Last updated: 3 September 2026
Who we are
All Hair & Beauty ("we", "us", "our") is the data controller for personal information collected through our website, online booking, client account, and salon services at our Nottingham studios.
Registered contact: info@allhairandbeautysalon.com. Postal address: 26 Peveril Street, Radford, Nottingham NG7 4AL.
We are registered with the Information Commissioner's Office (ICO) as a data controller. Our registration number is available on request.
Information we collect
- Identity and contact: name, email, phone number.
- Account details: login credentials (held securely by our authentication provider), profile photo URL, marketing preferences.
- Booking and visit data: appointments, salon location, service, stylist, notes you provide, deposit and payment status.
- Beauty profile: hair type, preferences, allergies, and similar notes you choose to save.
- Intake and consultation forms: answers and consent you submit before treatment (which may include health-related information you choose to provide).
- Orders and loyalty: shop purchases, points, referrals, gift cards, and membership interest.
- Messages and notifications: in-app notifications and studio messages sent to your account.
- Technical data: essential session cookies, device/browser type, and server logs needed to run the site securely.
How and why we use your information
- To take and manage bookings, deposits, and appointments (contract).
- To provide your client account, appointment history, and salon communications about your visits (contract / legitimate interests).
- To keep salon records for health, safety, and professional care where you have provided information (legitimate interests / legal obligation where applicable).
- To send marketing emails or texts only where you have opted in (consent). You may withdraw consent at any time in account settings or by contacting us.
- To improve our website and prevent fraud or misuse (legitimate interests).
Lawful bases (UK GDPR)
We rely on contract performance for bookings and account services, consent for optional marketing and certain intake questions, legitimate interests for operating a safe salon and website, and legal obligation where we must retain certain financial or tax records.
Where intake forms collect health-related information, we rely on your explicit consent or another lawful basis explained on the form at the time you complete it.
Children and young clients
We style clients of all ages. Where a child under 18 uses our online services, a parent or guardian should make the booking and provide contact details. We do not knowingly market directly to children.
How long we keep information
- Account and profile data: while your account is active. When you delete your account, we remove direct identifiers from linked records where we no longer need them for legal or operational purposes.
- Appointment and payment records: as required for accounting, tax, and salon operations (typically up to six years for financial records where applicable). Identifying guest fields on past appointments may be anonymised after account deletion.
- Marketing preferences: until you withdraw consent or we no longer need the record.
- Intake submissions: for the period needed to support your care and our professional records; personal answers may be redacted when your account is deleted.
Your rights
- Access — request a copy of your personal data.
- Rectification — correct inaccurate information in your account or by contacting us.
- Erasure — request deletion of your account from Settings. We anonymise or remove personal identifiers where possible; anonymised appointment and financial records may be kept for legal obligations.
- Portability — download your account data from Settings.
- Objection — object to processing based on legitimate interests, including direct marketing.
- Withdraw consent — for marketing at any time without affecting lawful processing before withdrawal.
- Complain to the ICO — ico.org.uk if you are unhappy with how we handle your data.
Security
We use industry-standard measures including encrypted connections (HTTPS), access controls, and row-level database security. No method of transmission over the internet is completely secure; we work to protect your data proportionately.
Contact us about privacy
For privacy questions or to exercise your rights, email info@allhairandbeautysalon.com with the subject "Privacy request". We aim to respond within one month.