Legal

Privacy notice

This explains what Who Cares does with your personal information, in plain terms. It applies to this website and to bookings made through it.

Who is responsible for your information

Who Cares is a one-person beauty studio in South Shields, operated as a sole trader, and is the data controller for everything described here. You can reach us about any of it by emailing olga@who-cares.app. The studio operates from a private address, which is given in full with your booking confirmation and is available on request.

What is collected

Your account — name and email address, so an appointment can be attached to you and confirmations can be sent.
Your bookings — the treatments chosen, the date and time, any notes you add, and what was charged.
Optional consultation details — allergies, skin sensitivities, relevant medical information and treatment preferences. This is entirely optional, it is never required to make a booking, and you can delete it at any time.
Patch test records — the date a tinting patch test was carried out, so it can be confirmed as in date.
Photographs — only where you have specifically agreed to them. A photograph of your treatment is never taken or published without your consent, that consent is recorded against the photograph itself, and you can withdraw it at any time, at which point the photograph comes down.
Notification preferences — if you turn on notifications, your browser gives us an anonymous address for your device so reminders can reach it. It identifies the device, not you, and turning notifications off removes it.
What you were charged — the amount and the date, recorded against your booking. Online payment is not switched on, so no card details are asked for or held anywhere.

Health-related information, such as allergies, is treated as special category data under UK GDPR. It is only collected with your explicit consent, only used to carry out your treatment safely, and is never used for marketing.

Why it is collected

To provide the treatment you booked — this is the performance of a contract with you.
To keep you safe during treatment, and to meet insurance requirements around patch testing — this relies on your explicit consent.
To keep accurate financial records — this is a legal obligation.
To show work in the gallery, where you have agreed to it — this relies on your consent, and only on your consent.
To send you marketing, but only if you have specifically opted in. You can opt out at any time, and every marketing email carries an unsubscribe link. Booking confirmations and reminders are not marketing and will still be sent.

Who else is involved

Running the booking system involves a small number of service providers. Each one only receives what it needs:

Supabase — stores the booking database, account logins and photographs. The database is hosted in London.
Make.com and Microsoft 365— carry confirmation, reminder and account emails from the studio's own mailbox. An email passes through Make's European service on its way to your inbox; the studio writes the email, and neither provider uses it for anything of their own.
Vercel — hosts the website itself.

Some of these providers are international companies, and where information is handled outside the UK it is done under the safeguards those providers have in place. Your information is never sold, and never shared with anyone for their own marketing.

How long it is kept

Booking and payment records are kept for six years, which is the period HMRC requires for business records.
Consultation and patch test records are kept while you remain a client and for a reasonable period afterwards, in case you return.
Photographs are kept until you ask for them to be removed, or until the consent behind them is withdrawn.
If you ask for your account to be deleted, personal details are removed and the financial record is reduced to what the law requires us to keep.

Your rights

Under UK GDPR you can ask to:

see a copy of the information held about you;
have anything inaccurate corrected;
have your information deleted, subject to the record-keeping above;
withdraw a consent you previously gave, at any time;
object to how your information is being used.

You can download a copy of your data and request deletion yourself from your account. If you are unhappy with how a request was handled, you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

This site sets only the cookies needed to keep you signed in and to keep your booking safe while you complete it. There is no advertising tracking and no third-party analytics, which is why you are not being asked to accept anything.

Contact

Email olga@who-cares.app about anything in this notice, including any of the rights above.