legitimate interests.
• Request that your data be transferred to you or to another provider in a structured, machine readable format.
• Withdraw your consent at any time, without affecting processing carried out before the withdrawal.
• Complain to the competent United Arab Emirates data protection authority.

Write to hello@crystalbeautyjlt.ae with the subject line "Data Request", or speak to our reception team. We may ask you to confirm your identity before we act on a request. We respond within 30 days. If a request is complex, we will tell you and explain the expected timeframe. There is no charge for a reasonable request.

CCTV operates in the reception, corridor, and back of house areas of the salon for the safety and security of clients, team members, and property. Signage is displayed at the entrance. Cameras are not installed in treatment rooms, changing areas, or bathrooms. Footage is accessed only by the owners and is shared only with the police, insurers, or legal advisers where necessary.

We do not knowingly collect personal data from anyone under 18 without the consent of a parent or legal guardian. Where a service is provided to a minor, the parent or guardian completes and signs the consultation and consent form and provides the contact details we hold.

We may update this policy. The current version is always published on our website with the effective date shown at the top. Where a change is significant, we will tell you directly.

Email: hello@crystalbeautyjlt.ae
Telephone and WhatsApp: +971 56 526 2977
Address: Unit F113, Red Diamond Building, Jumeirah Lakes Towers, Dubai, UAE

This policy is published in English and Arabic. In the event of any inconsistency between the two versions, the Arabic version prevails.