Privacy Policy

Who we are

Halton Hair & Beauty ("we", "us", "our") is an independent hair, beauty and skin studio at 1 Cross Green Lane, Halton, Leeds LS15 7SR. We are the data controller for the personal information described in this policy, which means we decide how and why it is used.

If you have any questions about this policy or how we handle your information, contact us:

• Email: hello@haltonhairbeauty.co.uk
• Phone: 0113 000 0000
• Post: Halton Hair & Beauty, 1 Cross Green Lane, Halton, Leeds LS15 7SR

[Placeholder: if the business is registered with the ICO, add the registration number here. A small business processing client health records will normally need to register — check at ico.org.uk/registration.]

Information we collect

We only collect what we need to look after you safely and run the salon. Depending on how you deal with us, this may include:

• Contact details — your name, phone number, email address and, if relevant, postal address.
• Booking information — the treatments you book, appointment dates and times, the therapist you see, your preferences, and any notes we make to make your next visit better.
• Consultation and health information — the answers you give on consultation forms before treatments such as hair colour, lash and brow tinting, waxing, massage, facials and micro-needling. This can include allergies, skin conditions, medication, pregnancy and recent medical history, as well as patch-test results and treatment records. See Health & consultation information.
• Photographs — before-and-after photos taken with your permission to track results or, only with your separate agreement, to share on our website or social media.
• Payment information — records of what you have paid for. Card payments are handled by our payment provider; we never see or store your full card number.
• Enquiries and correspondence — messages you send us by our website form, email, phone, WhatsApp or social media, including the enquiry type, treatment of interest and preferred dates you tell us.
• Website and account information — if you create an account or buy a gift voucher or product online: your login details, order history and delivery address, plus technical data such as your IP address, browser and the pages you visit (see Cookies & analytics).
• Reviews and feedback — anything you choose to tell us about your visit.

We collect this information directly from you — in the salon, on consultation forms, through our website and booking system, and when you contact us. We do not buy personal information from third parties.

How we use your information

• To take, confirm, remind you about and manage your appointments.
• To carry out treatments safely — checking suitability, patch tests, allergies and contraindications, and keeping an accurate record of what was done and the products used.
• To respond to your enquiries and provide the advice you ask for.
• To process payments, gift vouchers and online orders, and to keep the accounting records we are legally required to keep.
• To send you service messages, such as appointment confirmations, reminders and aftercare advice.
• To tell you about offers, new treatments and news — only where you have agreed to this (see Marketing).
• To meet our legal, insurance and licensing obligations, and to deal with any complaint, claim or dispute.
• To run, secure and improve our website.

Health & consultation information

Some of what you tell us at a consultation is information about your health. Under UK data protection law this is special category data and gets extra protection.

We ask for it because we cannot treat you safely without it: it tells us whether a treatment is suitable, whether a patch test is needed, and how to adapt what we do. We rely on your explicit consent to record it, which you give when you complete and sign your consultation form. You can withdraw that consent at any time, although it may mean we are unable to carry out certain treatments.

Consultation records are seen only by the therapists treating you. They are stored securely (locked away if on paper, or in our password-protected booking system if digital), are never used for marketing, and are never shared with anyone else unless you ask us to, or the law or a legitimate insurance claim requires it.

Our lawful basis for using your information

UK GDPR requires us to have a lawful reason for each use of your information. Ours are:

• Performing a contract with you — taking bookings, providing treatments, selling vouchers and products, and taking payment.
• Legal obligation — keeping financial and tax records, and complying with health and safety, licensing and insurance requirements.
• Legitimate interests — running and protecting our business: keeping accurate client notes, sending service messages, handling enquiries, defending legal claims, and understanding how our website is used. We only rely on this where our interests are not outweighed by your rights.
• Consent — recording health information on consultation forms, taking and sharing photographs, and sending you marketing. You can withdraw consent whenever you like.

