Legal
Privacy policy
How we handle your personal information, in plain English.
Key details
- Data controller
- MISSING:Data controller name for the privacy policy — the registered company that holds the enquiry data. Same answer as legalName above.
- Contact for privacy questions
- MISSING:A monitored email address for data subject requests (access, deletion). Can be the general enquiry address, but someone has to actually action requests within a month.
- ICO registration
- MISSING:ICO registration number, if they have one. Most salons do not need to register, but a clinic keeping health-related records probably should — worth them checking.
- How long we keep enquiry data
- MISSING:How long enquiry and client records are kept before deletion. They likely already have an answer for Salon IQ records; reuse it.
Special category (health) information
Some of the things people tell us about in an enquiry — hair loss, thinning, scalp irritation, menopause-related hair change — are, legally speaking, information about your health. Health information is a "special category" of data under UK GDPR, and needs a stronger justification than ordinary contact details.
We only collect this because you choose to tell us, in your own words, when describing what's bringing you to the clinic. We treat sending it to us as your explicit consent to us using it for the single purpose of understanding what you need and responding to your enquiry — nothing else. You can withdraw that consent at any time by asking us to delete your enquiry (see "Your rights" below); withdrawing it doesn't affect anything we did with it before you withdrew.
We don't use anything you tell us about your health for marketing, and we don't share it with anyone outside the clinic except where the law requires it or you've separately asked us to.
Who this policy covers
This policy covers anyone who visits this website, sends us an enquiry through it, or otherwise gives us their personal information — for example by calling the salon or messaging us on social media. It does not cover information you give directly to our booking partner, Salon IQ, when you book an appointment through them — that’s covered by Salon IQ’s own privacy policy, since they hold and process that booking data as a separate controller, not us.
What we collect and why
| We collect | When | Why (lawful basis) |
|---|---|---|
| Name, email, phone number | You submit the enquiry form | To reply to your enquiry — legitimate interests / taking steps to provide a service you’ve asked about |
| The content of your message | You submit the enquiry form | To understand and respond to what you’re asking |
| Which page you enquired from, and basic campaign data (UTM parameters, ad click IDs) | Automatically, when you submit the enquiry form | To understand which of our marketing is actually working — legitimate interests |
| Cookie consent choices | Automatically, on your first visit | Necessary to run the site the way you’ve asked us to |
| Analytics and advertising cookies (Google Analytics, Meta Pixel, Google Ads) | Only after you accept the relevant category in our cookie banner | Consent — see our Cookie Policy |
We do not sell your personal information, and we do not use it to make any automated decision that has a legal or similarly significant effect on you. How long we keep each of these is set out in the “Key details” box above.
Who we share it with
We use a small number of other companies to run this site and respond to enquiries. They only ever see what they need to do their specific job, and none of them can use your information for their own purposes:
- Cloudflare — hosts this website, its database and images, and provides security/bot protection.
- Resend — sends the confirmation and notification emails your enquiry triggers.
- Salon IQ — if you book an appointment, separately from an enquiry (see “Who this policy covers” above).
- Google (Analytics, Ads) and Meta (Facebook/Instagram) — only if you’ve accepted analytics or marketing cookies; see our Cookie Policy for exactly what each one does.
Your rights
Under UK GDPR you have the right to:
- Access the personal information we hold about you.
- Correct it, if it’s inaccurate or incomplete.
- Delete it (the “right to be forgotten”), including withdrawing consent for anything we’re holding on that basis.
- Restrict or object to how we use it.
- Receive a copy of it in a portable format, for anything we process based on your consent or a contract with you.
- Complain to the UK’s data protection regulator, the Information Commissioner’s Office (0303 123 1113), if you’re unhappy with how we’ve handled your information — though we’d appreciate the chance to put it right first.
To use any of these rights, contact us using the details in the “Key details” box above. We’ll respond within one month.
Children
This site and its enquiry form are intended for adults. If you’re booking or enquiring on behalf of a child (for example, about a children’s haircut), please only share the information needed to arrange that appointment.
Changes to this policy
We may update this policy from time to time — for example, if we start using a new analytics or advertising tool. The date this was last reviewed is shown at the top of this page; check back occasionally if you want to stay current.