Privacy Notice

1. Who we are

The Self Edit Beauty Studio is owned and run by Kara Woodcock. We are the controller of the personal information you give us when you book an appointment, buy a gift voucher or contact us.

Address: 2 Rosemary Lane, Richmond, DL10 4DP

Email: theselfeditbeautystudio@hotmail.com

Phone: 07546727145

If you have any questions about this notice or how we use your information, please contact us using the details above.

2. What information we collect

When you book an appointment or buy a gift voucher, we collect:

• your first name and surname
• your email address
• your mobile number
• the treatments, products and gift vouchers you choose, and the date and time of your appointment
• whether you have agreed to our booking terms, and which version you agreed to
• whether you would like to receive offers and news from us
• payment status and the amount paid (we never see or store your full card details)

We may also record notes about your appointment, such as treatment preferences. If you tell us about allergies, skin sensitivities or other health information relevant to your treatment, we will record it only to keep you safe during your treatment, and only with your explicit consent.

When you check a gift voucher code on our website, we keep a coded (hashed) version of your internet connection's IP address for up to 24 hours to stop misuse of voucher codes. This cannot be used to identify you by itself.

3. Where your information comes from

Most of the information we hold comes directly from you, through our website, by phone, by message or in person. If you booked with us before our current website was launched, your details were transferred from our previous booking system.

4. How and why we use your information

We use your information to:

• take and manage your bookings and gift voucher purchases (lawful basis: performance of a contract with you)
• send you booking confirmations, reminders and updates about your appointment (lawful basis: performance of a contract with you)
• take payments and deal with refunds (lawful basis: performance of a contract with you)
• keep financial and tax records (lawful basis: legal obligation)
• prevent fraud and misuse of our website and gift vouchers, and keep our website and booking system secure and working properly (lawful basis: our legitimate interests in running a safe and reliable business)
• send you offers and news by email or text message, only if you have ticked the box to receive them (lawful basis: consent)
• record health information you give us to keep you safe during your treatment (lawful basis: explicit consent)

You can withdraw your consent to marketing or to us holding your health information at any time by contacting us. This will not affect anything we did before you withdrew it.

We need your name, email address and mobile number to take your booking. Without them, we cannot accept your booking.

We do not use automated decision-making or profiling.

5. Who we share your information with

We do not sell your information. We share it only with the following organisations, and only as far as needed to provide our services.

Stripe (payment provider): Stripe processes your payment when you pay online. Stripe acts as a separate controller of your payment information and uses it for its own purposes, including fraud prevention and meeting its legal and regulatory obligations. Stripe's privacy policy: https://stripe.com/gb/privacy

Cedar Integration (processor): Cedar Integration, run by Andrew Woodcock in the United Kingdom, builds, hosts and maintains our website and booking system on our behalf, and only acts on our instructions. Cedar Integration uses the following sub-processors:

• Neon: database hosting, where your booking information is stored. Data is stored in London, United Kingdom.
• Vercel: website and booking system hosting. Data may be processed in the United States.
• Resend: sending booking confirmation and reminder emails. Data may be processed in the United States.
• Anthropic: AI assistance used by Cedar Integration when maintaining and fixing the booking system, which may involve access to booking records. Data may be processed in the United States.

We may also share your information if the law requires us to, for example with HMRC or the police.

6. Transfers outside the United Kingdom

Some of the organisations listed above process information in the United States. Where this happens, your information is protected by one of the following: the UK–US data bridge, where the organisation is certified under it; the UK International Data Transfer Agreement; or the UK Addendum to the EU Standard Contractual Clauses. Please contact us if you would like more information.

7. How long we keep your information

• Booking, payment and gift voucher records: six years after the end of the tax year in which the appointment or purchase took place, as needed for our tax records.
• Health information you have given us: for as long as you remain a client, and for up to six years after your last appointment.
• Marketing preferences: until you withdraw your consent or ask us to stop.
• Hashed IP addresses from voucher code checks: deleted after 24 hours.

After these periods, your information is securely deleted.

8. Website analytics and cookies

We use Vercel Web Analytics to understand how many people visit our website and which pages they view. It does not use cookies and does not identify you personally. We do not use advertising or tracking cookies. When you pay online, you are taken to a Stripe payment page, which may use cookies that are needed for payment and fraud prevention. See Stripe's privacy policy for details.

9. Your rights

Under UK data protection law, you have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete your information
• ask us to limit how we use your information
• object to us using your information based on our legitimate interests
• ask us to transfer your information to another organisation
• withdraw your consent at any time, where we rely on consent

To use any of these rights, please contact us using the details in section 1. We will reply within one month. There is normally no charge.

10. How to complain

If you are unhappy with how we have used your information, please contact us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO):

Website: https://ico.org.uk/make-a-complaint

Phone: 0303 123 1113

11. Changes to this notice

We may update this notice from time to time. The latest version will always be on this page, with the date it was last updated shown at the top.