Who we share your information with

We never sell your information. We share it only with trusted providers who help us run the salon, and only as much as they need:

• Our booking and client-record system, which stores appointments and consultation records on our behalf. [Placeholder: name the system, e.g. Fresha / Phorest / Timely.]
• Payment providers for card and online payments.
• Email, SMS and messaging providers used to send confirmations, reminders and (with your consent) marketing, including WhatsApp when you choose to message us there.
• Our website hosting, security and analytics providers, including Google (reCAPTCHA on our forms and the embedded map).
• Our accountant and professional advisers, and our insurers where a claim is made.
• Regulators, the police or a court where we are required to by law.

Some of these providers store information outside the UK. Where they do, we make sure it is protected by safeguards recognised under UK law, such as the UK's adequacy regulations or the International Data Transfer Agreement / Addendum.

How long we keep your information

• Consultation forms, patch-test and treatment records — 7 years from your last treatment, as required by our insurers. For clients under 18 at the time of treatment, until their 25th birthday.
• Booking and client contact details — for as long as you remain a client, and for 2 years after your last appointment. After that we delete or anonymise your record unless a treatment record above requires us to keep it.
• Financial and order records — 6 years after the end of the financial year they relate to, as required by HMRC.
• Enquiries — 12 months after we last correspond with you, unless you become a client.
• Marketing consent — until you withdraw it. We keep a record that you unsubscribed so we don't contact you again.
• Photographs — until you ask us to remove them.
• Website accounts — until you close the account or it has been unused for 3 years.

Marketing

We would love to keep you up to date with offers, new treatments and salon news, but we will only do so by email, text or messaging app if you have opted in. Every message includes an easy way to unsubscribe, or you can just tell us. Withdrawing consent does not affect appointment confirmations and reminders, which are service messages and not marketing.

We do not pass your details to anyone else for their own marketing.

Cookies & analytics

Our website uses a small number of cookies:

• Essential cookies that make the site work — remembering your basket, keeping you logged in, protecting forms from spam (Google reCAPTCHA) and remembering that you've dismissed our cookie notice. These cannot be switched off.
• Analytics cookies that tell us, anonymously, which pages are popular and how the site is used so we can improve it. [Placeholder: name the tools in use, e.g. Google Analytics / Microsoft Clarity, or remove this bullet if none are used.] These are only set if you accept them.
• Third-party content — the Google map on our contact page and any embedded social media posts may set their own cookies, governed by those companies' privacy policies.

You can manage cookies through your browser settings; blocking essential cookies may stop parts of the site working.

Keeping your information secure

Paper consultation forms are kept in a locked cabinet that only our staff can access. Digital records are held in password-protected systems with access limited to the therapists who need them. Our website is served over HTTPS and card payments are taken through PCI-compliant providers so that card details never touch our systems. Our team are trained to handle your information carefully and to keep what you tell us confidential.

If we ever discover a breach that puts your rights at risk we will tell you and the Information Commissioner's Office without undue delay.

Under 18s

Some treatments are not available to clients under 16, and clients under 18 need a parent or guardian present to give consent at the consultation. Where we hold information about a child, it is the parent or guardian's contact details we use to communicate about appointments. We do not knowingly send marketing to anyone under 18.

Your rights

You have the right to:

• Access — ask for a copy of the information we hold about you.
• Rectification — ask us to correct anything that is wrong or incomplete.
• Erasure — ask us to delete your information, where we don't have a legal or insurance reason to keep it.
• Restriction — ask us to pause using your information while a query is resolved.
• Objection — object to our use of your information based on legitimate interests, and to direct marketing at any time.
• Portability — receive the information you gave us in a portable format.
• Withdraw consent — at any time, where consent is the basis we rely on.

To exercise any of these rights, email hello@haltonhairbeauty.co.uk or speak to us in the salon. We will respond within one month and there is normally no charge. We may need to confirm your identity first.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office: ico.org.uk/make-a-complaint, phone 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Changes to this policy

We may update this policy from time to time, for example if we change our booking system or introduce new services. The latest version will always be on this page, with the date it was last updated shown at the top.