Last updated: 7 October 2026
This Privacy Policy explains how Facial Bar MedSpa & Salon (“Facial Bar”, “we”, “us”) collects, uses and protects your personal data when you visit www.facialbaronline.com, book with us online, contact us, or message us on WhatsApp. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the guidance of the Nigeria Data Protection Commission (NDPC).
1. Who we are
Facial Bar MedSpa & Salon is the data controller for the personal data described in this policy.
Address: 1 Kofo Abayomi Street, Victoria Island, Lagos, Nigeria
Email for privacy matters: facialbaronline@gmail.com
2. What personal data we collect
Booking form
When you book online we collect your first and last name, phone/WhatsApp number, email address (optional) and the services you are interested in.
Contact forms and email
When you contact us through a form on the website or by email we collect your name, contact details and anything you choose to include in your message.
Our “WhatsApp” buttons open a chat with us in WhatsApp. We do not receive any data from the website when you click. If you send us a message, we receive your WhatsApp name, phone number and the content of your messages. WhatsApp is operated by WhatsApp LLC / Meta under its own privacy policy.
Online shop and gift cards
If you buy products or gift cards on the website we collect your name, billing and delivery details, email, phone number and order details. Card payments are handled by Paystack; we do not see or store your full card details.
Treatment information
Our website forms do not ask for health information. If you choose to share health or skin-condition details with us (for example on WhatsApp or during a consultation), we treat them as sensitive personal data and use them only to provide safe, suitable treatment.
Data collected automatically
When you visit the website we and our service providers collect technical data such as your IP address, device and browser type, pages viewed, the page that referred you, and approximate location. This is collected through cookies and similar technologies (see section 6).
3. How we use your data and our lawful basis
- To manage your booking and respond to enquiries: confirming appointments, contacting you about your booking and answering questions. Lawful basis: taking steps at your request before providing a service, and performing our contract with you.
- To process shop and gift card orders: payment, delivery and customer service. Lawful basis: performing our contract with you.
- To provide safe treatment: using any health details you share. Lawful basis: your explicit consent.
- To understand and improve the website: through Google Analytics. Lawful basis: your consent where required, and our legitimate interest in running a useful website.
- To measure our advertising: through Google Ads, for example counting how many people book or message us after seeing an ad. Lawful basis: your consent where required, and our legitimate interest in understanding which advertising works.
- To keep records and meet legal obligations: tax, accounting and regulatory requirements. Lawful basis: legal obligation.
We do not sell your personal data, and we do not send you marketing messages unless you have agreed to receive them. You can opt out at any time.
4. Who receives your data
- Our team: booking and contact form submissions are emailed to Facial Bar management and front-desk staff so they can respond to you.
- Service providers who process data for us: our website hosting provider, our email delivery service, Google (Analytics, Ads, Maps and Workspace/Gmail), Paystack (payments) and WhatsApp/Meta (messaging).
- Authorities where the law requires it.
We require our service providers to keep your data secure and to use it only for the purposes we set.
5. International transfers
Some of our service providers (such as Google and Meta) store data on servers outside Nigeria, including in the United States and the European Union. Where this happens we rely on the safeguards permitted by the NDPA, such as the provider’s contractual data protection commitments, or, where appropriate, your consent.
6. Cookies and similar technologies
Cookies are small files stored on your device. We use:
- Essential cookies: needed for the site to work, for example to remember your shopping cart (WooCommerce).
- Analytics cookies: Google Analytics (for example
_gaand_ga_*) to understand how visitors use the site. These collect data in aggregate. - Advertising cookies: Google Ads (for example
_gcl_au) to measure bookings, calls and WhatsApp clicks that come from our ads. - Visit-source cookies: WooCommerce order attribution (
sbjs_*) records how you arrived at the site if you place an order.
Some pages show embedded content from Google Maps, Instagram and X (Twitter). These services may set their own cookies under their own privacy policies.
You can block or delete cookies in your browser settings. You can also opt out of Google Analytics with Google’s browser add-on and manage ad personalisation in your Google account settings. Blocking essential cookies may stop parts of the site (such as the cart) from working.
7. How long we keep your data
- Booking and enquiry records: up to 2 years after your last contact with us.
- Customer account, order, payment and accounting records: 6 years, as required for tax and accounting.
- Health details you share with us: only as long as needed for your care, then deleted.
- Analytics data: according to the retention settings in Google Analytics (no longer than 14 months).
After these periods we delete or anonymise the data.
8. How we protect your data
The website uses encrypted connections (HTTPS). Access to booking data, email and the website’s administration area is limited to authorised staff. If a personal data breach puts your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it and, where required, inform you without delay.
9. Your rights
Under the NDPA you have the right to:
- be informed about how we use your data;
- access a copy of your personal data;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use your data;
- receive your data in a portable format;
- object to processing, including for direct marketing;
- withdraw consent at any time, without affecting processing that took place before you withdrew it.
To use any of these rights, email facialbaronline@gmail.com. We will respond within 30 days and may need to confirm your identity first. If you are unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
10. Children
The website is not intended for anyone under 18. We do not knowingly collect personal data from children online. Treatments for minors are arranged in person with a parent or guardian.
11. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.
12. Contact us
Facial Bar MedSpa & Salon, 1 Kofo Abayomi Street, Victoria Island, Lagos
Email: facialbaronline@gmail.com