Personal Data Protection Notice

1. Roles under the PDPA

For personal data belonging to a salon's own clients, the salon is the data user and Nolira acts as a data processor under a written contract. For data about our own account holders, prospects and website visitors, Nolira is the data user.

2. Personal data we process

• Account holders: name, work email, phone number, role and branch assignment.
• Salon clients, on the salon's instruction: name, phone number, email, preferred language, appointment and visit history, payment and package records, service notes and, where consented, treatment photographs.

3. Purposes

• Providing the booking, point of sale and operations service.
• Sending transactional messages such as confirmations and reminders.
• Maintaining financial, tax and audit records.
• Securing the service and investigating misuse.
• Responding to enquiries and providing support.

4. Sensitive personal data

Allergy and sensitivity notes may constitute sensitive personal data under the PDPA. Where a salon records such information in Nolira, the salon is responsible for obtaining the explicit consent the Act requires. Nolira provides the technical controls: role-based access, access logging, exclusion from analytics, and restricted export.

Nolira is not a medical records system. Diagnoses, prescriptions and clinical assessments must not be stored in it.

5. Disclosure

Personal data may be disclosed to the service providers necessary to operate the platform, listed on our subprocessors page. Each is bound by contract to process data only on our instruction. We do not sell personal data and do not disclose it for third-party marketing.

6. Transfers outside Malaysia

Data is primarily hosted in a region close to Malaysia and Singapore. Where a service provider operates outside Malaysia, we rely on contractual safeguards requiring protection comparable to that afforded under the PDPA. The current hosting region for your organisation is available on request.

7. Retention

Personal data is retained only as long as necessary for the purpose it was collected, or as required by financial and tax law. Retention differs by category, and sensitive notes and photographs follow the shortest retention consistent with the service.

8. Your rights

Under the PDPA you may:

• Request access to your personal data.
• Request correction of inaccurate or incomplete data.
• Withdraw consent, where processing relies on consent.
• Limit processing for direct marketing purposes.

Where the data belongs to a salon's client, the request is directed to that salon as the data user, and Nolira supports them in responding. A fee may apply to data access requests as permitted by the Act.

9. Consequences of not providing data

Some data is necessary to deliver the service. Without a contact number a booking confirmation cannot be sent, and without a customer record a package balance cannot be tracked. Optional fields such as birthday are clearly optional.

10. Contact

Requests and enquiries under this notice: hello@nolira.my.

11. Language

This notice is issued in English. A Bahasa Melayu version will be made available, and in the event of any inconsistency the Bahasa Melayu version will prevail, as required under section 7(3) of the Act.