Privacy Policy

1. Who we are

This website is operated by , a company registered in the United Kingdom under company number , with its registered office at . We trade as .

We are the data controller for the personal data described in this policy. For any question about privacy, or to exercise your rights, write to .

We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data we collect

Enquiry and booking details

When you contact us to arrange a consultation we collect your name, email address, telephone number if you provide one, and the description you give of your hair and what you would like to change.

Consultation information

To prepare and deliver the session we collect information such as your colour and treatment history, heat styling and washing habits, the products you currently use, and the notes and recommendations produced during and after the consultation.

Photographs

You may choose to send photographs of your hair. This is entirely optional and a consultation can be delivered without them. Photographs and written descriptions are used solely to prepare and deliver your consultation, are kept for a limited period and are not shared with third parties beyond the service providers listed in section 4.

Health data

We do not request, and ask you not to send, medical or other special category data. Our consultations are cosmetic; we do not diagnose or treat any condition. If you send health information anyway, we will not rely on it and will delete it once we have responded to you.

Technical data

Our hosting provider records standard server log information such as IP address, browser type and the time of your request. This site does not use analytics or advertising tools.

We do not buy personal data from third parties and we do not build marketing profiles.

3. Purposes and lawful bases

• Answering enquiries and arranging sessions — to take steps at your request before entering into a contract, and to perform that contract once a consultation is booked (Article 6(1)(b) UK GDPR).
• Delivering the consultation and written recommendations — performance of our contract with you (Article 6(1)(b)).
• Reviewing optional photographs — your consent, given when you choose to send them (Article 6(1)(a)). You can withdraw that consent at any time.
• Keeping the website available and secure, and preventing misuse — our legitimate interests in running a functioning and secure service (Article 6(1)(f)).
• Keeping accounting and tax records, and responding to lawful requests — compliance with our legal obligations (Article 6(1)(c)).

Where we rely on legitimate interests, we have considered the effect on you and limited the data used to what is necessary. You can object to that processing at any time (see section 9).

4. Sharing with others

We do not sell personal data and we do not share it for anyone else's marketing. We share it only with service providers who process it on our instructions:

• our website hosting provider, which stores the site and its server logs;
• our email provider, through which enquiries and written recommendations are sent and stored;
• the video platform used to run consultations, which handles the call itself;
• our payment provider, which processes payment for a session and holds the transaction record. Card details are handled by the provider and never reach us;
• our accountant, and professional or legal advisers, where this is necessary.

Each provider acts under a written agreement that limits use of the data to the service they supply. We may also disclose data where the law requires it, or to establish, exercise or defend legal claims.

5. International transfers

Some of our providers operate servers outside the United Kingdom. Where personal data is transferred abroad, we rely on UK adequacy regulations for the destination country, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards needed in the circumstances. You can ask us which providers are involved and which safeguard applies by writing to the address in section 1.

6. How long we keep data

• Enquiries that do not lead to a booking: up to 12 months from the last message, then deleted.
• Consultation notes and written recommendations: up to 24 months after the session, so a follow-up can build on them.
• Photographs you send: up to 6 months after the session, then deleted. We delete them sooner on request.
• Payment and accounting records: six years after the end of the relevant financial year, as required by UK tax law.
• Server logs: the short period applied by our hosting provider, usually a few weeks.

When a period ends, data is deleted or securely destroyed. Where deletion is not immediately possible, for example in backups, the data is isolated and protected until removal.

7. Security

We use encrypted connections to this website, access-controlled accounts protected by strong authentication for email and file storage, and limited access to consultation material on a need-to-know basis. Photographs are stored separately from general correspondence and removed once the retention period ends.

No transmission over the internet is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office and, where the risk is high, you as well.

8. Cookies

This website does not set analytics, advertising or tracking cookies, and there is no server-side form on the site: the contact button opens your own email client. Strictly necessary cookies may be set by our hosting provider to keep the site available and secure; these are exempt from the consent requirement under the Privacy and Electronic Communications Regulations.

The video platform used for consultations sets its own cookies when you join a call. That processing is covered by the platform's own privacy notice, which we will identify to you before your session.

You can block or delete cookies in your browser settings. Doing so does not affect your ability to contact us.

9. Your rights

Under UK data protection law you have the right to:

• Access — obtain confirmation that we process your data and receive a copy of it.
• Rectification — have inaccurate data corrected and incomplete data completed.
• Erasure — ask us to delete your data where there is no longer a lawful reason to keep it.
• Restriction — ask us to pause processing while a query about accuracy or lawfulness is resolved.
• Portability — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller where technically feasible.
• Objection — object to processing based on our legitimate interests, and to any direct marketing at any time.
• Withdraw consent — where processing relies on consent, withdraw it at any time.

To exercise any of these rights, email . We respond within one month and may ask for information to confirm your identity. There is normally no charge. We do not use automated decision-making or profiling that produces legal or similarly significant effects.

10. Withdrawing consent

Where we rely on your consent, in particular for photographs you have sent, you can withdraw it at any time by emailing us. We will stop the processing concerned and delete the material, unless we are required to keep it by law. Withdrawal does not affect the lawfulness of processing carried out before you withdrew, and it does not prevent us from delivering a consultation that does not depend on photographs.

11. Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office, at ico.org.uk, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

12. Age limit

Our consultations are intended for adults. We do not knowingly provide services to, or collect data from, anyone under 18 without the involvement of a parent or guardian. If you believe a minor has sent us personal data, contact us and we will delete it.

13. Changes to this policy

We update this policy when our services or providers change, or when the law requires it. The date at the top of the page shows the current version. If a change materially affects how we use your data, we will tell clients with an active consultation by email.

Questions about this policy can be sent to or by post to .