Website & Online Privacy Policy

Last updated: 16 September 2026

1. Who we are

We are the controller of the personal data described in this policy. That means we decide how and why your personal data is used, and we are responsible for looking after it in line with UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and the Data (Use and Access) Act 2025.

See also our Cookie Policy and our Terms and Conditions.

2. What this policy covers

This policy explains how we collect and use personal data when you:

• visit our website or chat with us online;
• book an appointment, whether through our website, the Treatwell booking widget, by phone, email, social media or in person;
• visit one of our salons and receive a service;
• buy products, gift cards or packages from our online shop;
• sign up to our newsletter, claim an offer or enter a competition;
• leave a review or give us feedback;
• follow or message us on social media;
• apply for a job with us; or
• are recorded on CCTV in or around our salons.

Our website contains links to other websites, social media platforms and booking services. We are not responsible for how those organisations use your data, so please read their privacy policies.

3. The personal data we collect

• Identity data: your name, title and, where you give it to us, date of birth.
• Contact data: email address, phone number, and billing and delivery addresses.
• Appointment and service data: bookings, cancellations and no-shows, the stylist you saw, the services you received, consultation notes, hair history, colour formulas, and product recommendations.
• Health data: information you give us so we can carry out treatments safely, such as allergies, skin or scalp sensitivities, patch test results, relevant medical conditions and medication, and pregnancy where it affects a treatment. This is "special category" data and we give it extra protection (see section 5).
• Images: before and after photos or videos of your hair, taken only with your permission.
• Financial and transaction data: details of payments, deposits, refunds, gift cards and purchases. Card payments are handled by our payment providers. We do not store your full card details.
• Communications data: emails, website form submissions, live chat messages, social media messages, reviews, feedback and complaints.
• Marketing data: your marketing preferences, and whether you open or click our emails.
• Technical and usage data: IP address, device and browser type, pages viewed, how you arrived at our website, and similar information collected through cookies and similar technologies.
• CCTV footage: images and video of people in and around our salons, recorded by our CCTV systems.
• Recruitment data: your CV, work history, qualifications, portfolio, references and right to work information if you apply for a job.

4. How we collect your personal data

• Directly from you: when you book, visit a salon, fill in a form, buy from our shop, contact us, subscribe to our emails, or apply for a job.
• Through booking platforms: when you book with us through Treatwell, including through the Treatwell widget on our website, Treatwell shares your booking details with us. Treatwell is responsible for its own use of your data under its privacy policy.
• Automatically: through cookies, pixels and similar technologies when you use our website (see section 7).
• From third parties: such as advertising, analytics and affiliate partners, review platforms (for example Google and Treatwell), and social media platforms when you interact with our pages or adverts.

5. How we use your data and our lawful bases

We only use your personal data where the law allows us to. The table below sets out what we use your data for and the lawful basis we rely on.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more information about this.

If you do not give us information we need, such as allergy information before a colour or chemical service, we may not be able to carry out that service.

We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you.

CCTV

We use CCTV in our salons for security and safety. Signs are displayed where CCTV is in operation. Cameras are not placed in areas where people would reasonably expect privacy, such as toilets. Footage is stored securely, access is limited to authorised managers, and we only share it with the police, insurers or legal advisers where necessary. You can ask for a copy of footage of yourself using your right of access (section 12).

6. Marketing

We will only send you marketing if you have agreed to receive it, or if you are an existing client and we are telling you about similar services, and you have not opted out.

You can opt out at any time by clicking "unsubscribe" in any email, replying STOP to a text, or emailing [email protected]. We will keep a record of your opt-out so we do not contact you again. Opting out of marketing does not stop service messages such as booking confirmations and reminders.

7. Cookies and similar technologies

Our website uses cookies and similar technologies. Some are needed for the website to work, for security, or to remember your choices, and the law allows us to use these without your consent. We only use analytics and advertising cookies if you agree to them through our cookie banner. You can change your choices at any time.

Technologies used on our website include Google Analytics, Google Ads, the Meta Pixel, Impact (affiliate tracking), Ahrefs Web Analytics, Cloudflare, Google reCAPTCHA, Tidio live chat, and embedded content from YouTube and Google Maps. Full details are in our Cookie Policy.

8. Who we share your data with

We do not sell your personal data. We share it only where necessary, with:

• Our stylists: including self-employed stylists who work in our salons, so they can deliver your service. They must keep your information confidential.
• Service providers who act on our behalf, including:
  • booking and salon software providers (such as Treatwell);
  • website hosting, security and IT support providers (such as Cloudflare);
  • payment providers (such as PayPal and Treatwell);
  • email marketing providers (such as Mailchimp);
  • live chat providers (such as Tidio); and
  • analytics, advertising and affiliate partners (such as Google, Meta and Impact).
• Professional advisers: including accountants, lawyers, insurers and banks.
• Authorities: HM Revenue & Customs, the police, regulators, courts and other public bodies, where the law requires or allows it.
• Buyers or investors: if we sell, transfer or merge part of our business, in which case the new owner may use your data in the same way as set out in this policy.

Our service providers may only use your data on our instructions and must keep it secure.

9. International transfers

Some of our service providers, such as Google, Meta, Mailchimp and PayPal, may process your data outside the UK, including in the European Economic Area and the United States. When this happens, we make sure your data is protected by one of the following safeguards:

• the country is covered by UK adequacy regulations (this includes the EEA, and US organisations certified under the UK Extension to the EU-US Data Privacy Framework); or
• we use contracts approved for UK transfers, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

You can contact us for more information about the safeguards we use.

10. How we keep your data secure

We use appropriate technical and organisational measures to protect your personal data. These include access controls, secure systems provided by reputable suppliers, and limiting access to people who need it. If a data breach is likely to put your rights at high risk, we will tell you and the Information Commissioner's Office (ICO) as required by law.

11. How long we keep your data

12. Your rights

You have the right to:

• access the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• erase your data in certain circumstances;
• restrict how we use your data in certain circumstances;
• object to us using your data based on legitimate interests, and to direct marketing at any time;
• data portability, meaning you can receive data you gave us in a commonly used format, or ask us to send it to another organisation;
• withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it; and
• complain to us, and to the ICO (see section 13).

To use any of these rights, email [email protected]. There is normally no fee. We will respond within one month, which may be extended by up to two further months for complex requests; if so, we will tell you why. We may need to confirm your identity first, and the time limit starts once we have done so. When responding to an access request, we will carry out reasonable and proportionate searches for your data.

You can find more information about your rights on the ICO website.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at [email protected] with "Data Protection Complaint" in the subject line. We will:

• acknowledge your complaint within 30 days;
• look into it without undue delay and keep you updated; and
• tell you the outcome.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

14. Children

Our website and online shop are not intended for children. We provide salon services to under-16s only with the consent of a parent or guardian, who will provide the child's information and any health information on their behalf.

15. Changes to this policy

We review this policy regularly and will update it when our practices or the law change. The date at the top shows when it was last updated. If we make significant changes, we will tell you by email or through a notice on our website.

This policy page and its content is copyright of Blueshift Productions Ltd © 2026. All rights reserved.