Legal

Privacy Policy

How we collect, use, share and protect your personal information.

1. Introduction

Beauty Within respects your privacy and is committed to protecting personal data. This Privacy Policy explains what personal data we process, why we process it, how long we keep it, who we share it with, and the rights available to you under UK data protection law (including the UK GDPR and the Data Protection Act 2018).

This Policy should be read with our GDPR page (rights in more detail), Cookie Policy, and Terms & Conditions.

3. Scope

This Policy applies to personal data processed in connection with:

  • use of our website at https://beautywithinkingswood.co.uk;
  • salon enquiries, consultations, bookings and treatments;
  • wellbeing support enquiries and related Services;
  • product recommendations and orders arranged through us;
  • gift vouchers, plans and invoicing;
  • our mailing list, where you choose to subscribe; and
  • communications you send to us.

It does not apply to third-party websites or apps linked from our Site (for example social media profiles or payment providers), which are governed by their own privacy notices.

4. What personal data we collect

Depending on your relationship with us, we may process:

4.1 Identity and contact data

Name, title, email address, telephone number, postal address, and similar identifiers.

4.2 Booking and service data

Appointment dates and times, treatment selections, preferences, attendance notes, deposit/payment status, invoice references, and related administrative records.

4.3 Health and wellbeing data

Information you provide that is relevant to safe treatment (for example medical history relevant to contraindications, allergies, pregnancy status, medications, skin concerns, and aftercare discussions). This may constitute special category data (see section 8).

4.4 Communication data

Messages sent via forms, email or telephone, and our responses.

4.5 Transaction data

Amounts paid or owed, payment method type, and payment references. We do not store full payment card numbers on our public website.

4.6 Mailing list data

Email address, subscription status, and the date you consented, if you join the Beauty Within mailing list. Confirmation and unsubscribe links are unique to you.

4.7 Technical and security data

IP address, browser type, device information, and security-related logs associated with website use, form submission and session management.

5. How we collect personal data

  • Directly from you - forms, bookings, consultations, telephone, email, in-salon.
  • Automatically - essential cookies and server logs when you use the Site.
  • From service partners - for example booking or payment providers confirming a Booking or payment, where you interact with those services.

6. How we use personal data

We use personal data to:

  • respond to enquiries and provide consultations;
  • schedule, confirm, remind, deliver and follow up on Services;
  • assess suitability and deliver care safely and professionally;
  • process deposits, invoices and payment matching;
  • administer vouchers, plans and product orders;
  • send mailing list emails where you have confirmed your subscription (you can unsubscribe at any time);
  • operate, secure and improve the Site and prevent misuse;
  • comply with legal, regulatory and professional obligations; and
  • establish, exercise or defend legal claims where necessary.

We do not sell personal data. We do not share personal data with third parties for their own marketing.

7. Lawful bases for processing

Under UK GDPR we rely on one or more of the following bases:

  • Contract - processing necessary to take steps at your request before a contract, or to perform a contract for Services;
  • Legitimate interests - running a secure, efficient salon business and website in ways you would reasonably expect, balanced against your rights;
  • Legal obligation - where the law requires us to process or retain information;
  • Consent - where we specifically ask for it (you may withdraw consent at any time); and
  • Vital interests - in rare cases where processing is needed to protect someone’s life.

Where we process special category data, we also identify an Article 9 condition (see section 8).

8. Special category (health) data

Health-related information is processed only where necessary for your care, safety and professional record-keeping. Typical conditions include provision of health or social care (with appropriate safeguards), explicit consent where required, or establishment/defence of legal claims.

Please only share information that is relevant. If you prefer not to provide information that we reasonably need for safe treatment, we may be unable to proceed with that treatment.

9. Sharing and recipients

We share personal data only where necessary, including with:

  • Service providers acting as processors (hosting, email delivery, IT/security) under written instructions;
  • Booking and payment providers needed to complete Bookings or payments you initiate;
  • Professional advisers (for example accountants or lawyers) under confidentiality;
  • Regulators, courts or law enforcement where required by law or to protect rights and safety.

We require processors to implement appropriate security and to process personal data only for agreed purposes.

10. International transfers

Where a provider processes data outside the UK, we take steps required by UK GDPR to ensure appropriate safeguards (for example adequacy regulations or standard contractual clauses), unless an exception under UK law applies.

11. Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including legal, accounting, insurance and professional record-keeping requirements, and then delete or irreversibly anonymise it.

  • General website enquiries - typically retained for a limited period after resolution unless a client relationship continues.
  • Booking and client records - retained for the period needed to deliver care, manage complaints/claims, and meet professional or legal obligations.
  • Financial records - retained for periods required by tax and accounting rules.
  • Security logs - retained for a shorter operational period unless needed for an investigation.
  • Mailing list - kept while you remain subscribed. Unconfirmed sign-ups and unsubscribed addresses are removed after about 7 days.

Exact periods may vary by record type. You may ask us for more detail about a specific category.

12. Security

We implement technical and organisational measures appropriate to the risk, including access controls, encrypted transport (HTTPS), hardened hosting configuration, and secure session/CSRF protections on forms. No method of transmission or storage is completely secure; we work to reduce risk and respond to incidents in line with our legal duties.

13. Cookies

We use essential cookies to operate the Site and secure forms. Details are in our Cookie Policy.

14. Your rights

Depending on the circumstances, you may have rights of access, rectification, erasure, restriction, portability and objection, and rights relating to automated decision-making. See our GDPR page for a fuller explanation and how to exercise these rights.

15. Children

Our Site and Services are directed to adults. We do not knowingly collect personal data from children online for marketing. Where a young person receives treatment, this is handled with appropriate guardian involvement and professional judgement.

16. Changes to this Policy

We may update this Privacy Policy periodically. The Effective date and Version will be revised when material changes are made. Please review this page from time to time.