1. Who We Are (Data Controller)

Welcome to HAIR BY EVA LTD (“we”, “our”, or “us”). We operate the website https://hairbyeva.uk/ and provide professional hair care, styling, and technical salon services. We take the privacy and security of your personal data very seriously.

This Privacy Policy informs you about how we look after your personal data when you visit our website, submit enquiries, book consultations or appointments, and visit our salon. It also tells you about your privacy rights and how the law protects you under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations (PECR).

HAIR BY EVA LTD is the registered Data Controller responsible for your personal information.

2. Personal Data We Collect

Personal data means any information relating to an identified or identifiable living individual. Depending on your interactions with us, we may collect, store, and process the following categories of data:

• Identity & Contact Data: First name, surname, telephone number, mobile number, and email address.
• Appointment & Transaction Details: Booked services (e.g., Balayage, Air Touch Balayage, Highlights, Keratin Treatment, Extensions, Styling), appointment dates and times, booking deposits (50% deposit required under salon policy), cancellation or rescheduling history, and referral promo details (“Recommend a friend”).
• Hair History & Salon Notes: Client profile notes detailing previous colour formulas, bleach processes, bond-building treatments, condition of hair and scalp, and styling preferences to guarantee consistent and safe service delivery.
• Communication & Form Data: Any enquiries, messages, or information sent via our website contact form (Contact Form 7), direct email, telephone calls, SMS, or direct messages on our official social media channels.
• Technical & Analytics Data: IP address, device type, browser model and version, operating system, time zone, referral sources, pages visited, and interaction data collected through Google Site Kit and Google Analytics.

3. Special Category Data (Skin & Allergy Patch Tests)

Under Article 9 of the UK GDPR, data concerning health is classified as Special Category Personal Data and receives extra protection under the law.

In accordance with product manufacturer guidelines, good hairdressing industry practice, and our salon public liability insurance requirements, we collect and retain:

• Records that a patch test was administered, including date, product/batch reference, and test site.
• The outcome of the patch test (no adverse reaction or recorded sensitivity/reaction).
• Any declared allergies, skin conditions, scalp sensitivities, or medical contraindications disclosed during your consultation.

We process this sensitive data strictly under Article 9(2)(a) of the UK GDPR (Explicit Consent) and Article 9(2)(f) (Establishment, exercise, or defence of legal and insurance claims).

4. How We Collect Your Data

We collect personal information through the following avenues:

• Direct Interactions: You provide information when you speak to us on the phone (07576 489844), send an email to info@hairbyeva.uk, complete a website enquiry form, book a consultation, pay a deposit, or fill out a client record card at our salon.
• Automated Technologies: When you navigate https://hairbyeva.uk/, technical data is collected via server logs and Google Analytics 4 tags (managed via Google Site Kit).
• Social Media: When you engage with our public profiles on Instagram (@hair_by_eva__), Facebook, or TikTok.

5. Lawful Bases for Processing

Under Article 6 of the UK GDPR, we only collect and use your personal information when we have an appropriate legal ground:

6. How We Use Your Data

We use your personal data to:

• Coordinate and confirm your appointments with our stylists (Eva and Christina).
• Manage salon scheduling and apply our 48-hour cancellation and deposit forfeiture policy.
• Safely prepare personalized colour formulas, treatments, and techniques tailored to your hair type.
• Send practical appointment reminders, notices, and answers to your service requests.
• Track promotional eligibility (e.g. applying new client discounts and referral rewards).
• Maintain salon security, prevent fraudulent transactions, and preserve insurance documentation.

We do not sell, rent, or trade your personal information to third-party marketing companies.

7. Data Sharing & Third-Party Services

We may share personal data with trusted third-party service providers who operate strictly as data processors under our instructions:

• Website & Infrastructure Providers: Web hosting providers, email hosts, and technical web support agencies (e.g., A-WD) maintaining our website and server.
• Analytics & Tag Services: Google Ireland Limited / Google LLC (Google Tag Manager, Google Analytics 4) to monitor website performance and traffic metrics.
• Payment Gateways & Banking: Certified payment terminals or banking services utilized for processing booking deposits. No complete credit or debit card numbers are stored on our website server.
• Professional Advisors & Insurers: Salon public liability insurers, legal counsel, and chartered accountants as necessary for risk management, claims, and statutory reporting.
• Statutory Authorities: HM Revenue & Customs (HMRC), the police, or regulatory authorities when compelled by statutory legal requirements.

