Legal

Privacy notice

This explains what Who Cares does with your personal information, in plain terms. It applies to this website and to bookings made through it.

Who is responsible for your information

Who Cares is a one-person beauty studio in South Shields, operated as a sole trader, and is the data controller for everything described here. You can reach us about any of it by emailing olga@who-cares.app. The studio operates from a private address, which is given in full with your booking confirmation and is available on request.

What is collected

Your account — name and email address, so an appointment can be attached to you and confirmations can be sent.
Your bookings — the treatments chosen, the date and time, any notes you add, and what was charged.
Optional consultation details — allergies, skin sensitivities, relevant medical information and treatment preferences. This is entirely optional, it is never required to make a booking, and you can delete it at any time.
Patch test records — the date a tinting patch test was carried out, so it can be confirmed as in date.
Photographs of your treatment— Olga may take a before and after photo of your nails, hands or feet. These are kept on your record so she can match a colour or shape next time, and may be shown in the gallery on this website or on the studio's social media. They show the work, not who you are, and your name is never shown with them. If you would rather they were not used, say so at your appointment or by email and they will not be.
Photographs that show your face — for brows and lashes. These are only ever shown publicly if you have said yes to that yourself, from your account. You can withdraw it there at any time: any photo of your face comes off this website straight away, and Olga will take down social media posts of you when you ask.
Credit and referrals— if Olga puts credit on your account for sending somebody our way, we record the amount, the reason and, where you have told us, who it was you introduced. That last part is a note about them as well as about you, so it is kept to the studio's own records and is never shown to other clients.
Notification preferences — if you turn on notifications, your browser gives us an anonymous address for your device so reminders can reach it. It identifies the device, not you, and turning notifications off removes it.
Payment records — the amount, the date, and a reference from our payment processor. Card numbers are never seen or stored by Who Cares.

Health-related information, such as allergies, is treated as special category data under UK GDPR. It is only collected with your explicit consent, only used to carry out your treatment safely, and is never used for marketing.

Why it is collected

To provide the treatment you booked — this is the performance of a contract with you.
To keep you safe during treatment, and to meet insurance requirements around patch testing — this relies on your explicit consent.
To keep accurate financial records — this is a legal obligation.
To show her work in the gallery and on social media using photos of nails, hands and feet — this is in the studio's legitimate interest in showing what it does, and never identifies you. You can object to it at any time.
To show photos that include your face — this relies on your consent, and only on your consent.
To send you marketing, but only if you have specifically opted in. You can opt out at any time, and every marketing email carries an unsubscribe link. Booking confirmations and reminders are not marketing and will still be sent.

Who else is involved

Running the booking system involves a small number of service providers. Each one only receives what it needs:

Supabase — stores the booking database, account logins and photographs. The database is hosted in London.
Make.com and Microsoft 365— carry confirmation, reminder and account emails from the studio's own mailbox. An email passes through Make's European service on its way to your inbox; the studio writes the email, and neither provider uses it for anything of their own.
Vercel — hosts the website itself.
Stripe — takes deposit payments. Stripe handles your card details directly; they are never sent to Who Cares.

Some of these providers are international companies, and where information is handled outside the UK it is done under the safeguards those providers have in place. Your information is never sold, and never shared with anyone for their own marketing.

How long it is kept

Booking and payment records are kept for six years, which is the period HMRC requires for business records.
Consultation and patch test records are kept while you remain a client and for a reasonable period afterwards, in case you return.
Photographs are kept while you remain a client, unless you ask for them to be removed. A photo of your face comes off the website as soon as you withdraw your yes to it.
If you ask for your account to be deleted, personal details are removed and the financial record is reduced to what the law requires us to keep.

Your rights

Under UK GDPR you can ask to:

see a copy of the information held about you;
have anything inaccurate corrected;
have your information deleted, subject to the record-keeping above;
withdraw a consent you previously gave, at any time;
object to how your information is being used.

You can download a copy of your data and request deletion yourself from your account. If you are unhappy with how a request was handled, you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

This site sets only the cookies needed to keep you signed in and to keep your booking safe while you complete it. There is no advertising tracking and no third-party analytics, which is why you are not being asked to accept anything.

Contact

Email olga@who-cares.app about anything in this notice, including any of the rights above.