Privacy Policy
Last updated: [DATE OF GO-LIVE]
This policy explains how [UK COMPANY NAME] ("we", "us") collects and uses your personal data when you use [UK DOMAIN] or buy from us. We are the data controller. We are registered with the Information Commissioner's Office (ICO), registration number [ICO NUMBER].
Contact for privacy questions: privacy@[UK DOMAIN] · [UK ADDRESS]
1. Data we collect
- Identity & contact: name, email, phone number, delivery and billing address.
- Order data: products bought, prices, order history, returns.
- Payment data: processed by Stripe and PayPal. We do not store your full card number.
- Account data: login email and an encrypted password (if you create an account).
- Business data (trade accounts): salon name, VAT number, proof of trade.
- Technical data: IP address, browser, device, pages visited (see our Cookie Policy).
- Communications: messages you send us, reviews you write, marketing preferences.
2. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Process and deliver your order, send order emails, handle returns | Contract |
| Keep invoices and tax records (6 years) | Legal obligation |
| Prevent fraud and keep the website secure | Legitimate interests |
| Improve our website with statistics | Legitimate interests |
| Send newsletters and offers | Consent (you can unsubscribe at any time). Existing customers may receive offers on similar products, with an opt-out in every email. |
| Ask for a product review after purchase | Legitimate interests |
3. Who we share it with
Only with the companies that help us run the shop: payment providers (Stripe, PayPal), couriers (Royal Mail, DPD), our email service ([Brevo]), website hosting ([HOSTING PROVIDER]), our accountants, and authorities where the law requires it. We never sell your data.
4. International transfers
Some providers (and our parent group in the United Arab Emirates, which supports the website and customer service) may process data outside the UK. When this happens we use UK-approved safeguards such as the ICO International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses.
5. How long we keep it
Order and invoice records: 6 years (tax law). Account data: until you close your account + 2 years of inactivity. Marketing data: until you unsubscribe. Contact-form messages: 2 years.
6. Your rights
You can ask to: access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent at any time. Email privacy@[UK DOMAIN]. We reply within one month. You also have the right to complain to the ICO: ico.org.uk, 0303 123 1113.
7. Security
Payments use encrypted (HTTPS/TLS) connections and PCI-DSS-compliant providers. Access to customer data is limited to staff who need it.
8. Children
Our website is not intended for children under 16 and we do not knowingly collect their data.
9. Changes
We will post any changes on this page with a new "last updated" date.
Last updated: [DATE OF GO-LIVE]