Privacy Policy

Who we are

This policy applies to COLAB Hair (ABN 30 504 889 845), based in Melbourne, Victoria, Australia (“we”, “us”, “our”). It covers our website at www.colab.hair and the services we provide to clients.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We also follow the Spam Act 2003 (Cth) when sending marketing messages.

What we collect

The information we collect depends on how you deal with us. It may include:

• Contact details: your name, email address, phone number and postal address.
• Booking details: appointment dates and times, the service you booked, and any notes you give us when booking.
• Payment details: the amount paid, payment status and the last four digits and brand of your card. We do not see or store your full card number (see Stripe below).
• Client records: notes about your appointments and the services we provide to you,including health or wellbeing information you choose to share.
• Communications: emails, messages and enquiries you send us, and your email preferences.
• Website data: your IP address, browser type, device, pages visited, referring site and the time of your visit.

How we collect it

• Directly from you, when you book, pay, fill in a form, subscribe to our emails, or contact us.
• Automatically, through your use of our website, including cookies and similar technologies.
• From the service providers listed below, for example when a payment is processed or an email is delivered or opened.

If you give us information about another person, please make sure they know and are happy for you to do so.

Why we use it

We use your personal information to:

• book, manage and deliver your appointments, and send reminders and follow-ups;
• process payments and issue receipts and refunds;
• keep accurate client records and meet our legal, tax and professional obligations;
• respond to your questions and requests;
• send you news, offers and updates, where you have agreed to receive them;
• understand how our website and business are performing, and improve them;
• protect our business and website from fraud, misuse and security threats.

We only use or disclose your information for the purpose we collected it, for a related purpose you would reasonably expect, with your consent, or where the law requires or allows it.

Services we use

We share personal information with trusted providers who help us run the business. They may only use it to provide their service to us, and each has its own privacy policy.

We may also disclose information to our professional advisers (such as accountants and lawyers), insurers, and government bodies or courts where required by law. We do not sell your personal information.

How we use AI tools

We use large language model (LLM) AI tools to help us review and understand how our business is running and to make improvements, for example by looking at trends in enquiries, bookings, feedback and website performance, and by drafting or refining our content.

When we do this:

• we aim to use de-identified or summarised information, and we do not intentionally enter client names, contact details, payment details or appointment or health notes into AI tools;
• we do not use AI tools to make decisions about you that have a legal or similarly significant effect, and a person reviews AI-assisted output before we act on it;
• we choose tools and settings that, as far as we can control, do not use our inputs to train the provider’s public models.

AI providers may process data on servers outside Australia (see “Overseas storage” below). If you have concerns about this, contact us.

Cookies and similar technologies

Cookies are small files stored on your device when you visit a website. We may use them to make our site work, to understand how it is used, and to support our marketing, including measuring campaigns and showing relevant ads or content.

Types we may use

• Essential: needed for the site and booking and payment features to work.
• Analytics: tell us how visitors use the site so we can improve it.
• Marketing: help us measure the success of our campaigns and, if we run ads, show them to people who have visited our site. These may be set by third parties such as Meta, Google, MailerLite.

Your choices

You can accept or decline non-essential cookies using our cookie banner , and you can block or delete cookies in your browser settings. Blocking some cookies may affect how parts of the site work. Third parties that set marketing cookies may collect information about your activity across other sites, and are responsible for their own use of it.

Marketing emails

We send newsletters and promotional emails only to people who have subscribed or otherwise agreed to receive them, or where the law allows us to contact existing clients about similar services. Every email includes an unsubscribe link, and we action unsubscribe requests promptly and within five working days.

MailerLite tracks whether emails are opened and links are clicked so we can see what is useful. You can unsubscribe at any time, or ask us to delete your details, by contacting us.

Overseas storage

Some of our providers store or process data outside Australia. Stripe, MailerLite and AI tool providers may handle information in countries including the United States and the European Union. Namecheap operates internationally and may process website data outside Australia. Client Diary stores all data in their encrypted servers in Melbourne and Sydney

Before we disclose your information overseas, we take reasonable steps to make sure the recipient handles it in a way consistent with the APPs. By giving us your information and using our services, you understand that some of your information may be stored or processed overseas.

Security and retention

We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access or disclosure. These include password-protected and access-limited systems, multi-factor authentication where available, and using reputable providers.

We keep personal information only as long as we need it for the reasons described above or as the law requires. For example, financial records are generally kept for at least five years, and client records are kept for at least seven years, or until a minor turns 25, if you provide health services in Victoria. When information is no longer needed, we securely destroy or de-identify it.

If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

Your rights

You can ask us to:

• give you access to the personal information we hold about you;
• correct information that is inaccurate, out of date or incomplete;
• delete your information, where we are not required to keep it;
• stop sending you marketing, or stop using your information for marketing.

We will respond within a reasonable time, usually within 30 days. We may need to verify your identity first. In limited cases the law allows us to refuse access, and if we do, we will explain why in writing.

You also have the option of dealing with us anonymously or using a pseudonym where that is lawful and practical, though this will not be possible for bookings and payments.

Complaints

If you think we have breached the APPs or mishandled your information, please contact us first so we can try to fix it. We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

Changes to this policy

We may update this policy from time to time, for example when our services or the law change. The latest version will always be on this page with its updated date at the top.

Contact us

For privacy questions, requests or complaints: