Privacy and Cookie Notice

KZEUS Energy owns and operates this booking platform and the businesses offered through it. KZEUS Energy is the responsible party for personal information processed through the platform and is KZEUS Energy trading as Scalp Soak Haus where processing is specific to Scalp Soak Haus.

Kimberly Gareeb is the head, responsible person, and Information Officer. Contact: bookings@kimgareeb.co.za or +27 840 654 302. Physical address: Suite 127 Block D, Millennium Business Park, 19 Edison Way, Century City, Cape Town, 7441.

Depending on how you use the platform, KZEUS Energy may process your name, phone number, email address, selected services, appointment dates and times, booking notes, payment and refund status, inquiry details, venue information, uploaded hairstyle references, current hair photos, correspondence, consent choice, and technical or security data.

Technical data can include IP address, browser and device information, request timestamps, page URL and title, referral information, security signals, session or owner tokens, online identifiers, and service logs required to deliver and protect the platform.

KZEUS Energy processes personal information to create and manage bookings, take or record payments, send confirmations and reminders, respond to inquiries, prepare quotes, handle cancellations or refunds, provide customer support, prevent fraud and abuse, secure and improve the platform, maintain records, resolve disputes, and comply with applicable law.

Information is used only where the purpose requires it. Refusing information required for a requested booking, payment, security check, or inquiry may mean that specific request cannot be completed. Refusing optional Google analytics and advertising measurement has no such consequence.

Necessary technologies support the consent preference, booking cart localStorage, short-lived pending-checkout sessionStorage, authentication and scoped confirmation-owner or payment-owner cookies, Cloudflare Turnstile checks on protected forms, hosting, fraud prevention, load balancing, and security logs. Rejecting optional measurement does not affect browsing, booking, checkout, payment, confirmation, security, or authentication.

The consent choice is stored only in this browser under kg_ads_consent with choice, policy version, decision time, and expiry. Policy google-measurement-basic-v2 keeps that record for 180 days unless you change it sooner. A missing, invalid, expired, or different-version choice asks again. An earlier google-ads-basic-v1 choice is not upgraded and requires a fresh decision. No server-side consent log is created by this implementation.

Vercel Web Analytics and Speed Insights provide operational performance information under their applicable privacy design and terms. They are not Google Analytics, are not reclassified by the advertising choice, and must not receive the Scalp conversion event through this package.

With your permission, one optional Google analytics and advertising measurement choice allows the existing Google Tag Manager container GTM-P5T6LX8J to load Google Analytics 4 measurement ID G-Q13SD3EQ3H for public website use and Google Ads measurement for whether advertising led to a confirmed Scalp Soak Haus booking.

Under this Basic Consent Mode implementation, no Google collection occurs before acceptance: no Google tag, request, cookie, browser-storage artifact, iframe, or cookieless ping loads from this package. After acceptance, Google Analytics 4 public page views may measure public booking routes and history navigation; admin and login page measurement remains excluded. The confirmed-booking event uses only its stable booking-session transaction identifier.

After acceptance, Google may process online and advertising identifiers, consent state, page URL and title, referrer, browser and device details, IP-derived request information, timestamps, and other request metadata. The confirmed-booking event does not send Google your name, phone number, email address, selected service, price, notes, health information, payment details, or enhanced-conversion data.

The GA4 property may be linked to the verified Google Ads account and auto-tagging may add an advertising click identifier to landing-page URLs. Personalised advertising remains disabled. Google Signals, remarketing, Customer Match, enhanced conversions, user-provided data, and new audience collection remain disabled, and the GA4 event is not another Primary Google Ads conversion.

Supplying this optional choice is voluntary. Rejection means website use or a confirmed booking may not be measured or attributed to advertising, but it does not restrict use of the website or booking service.

Hairstyling inquiry photos are requested so Kimberly can assess the style reference, current hair condition, likely timing, and quote. Submit only images you are comfortable sharing for this purpose. Inquiry photos are not sent through the Google confirmed-booking event.

Information may be available to authorised KZEUS Energy staff and the relevant business. Service-provider categories include Vercel for hosting and operational performance, Supabase for database, authentication, and storage, PayFast for payment processing, Resend for email delivery, Cloudflare Turnstile for protected-form security, Sentry for error monitoring, Upstash for rate limiting, and Google only for optional analytics and advertising measurement after acceptance.

A provider may act as an operator processing information for KZEUS Energy or as an independent responsible party for parts of its service, depending on the processing and applicable provider terms. Professional advisers, regulators, law-enforcement bodies, or other recipients may receive information where authorised or required by law.

Some service providers and their subprocessors may process or store information outside South Africa. Where KZEUS Energy authorises such processing, the applicable provider terms, contractual safeguards, security measures, and operator arrangements must support the requirements of POPIA section 72.

Provider locations and subprocessors may change. Contact the Information Officer for current information relevant to a specific service or transfer. This notice does not claim that every provider keeps all information in South Africa.

Information is kept only while its purpose requires it, subject to legal, accounting, dispute, security, and backup needs. Booking, client, payment-status, correspondence, inquiry, photo, and technical records can have different retention periods because their purposes and legal duties differ.

Tax and accounting records are retained locally for the period required by applicable law. Browser consent choices are retained for 180 days. Provider logs, backups, payment records, email records, error reports, and optional Google measurement data follow the relevant configured retention and provider terms, then are deleted, anonymised, or made inaccessible when no longer required.

Use Cookie settings in the public footer to accept, reject, or change the optional Google analytics and advertising measurement choice at any time. Withdrawal applies without a forced reload, denies future optional measurement, and removes controllable _ga* and _gcl_* cookies plus the _gcl_ls browser-storage artifact where this browser can access them.

Withdrawal does not reverse historical processing. JavaScript cannot reliably unload already executed third-party runtime code or remove inaccessible third-party or differently scoped artifacts. Contact the Information Officer if you want help with a privacy request relating to earlier processing.

Subject to POPIA and other applicable law, you may ask to access, correct, delete, restrict, or object to processing; request information about recipients; or withdraw optional consent. KZEUS Energy may need to verify your identity and may retain information where the law permits or requires it.

Send privacy requests to bookings@kimgareeb.co.za or +27 840 654 302. You may complain to the Information Regulator South Africa using the current complaint route and forms at inforegulator.org.za if you believe your rights have been infringed.

Version 3 is effective 25 August 2026 and records the operator-approved local privacy and cookie package. It is not a claim of external legal certification. Material changes to optional purposes or policy version require a new browser choice.

The website normally displays the currently published legal page from its managed content store. This source fallback does not by itself replace an existing live published version; publication remains a separate authorised action.