Privacy Policy

1. The short version

The rest of this policy sets out the detail required by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who is responsible

yoursalon.uk is operated by [Company name], registered in England and Wales under company number [company number], registered office [registered address]. We are registered with the Information Commissioner's Office under registration number [ICO registration number].

For questions about this policy or about your data, email privacy@yoursalon.uk.

3. Salon owners and client data: who does what

There are two different relationships going on in the app, and it matters which one applies.

Your own data as a salon owner

For the account you hold with us, covering your name, your salon details, your login, your subscription and how you use the app, we are the data controller. This policy explains what we do with it.

Your clients' data

For the information you put into the app about your clients, such as their contact details, appointments, notes, colour formulas, patch test records and payment history, you are the data controller and we are your data processor. You decide what is collected and why; we only act on your instructions.

As your processor we commit to:

• process client data only on your documented instructions, and only to provide the app;
• keep it confidential and make sure our staff are bound by confidentiality;
• apply appropriate technical and organisational security measures (section 11);
• use sub-processors only as listed in section 7, and tell you before we add or replace one;
• help you respond to requests from your clients about their rights;
• help you with security, breach notification and data protection impact assessments;
• tell you without undue delay if we become aware of a personal data breach affecting your client data; and
• delete or return client data when your account ends, in line with section 10.

These commitments are the terms required by Article 28 UK GDPR. If your salon needs a separate signed data processing agreement, email privacy@yoursalon.uk.

If you are a client of a salon and want to know what your salon holds about you, or want it changed or deleted, please contact the salon directly, as they control that record. We will help them respond.

4. What we collect

Information you give us

• Account details: your name, email address, mobile number, salon name and address, and your password (stored only as a secure hash).
• Salon set-up: your services, prices, durations, opening hours, staff names and rotas.
• Client records you enter: client names and contact details, appointment history, notes, photos, colour formulas, allergies and patch test records.
• Anything you send us: support emails, feedback and bug reports.

Information we collect automatically

• Device and app data: device model, operating system version, app version, language and time zone, and a device or installation identifier.
• Usage data: which screens and features are used and when, so we can find faults and improve the app.
• Technical logs: IP address, crash reports and error diagnostics.

Information from others

• Apple and Google: confirmation that a subscription has started, renewed, lapsed or been refunded. We do not receive your payment card details from them.
• Our payment provider: confirmation that a client's deposit or payment succeeded or failed, and the last four digits and card type for reconciliation.

5. Why we use it, and our lawful basis

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. You can ask us for details of that assessment, and you can object. See section 12.

6. Health and other sensitive data

Some salon records are special category data under UK GDPR, for example allergies, skin conditions, medication, pregnancy, or patch test results.

Where a salon records this in the app, the salon is responsible for having a valid condition for processing it, which in practice usually means the client's explicit consent given at consultation. We only store and secure that information on the salon's behalf as its processor. We do not use it for any purpose of our own.

If you are a salon owner, make sure your consultation forms and your own privacy notice cover this properly.

7. Who we share it with

We do not sell personal data and we do not share it for anyone else's marketing. We do share it with service providers who help us run the app, and only as far as they need it. These are our sub-processors:

We may also disclose personal data where the law requires it, to our professional advisers, or to a buyer if our business is sold, in which case we will tell you first.

8. Payments

We do not see or store full payment card numbers.

Your £25 monthly subscription is charged by Apple or Google to the payment method on your Apple ID or Google Play account. Those companies handle that transaction under their own privacy policies. See Apple and Google. We only receive confirmation of your subscription status.

Payments from your clients are handled by our payment provider, which is PCI DSS compliant. Card details go directly to them; we receive only the result of the transaction and a partial card reference for your records.

9. Where your data is held

We store personal data on servers in the United Kingdom and/or the European Economic Area.

Some of our providers may process data outside the UK. Where that happens, we make sure it is protected by an approved safeguard: UK adequacy regulations, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures needed. You can ask us for details.

10. How long we keep it

Client data held on your behalf is deleted when your account is deleted, subject to the backup cycle above. Export what you need before you go.

11. Keeping it safe

We use appropriate technical and organisational measures, including:

• encryption in transit (TLS) and encryption of data at rest;
• passwords stored only as salted hashes, never in readable form;
• access limited to staff who need it, on a least-privilege basis;
• regular backups, tested for restoration;
• logging and monitoring of access to production systems; and
• a documented process for assessing and reporting personal data breaches.

No system is completely secure. If a breach is likely to result in a high risk to people's rights, we will tell those affected without undue delay, and the ICO within 72 hours where required.

12. Your rights

Under UK data protection law you have the right to:

• be informed about how your data is used, which is what this policy is for;
• get a copy of the personal data we hold about you;
• have it corrected if it is wrong or incomplete;
• have it deleted where there is no good reason for us to keep it;
• restrict how we use it while a concern is being resolved;
• portability: receive your data in a common machine-readable format, or have it sent to another provider;
• object to processing based on legitimate interests, and to direct marketing at any time; and
• not be subject to decisions made solely by automated means that have a significant effect on you. We do not make such decisions.

To exercise any of these, email privacy@yoursalon.uk. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify your identity first.

If your request is about data held by a salon, we will pass it to that salon, as they control that record.

13. Deleting your account

You can delete your yoursalon.uk account and the data in it from inside the app: Settings → Account → Delete account. The app will confirm what will be deleted before anything happens.

If you cannot access the app, email privacy@yoursalon.uk from your registered address and we will delete it for you.

Deleting your account does not automatically cancel a subscription bought through the App Store or Google Play. Cancel that separately in your device account settings. See the Terms & Conditions. Full instructions are on our support page.

14. Marketing and messages

Service messages such as booking confirmations, reminders, receipts and security notices are part of the app and cannot be switched off while you have an account, though you can change which reminders your clients receive.

Marketing from us about new features and offers is only sent where we are allowed to. Every marketing email has an unsubscribe link, and you can opt out any time in the app or by emailing us.

Messages you send your clients through the app are your responsibility. You must have a lawful basis to contact them and must honour their opt-outs. Do not use the app to send unsolicited marketing.

15. Cookies and app analytics

This website uses only what is strictly necessary to serve the pages you ask for. We do not run advertising cookies or third-party tracking pixels on it. Web fonts are loaded from Google Fonts, which receives your IP address in order to serve them.

The app uses a device or installation identifier and collects the usage and crash data described in section 4, to keep it working and improve it. We do not use it for advertising, we do not track you across other companies' apps and websites, and we do not ask for the App Tracking Transparency permission.

You can control app analytics in your device settings and, where offered, in the app's own privacy settings.

16. Children

The app is for salon businesses and is not intended for children. We do not knowingly collect data directly from anyone under 16 for our own purposes.

A salon may hold records for a client who is under 16, a child's haircut for example. Where that happens the salon is the controller and is responsible for obtaining consent from a parent or guardian and for handling that record appropriately.

17. Changes to this policy

We will update this policy when the app or the law changes. The version number and date at the top always show the current version. If a change materially affects you, we will tell you in the app or by email before it takes effect.

18. Contact and complaints

Data protection enquiries: privacy@yoursalon.uk
General support: support@yoursalon.uk
Post: [Company name], [registered address]

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 · ico.org.uk/make-a-complaint