8. International Data Transfers

Certain digital services we use (such as Google Tag Manager, Google Analytics, or Google Fonts) may process or store data outside the United Kingdom, including on servers located in the European Union or the United States.

Whenever personal data is transferred internationally, we ensure adequate protection is provided by relying on approved UK transfer mechanisms, including the UK International Data Transfer Agreement (IDTA), UK Addendum to EU Standard Contractual Clauses (SCCs), or the UK Extension to the EU-US Data Privacy Framework.

9. Data Retention (How Long We Keep Your Data)

We keep your personal information only for as long as necessary to satisfy the purposes for which it was obtained:

• Client Patch Test & Treatment Records: Kept for a minimum of 6 to 7 years from the date of your last visit. This aligns with UK statutory limitation periods for personal injury claims and fulfills salon public liability insurance policy conditions.
• Financial & Deposit Records: Retained for 6 years following the end of the relevant financial tax year in accordance with HMRC statutory rules.
• Enquiries & General Messages: Enquiries that do not culminate in an appointment booking are routinely deleted after 12 months.
• Google Analytics Data: Retained in Google Analytics for up to 14 months, after which event data is automatically purged.

10. Data Security Measures

We maintain appropriate technical and organizational measures to safeguard your personal data:

• Full SSL/TLS encryption across our website (https://hairbyeva.uk/) ensuring all data in transit is encrypted.
• Restricted, password-protected administrative access to website backend, contact form logs, and salon booking systems.
• Confidential handling of all client patch test cards, allergy notes, and personal contacts.
• Continuous monitoring, theme updates, and security patch application on our WordPress platform.

11. Cookies & Tracking Technologies

Our website utilizes cookies and related web technologies to provide an optimal browsing experience.

What Are Cookies?

Cookies are small text files placed on your computer or mobile device when you browse websites. They are widely used to make websites work efficiently and provide usage information to website operators.

Cookies We Use

• Strictly Necessary Cookies: Essential for core website operations, page navigation, security tokens (CSRF protection), and WordPress administrative sessions.
• Analytics Cookies (Google Analytics 4 / Google Site Kit): Help us understand how visitors arrive at and interact with our website. Tag ID: GT-MKTRTN9F. Data is processed in aggregated, pseudonymised form.
• External Web Fonts: We load Google Fonts (fonts.googleapis.com) to display salon typography.

How to Control Cookies

You can adjust your web browser settings to block or delete cookies at any time. Consult your browser's Help menu (e.g. Chrome, Safari, Edge, Firefox) for instructions. Please note that blocking essential cookies may impact website display and functionality.

12. Your Legal Rights (UK GDPR)

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you possess comprehensive rights over your personal data:

• Right of Access: Request a copy of the personal information we hold about you (Subject Access Request).
• Right to Rectification: Request correction of inaccurate, outdated, or incomplete information.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data where there is no compelling legal or insurance obligation for us to retain it.
• Right to Restriction: Request restriction of processing under certain circumstances.
• Right to Object: Object to processing carried out based on legitimate interests or direct marketing.
• Right to Data Portability: Request that digital data you provided be transferred to you or another service provider in a structured, machine-readable format.
• Right to Withdraw Consent: Withdraw previously granted consent at any time (e.g. for marketing or patch testing before treatment proceeds).

To exercise any of your statutory rights, please contact us at info@hairbyeva.uk. We respond to verified requests within one calendar month at no charge.

13. Questions, Complaints & The ICO

If you have any questions or wish to raise a concern regarding how your personal information is handled, please reach out to us at info@hairbyeva.uk so that we may assist you immediately.

You also have the legal right to lodge a complaint at any time with the UK data protection supervisory authority:

14. Contact Information & Policy Updates

We may update this Privacy Policy periodically to reflect operational changes, new service offerings, or revisions in data protection laws. Any modifications will be posted directly to this URL with an updated revision date.

For any questions, requests, or privacy enquiries, please contact: