Privacy Policy

Who we are

Kairo is run by [[BUSINESS NAME]] (ABN [[ABN]]) of [[ADDRESS]]. In this policy that's “we” and “us”. You can reach us at [[CONTACT EMAIL]].

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Two different relationships

This matters more than anything else here, so it comes first.

• Your information. If you are a salon or barbershop using Kairo, we hold your business's information and this policy covers how we treat it.
• Your clients' information. The names, contact details, appointment history and notes your business records about the people it serves. That belongs to your business. We hold it for you and on your instructions. We don't use it for our own purposes, we don't sell it, and we never market to your clients. The Data Processing Addendum sets that out in full.

If you're a client of a salon that uses Kairo and want to see, change or delete what's held about you, ask the salon. They control that record. We'll help them action it.

What we collect from you

• Business and contact details, and what we need to set up your booking page.
• Billing records — what you paid and when. Card details are handled by our payment provider; we don't store card numbers.
• What you send us when you ask for help.
• Sign-in times, IP address and browser information, kept for security and troubleshooting.

Health information in client notes

Kairo lets you record notes against a client or an appointment. In a salon those often include allergies, patch-test results and product reactions. Under the Privacy Act that's health information, and it gets stronger protection than ordinary personal information.

We don't read your client notes, except where you ask us to while helping you, or where the law requires it.

What we use information for

• Running, maintaining and supporting the service.
• Taking payment and keeping the financial records we're required to keep.
• Contacting you about your account, billing, security and changes.
• Investigating misuse and meeting legal obligations.
• Improving the software — using aggregated or de-identified information wherever that will do the job.

We don't sell personal information, and we don't use your client list to market anything to anyone.

Who else sees it

Only the providers we need to run the service, listed in Sub-processors, and only what each of them needs. We may also disclose information where the law, a court or someone's safety requires it.

Where it's held

Your data is held in Australia. Some of the providers we use may process information overseas — the sub-processors table says which and where. Where information goes overseas we take reasonable steps to see it's handled consistently with the Australian Privacy Principles.

How long we keep it

• While you're a customer — for as long as you use Kairo.
• After you stop — we keep your data for 60 days so you can ask for an export, then delete it within a further 30 days. Ask us to delete it sooner and we will.
• Financial records — five years, as Australian tax law requires.
• Backups — deleted data can sit in a backup until that backup rotates out, which takes up to 90 days.

Security

The Security Overview has the detail. No system is perfectly secure and we don't claim otherwise.

If something goes wrong

If there's a breach likely to cause serious harm, we'll notify the Office of the Australian Information Commissioner and the people affected, as the Notifiable Data Breaches scheme requires. Where it concerns your clients' data we'll tell you as soon as practicable — normally within 72 hours of confirming it — so you can meet your own obligations, and we'll help you do it.

Access, correction and complaints

To see or correct what we hold about your business, email [[CONTACT EMAIL]]. We'll respond within 30 days. If you're unhappy with how we've handled your information, tell us first and we'll try to sort it out. If you're still unhappy you can complain to the OAIC at oaic.gov.au.

Changes

We may update this policy. If a change materially affects you we'll email you at least 14 days before it takes effect. The current version is always at kairobookings.com/legal/privacy.