Privacy policy

Last updated: [date]

Who we are

[Business name], [address], [company registration number if any] is responsible for your personal data. Contact: [email].

What we collect and why

When you book or buy something on this website we collect your name, email address, phone number (optional) and any notes you add. We use them to arrange your appointment, send your confirmation and contact you about your booking. The legal basis is the performance of our contract with you (Article 6(1)(b) GDPR). We keep a record of your order (what you booked, when and the amount paid) because accounting law requires it (Article 6(1)(c)).

Please do not write health information in the booking notes. We ask about anything relevant in person at your appointment.

Payments

Card payments are handled by Stripe. We never see or store your card details. Stripe processes your payment and email address under its own privacy policy: stripe.com/privacy.

Who else processes your data

• [Hosting provider, country] — hosts this website and its database.
• Stripe — payment processing.
• [Email provider, e.g. Brevo] — sends booking confirmations.
• [Google Calendar — if bookings are added to our calendar: which details]

We do not sell your data or use it for advertising.

How long we keep it

• Details entered at checkout without completing payment: deleted after [30] days.
• Gift vouchers and bundles: the code is kept until it expires; your email and any recipient name and message you added are removed together with your order details.
• Orders: your contact details are removed [after N months / when you ask]; the order record without them is kept for [N] years as required for our accounts.
• Server logs (including IP addresses): [a few] days.

Cookies

This website uses only cookies that are needed for it to work: one that remembers your basket while you book (deleted after checkout), and the payment form's own cookies set by Stripe to prevent fraud. We do not use analytics or advertising cookies. The site's fonts are served from our own server.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Email [email] and we will reply within one month. Where we must keep an order for accounting, we remove your contact details from it instead of deleting it.

You can also complain to a data protection authority — [e.g. the Office for Personal Data Protection].