Data Protection

1. Data controller

The data controller for Individual Beauty Studio is Nina, based in Bromley Cross, Bolton. As data controller, Nina is responsible for deciding how and why your personal data is collected and used.

Website: individualbeautystudio.co.uk

2. What personal data we hold

Depending on the services you use, we may collect and hold the following personal data:

• Your name, email address, and phone number
• Appointment history and treatment records
• Health and skin information provided during consultations
• Gift voucher and purchase records
• Communications you send to us by phone, email, or via our website

We only collect information that is necessary to provide your treatment safely or to respond to your enquiry.

3. Lawful basis for processing

We process your personal data on the following lawful bases:

• Contract — to book and carry out your appointments and treatments
• Legitimate interests — to manage our salon and respond to enquiries
• Legal obligation — to meet any applicable record-keeping requirements
• Consent — where you have provided health information as part of a treatment consultation

4. Special category data

Certain treatments require us to collect health-related information during a consultation to ensure your safety and suitability for treatment. This is classed as special category data under UK GDPR and is processed only with your explicit consent. It is kept strictly confidential, stored securely, and is only accessible to the therapist carrying out your treatment.

5. How we store your data

Your personal data is stored securely and is only accessible to authorised members of the Individual Beauty Studio team. We take reasonable steps to protect your information from unauthorised access, loss, or misuse.

6. How long we keep your data

We retain your personal data only for as long as necessary. Appointment and consultation records are typically kept for up to 3 years. Enquiry data where no appointment was made is held for up to 12 months.

7. Sharing your data

We do not sell or share your personal data with third parties for marketing purposes. Your information will not be passed on to anyone outside of what is strictly necessary to provide your treatment or manage your booking.

8. Your rights

Under UK GDPR, you have the following rights:

• The right to access the personal data we hold about you
• The right to have inaccurate data corrected
• The right to have your data deleted (where applicable)
• The right to restrict or object to how we process your data
• The right to withdraw consent at any time

To exercise any of these rights, please get in touch and we will respond within one month.

9. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

ICO website: www.ico.org.uk  |  ICO helpline: 0303 123 1113