Privacy Policy

1. Who is responsible for your data

The data controller is OPERA ENGINEERING FZ-LLC, RAKEZ, UAE trade licence no. FXMB0229, tax registration number (TRN) 104305889800003, registered at Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. Services are delivered at Unique Persona, Dubai. For any data-related question, write to hello@ele-bos.com.

This policy is based on UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). At the time of publication the executive regulations under the law have not yet been issued: this text states current practice under the law itself and will be updated when they come into force.

2. What data is collected

• Name and contact details (phone number, WhatsApp name, e-mail where relevant) when you message on WhatsApp or book through the sonline online-booking widget.
• Service details: the treatment requested, appointment date and time, preferences and notes about your colour history that you share yourself.
• Technical data — IP address, device and browser type, pages viewed, referring source — if analytics is enabled and you have consented to it.
• Photographs of your hair are published only with your separate consent.

No special categories of data are collected. If you disclose a health condition or allergy that matters for the safety of a treatment, it is used only to deliver the service.

3. Purposes and lawful basis

• Booking, confirming and reminding you of an appointment — performance of the service contract.
• Replying to your WhatsApp and e-mail messages — your consent, given by contacting us.
• Keeping a client history (colour formulas, treatments performed) — legitimate interest in a safe and predictable result.
• Website analytics and marketing material — your consent only, which you may withdraw at any time.
• Accounting and compliance with UAE law, including VAT — compliance with a legal obligation.

4. This site and third-party platforms

The site has no forms, accounts or sign-up: it asks nothing of you. Booking and messaging happen on third-party platforms — WhatsApp (Meta Platforms), the sonline booking widget, and the Unique Persona salon where services are delivered. Those platforms process data under their own policies and act as independent controllers for their own activities.

Before messaging or booking, we recommend reading those services' policies. We do not control their settings and receive no more data from them than is needed for the appointment.

5. Cross-border transfers

The providers listed above may process data on servers outside the UAE. Such transfers are made in line with the PDPL: to jurisdictions with an adequate level of protection, or on the basis of contractual safeguards or your explicit consent where the law requires it. Only the minimum necessary data is transferred.

6. Retention periods

• WhatsApp and e-mail correspondence: typically 12–24 months from the last contact.
• Appointment history and colour formulas: typically 24–36 months from the last visit.
• Financial and tax records: for the period required by UAE law (usually at least 5 years).
• Analytics data: typically 14–26 months, in anonymised or aggregated form.

7. Your rights under the PDPL

• access your data and obtain a copy of it;
• have inaccurate or incomplete data corrected;
• request erasure of your data;
• restrict processing;
• receive your data in a portable format;
• object to processing, including automated processing;
• withdraw consent at any time, without affecting services already provided;
• lodge a complaint with the UAE Data Office.

Send your request to hello@ele-bos.com. We respond within 30 days of receipt; for complex requests we will tell you if more time is needed. We may ask for additional details to verify your identity.

8. Security

The site is served over HTTPS. Access to messages and client notes is limited to devices protected by passwords and two-factor authentication, and data is shared only with those who need it to deliver the service. In the event of a breach likely to harm you, we will notify you and the competent authority within the timeframes set by the PDPL.

9. Children's data

Services for minors are provided only with a parent or legal guardian present, and it is the guardian who provides the necessary data. The site is not intended for independent use by children.

10. Changes to this policy

The current version is always published on this page with its update date. Material changes are announced on the site's home page and, where appropriate, at your next contact with us.