Privacy Policy

1. Introduction

This Privacy Policy explains how Launch Technology (“Launch Technology”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you use welns, including the websites at welns.me, pro.welns.me, g.welns.me and my.welns.me and any related services we provide (together, the “Platform”).

We process personal data in accordance with the Nigeria Data Protection Act 2023 (the “Act”), the regulations and directives issued under it by the Nigeria Data Protection Commission (the “Commission”), and other applicable law. This Policy should be read together with our Terms of Service.

2. Who we are

welns is a booking and payments platform for beauty and wellness businesses. It is operated by Launch Technology, which is the data controller for the personal data described in this Policy, except where section 14 provides otherwise.

You may contact us about this Policy or about your personal data at welns.you@gmail.com.

3. Scope of this Policy

This Policy applies to:

1. Customers: individuals who book an appointment through the Platform, pay a deposit, hold a customer account, or are entered as a customer by a business that uses the Platform;
2. Providers: businesses that offer their services through the Platform (such as salons, studios and independent professionals), and the owners, staff members and representatives of those businesses; and
3. Visitors: anyone who visits our websites or opens a booking link.

4. Personal data we collect

4.1 Data you give us

Customers. Your first and last name, telephone number and email address; your password, if you set one (stored only in hashed form); the details of each booking you make, including the services, date, time and business; and the information you provide when you change, cancel or dispute a booking, or invite a business to the Platform.

Providers. The business name, address and location; contact details of the business and its owner; descriptions, prices and images of services; opening hours; staff names and contact details and their account credentials; links to social media profiles; and, where you request payouts, your bank account details and the identity information required to verify you, which may include your Bank Verification Number (BVN), National Identification Number (NIN) and supporting details.

4.2 Data created when you use the Platform

• Booking and account records: appointment history and status, changes, cancellations, no-show records, credit balances, disputes and their outcomes.
• Payment records: the amount, currency, reference, status and channel of each payment, and the payouts made to providers. Card and bank account details entered at checkout are collected and processed by our payment processor; we do not receive or store full card numbers.
• Usage and device data: IP address, browser and device type, pages viewed, the booking link you arrived through, and the date and time of your activity. On booking pages we use a random identifier stored in your browser to count visits to each booking link; it does not identify you by name.
• Notifications: if a provider enables browser notifications, the subscription details issued by that browser.
• Communications: records of the emails and messages we send to you and their delivery status, and any correspondence you send to us.

4.3 Data we receive from others

• Providers, who may enter your name and contact details to record a booking made in person or by telephone.
• Our payment processor, which confirms whether a payment succeeded and its amount.
• Identity verification services, which return the result of checks on a provider’s identity information.
• Google, if you choose to sign in with Google (see section 5).
• Other users, for example a customer who invites a business to join the Platform, or a person who pays a deposit on your behalf using a payment link you shared.

5. Sign in with Google

If you choose to sign in with Google, Google shares with us your name, your email address, whether Google has verified that address, and a unique identifier for your Google account. We do not receive your Google password and we do not request access to your contacts, files, calendar or any other Google data. We do not store your Google profile photograph.

We use this information only to create your welns account, to sign you in, to link your sign-in to an existing welns account held under the same verified Gmail address, and to complete your profile. We do not sell information received from Google, use it for advertising, or transfer it to others except as necessary to provide the Platform or as required by law. Our use of information received from Google complies with the Google API Services User Data Policy.

You may withdraw welns’s access at any time in your Google Account settings. Withdrawing access does not delete your welns account; to request deletion, see section 11.

6. How we use personal data and our lawful bases

We process personal data only where we have a lawful basis under the Act. We rely on the following:

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. We do not send marketing messages without your consent, and we do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

7. How we share personal data

We do not sell personal data. We share it only as follows:

1. With the provider you book. When you book, the provider receives your name, telephone number, email address and the details of your booking, so that it can deliver the service and contact you about it.
2. With people you choose. If you share a payment link, the person who opens it can see the booking details needed to pay the deposit.
3. With service providers acting for us, under contracts that require them to protect the data and use it only on our instructions: payment processing; identity verification; email, SMS and messaging delivery; cloud hosting and infrastructure; application monitoring; sign-in services (Google); and the push services operated by browser vendors.
4. With professional advisers, such as lawyers, auditors and insurers, under duties of confidentiality.
5. With authorities, where we are required to do so by law, regulation or court order, or where disclosure is necessary to protect the rights, property or safety of our users, the public or ourselves.
6. In a business transfer. If Launch Technology is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred to the successor, which will be bound by this Policy or provide equivalent protection.

