Last updated 22 September 2026
O+ Connect is the booking and point-of-sale system used by ORO Aesthetics, The Nut Box and Trendy Uniforms. This policy explains what personal information the system holds about clients, why it holds it, and what you can ask us to do with it.
It is written to meet our obligations under South Africa's Protection of Personal Information Act, 2013 (POPIA).
The responsible party is ORO Aesthetics, 9 On Windmill Road, Musgrave, Durban, South Africa. You can reach us on WhatsApp at 078 593 7747 or on Instagram at @oro_aesthetics.
| What | When | Why |
|---|---|---|
| Your first name and surname | When you book an appointment in advance | So we know whose appointment it is and can greet you properly |
| Your telephone number | When you book an appointment in advance | To contact you about your booking, and to recognise you as a returning client so you do not have to give your details again |
| Which treatment, when, and how long | Each booking | To run the diary and avoid double-booking |
| What was bought and what was paid | Each sale | To keep accurate financial records, as the law requires of us |
We do not collect or store your identity number, your address, your email address, or any card or banking details. When you pay by card, that happens on the card machine and its records stay with the bank — our system only records that the payment method was a card.
Walk-in sales, including everything sold by The Nut Box and Trendy Uniforms, are recorded without any personal information at all.
A record of which treatments you have had is kept alongside your name and number. Under POPIA this sits close to health information, which the Act treats more strictly than ordinary personal information. We keep it only so that we can give you appropriate care on a return visit, and it is not used for anything else.
Your information is stored in a database on a computer at the business premises. It is not stored on a public website and is not accessible from the internet. Backups are kept so that records are not lost, and those backups are stored in the same manner.
Appointments are copied to a private Google Calendar so that the owner and the therapist can see the day's bookings on their phones. Depending on how the system is configured, the calendar entry may contain your name and telephone number alongside the treatment and time.
This means Google processes that information on our behalf as an operator. The calendar is private and shared only with the people who run the business. Google's own handling of the data is covered by the Google Privacy Policy. If you would prefer your name not to appear in the calendar, tell us and we will switch that off for you.
Only the owner and the staff who need it to do their work. We do not sell your information, we do not rent it out, and we do not share it for advertising. It is disclosed to anyone else only where the law requires it — for example to our accountant or to SARS, where a sales record is needed for tax purposes.
Financial records are kept for five years, which is what South African tax law requires. Client and booking details are kept for as long as you remain a client, and are removed on request at any time.
Under POPIA you may ask us to:
Ask on WhatsApp at 078 593 7747 and we will deal with it. There is no charge. We may need to keep a sales record even after deleting your personal details, because the law requires us to keep the financial record — in that case the sale stays but your name and number come off it.
If you are not satisfied with how we have handled your information, you may complain to the Information Regulator of South Africa at inforegulator.org.za.
The computer holding your information is password protected, and staff access the system only on devices belonging to the business. Access to the financial records and the price list is restricted to the owner; staff devices can take bookings and payments but cannot see the books.
If this policy changes we will update this page and change the date at the top.