Legal

GDPR & your data rights

A clear guide to your rights under UK data protection law and how to exercise them.

1. Overview

This notice explains your rights as a data subject when Beauty Within processes your personal data. It complements our Privacy Policy, which describes what we collect and why.

We process personal data lawfully, fairly and transparently, and only for purposes that are explicit and legitimate.

2. Legal framework

Our processing is governed primarily by:

  • the UK General Data Protection Regulation (UK GDPR);
  • the Data Protection Act 2018; and
  • the Privacy and Electronic Communications Regulations (PECR), where relevant to cookies and electronic communications.

3. Our data protection principles

We apply the UK GDPR principles, including:

  • Lawfulness, fairness and transparency
  • Purpose limitation
  • Data minimisation
  • Accuracy
  • Storage limitation
  • Integrity and confidentiality (security)
  • Accountability

4. Your rights explained

Subject to legal conditions and exemptions, you may have the following rights:

4.1 Right to be informed

You have the right to clear information about how we use your personal data. We provide this mainly through our Privacy Policy, Cookie Policy and this notice.

4.2 Right of access

You may request confirmation of whether we process your personal data and, where we do, access to that data and supporting information (a subject access request).

4.3 Right to rectification

You may ask us to correct inaccurate personal data or complete data that is incomplete.

4.4 Right to erasure (“right to be forgotten”)

You may ask us to delete personal data in certain circumstances (for example where it is no longer needed for the original purpose, or where you withdraw consent and no other lawful basis applies). This right is not absolute - we may need to retain information for legal, clinical or claims purposes.

4.5 Right to restrict processing

You may ask us to limit how we use your data while a complaint or accuracy concern is resolved, or in other limited situations set out in UK GDPR.

4.6 Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may request to receive certain personal data in a structured, commonly used and machine-readable format, or ask us to transmit it to another controller where technically feasible.

4.7 Right to object

You may object to processing based on legitimate interests (including profiling based on those interests). You also have an absolute right to object to direct marketing. We do not currently send third-party marketing or sell data for marketing.

4.8 Rights related to automated decision-making

You have rights regarding decisions based solely on automated processing that produce legal or similarly significant effects. Beauty Within does not use solely automated decision-making of that kind.

4.9 Right to withdraw consent

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

5. How to make a request

To exercise any right, contact us using the details in section 13 and include:

  • your full name and contact details;
  • a clear description of the right you wish to exercise;
  • enough information for us to locate relevant records (for example appointment dates); and
  • any preference for how you wish to receive a response.

Please mark emails “Data Protection Request” so we can prioritise them: info@beautywithinkingswood.co.uk

6. Identity verification

To protect your privacy, we may ask for reasonable information to verify your identity before fulfilling a request. If a request is made on your behalf by a third party, we may require proof of authority.

7. Response times and fees

We aim to respond within one month of receiving a valid request. For complex or numerous requests we may extend by up to two further months and will tell you why.

Requests are normally free of charge. We may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, in line with UK GDPR.

8. Limits and exceptions

Rights are not always absolute. We may refuse or partially refuse a request where an exemption applies (for example legal professional privilege, crime prevention, or where disclosure would adversely affect the rights of others). Where we refuse, we will explain our reasons unless the law prevents us from doing so, and tell you about your right to complain to the ICO.

9. Special category data

Health and similar special category data receives enhanced protection. We process it only where a UK GDPR Article 9 condition applies (in addition to a lawful basis), with appropriate safeguards. See the Privacy Policy for details.

10. Processors and accountability

Where we use service providers to process personal data on our behalf, we use contracts that require confidentiality, security and processing only on our documented instructions. We remain accountable for personal data under our control.

11. Personal data breaches

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will assess it and, where required, notify the ICO and affected individuals in accordance with UK GDPR.