8. International transfers

Some of our service providers store or process data outside Nigeria, including in the United States and the European Union. Where we transfer personal data outside Nigeria, we do so in accordance with Part VIII of the Act: to countries or organisations that the Commission recognises as providing an adequate level of protection, under contractual or other safeguards that provide such protection, or on another basis that the Act permits. You may contact us for further information about the safeguards we use.

9. How long we keep personal data

We keep personal data only for as long as it is needed for the purposes for which it was collected, including to meet legal, accounting and reporting requirements. When a retention period ends, we delete the data or irreversibly anonymise it so that it no longer identifies you. Our retention periods are:

Where you ask us to delete your account, we will delete or anonymise your personal data within thirty (30) days, except data that we are required by law to retain, such as financial records. Booking records needed for those purposes are retained with your identifying details removed. We may retain data for longer where it is needed to establish, exercise or defend a legal claim, or where the law requires it.

10. Security

We use technical and organisational measures appropriate to the risk to protect personal data, including encryption of data in transit, hashing of passwords, encryption of sensitive identity information, access controls limiting staff access to what their role requires, and monitoring of our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Commission within seventy-two (72) hours of becoming aware of it, and we will inform you without undue delay where the breach is likely to result in a high risk to you, as the Act requires.

11. Your rights

Subject to the conditions and exceptions in the Act, you have the right to:

1. be informed about how your personal data is processed;
2. obtain a copy of the personal data we hold about you;
3. have inaccurate or incomplete personal data corrected;
4. have your personal data erased;
5. restrict the processing of your personal data;
6. object to processing based on our legitimate interests;
7. receive your personal data in a commonly used, machine-readable format, and have it transmitted to another controller;
8. withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
9. not be subject to a decision based solely on automated processing that produces legal or similarly significant effects concerning you.

You can update your name, telephone number, email address and password in your account at any time. To exercise any other right, email us at welns.you@gmail.com from the email address linked to your account. We may need to verify your identity before acting on a request. We will respond within thirty (30) days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng).

12. Cookies and similar technologies

We use only the cookies and browser storage needed to run the Platform. We do not use advertising cookies.

• Session cookie (wlns_session): keeps you signed in across welns.me sites for up to ninety (90) days, or until you sign out. It is strictly necessary.
• Browser storage: remembers a booking in progress and your most recent booking reference so that you can return to it; a random visit identifier used to count visits to booking links; the campaign or invitation that brought you to the sign-up page, for thirty (30) days; and your display preferences, such as light or dark mode.
• Google: if you use Sign in with Google, Google sets its own cookies under the Google Privacy Policy.

You can delete cookies and browser storage in your browser settings. If you block the session cookie, you will not be able to stay signed in.

13. Children

The Platform is not directed at children under the age of eighteen (18), and they may not open an account. A parent or guardian may book a service on behalf of a child, in which case the parent or guardian provides the information and remains responsible for the booking. If we learn that we have collected personal data from a child without the consent of a parent or guardian, we will delete it.

14. Providers and their own use of data

Providers are independent businesses. When a provider receives your personal data through a booking, the provider uses it to deliver its service and is responsible, as a separate controller, for its own use of that data. Where a provider records customer information on the Platform for its own business purposes, such as a booking taken by telephone, we process that information on the provider’s behalf and in accordance with its instructions. Questions about how a provider uses your data should be directed to that provider; we will assist where we can.

15. Changes to this Policy

We may update this Policy from time to time. The effective date at the top of this page shows when it was last changed. If we make a material change, we will notify you by email or through the Platform before the change takes effect.

16. Contact us

Launch Technology
Email: welns.you@gmail.com