Privacy Notice.

1. Who we are

Infinity Hair & Beauty Lab Ltd is the data controller responsible for the personal information described in this notice. We trade as Infinity Hair & Beauty Lab and Infinity Hair & Beauty Lab Academy.

• Company number: 14472484
• Registered in England and Wales
• Trading as: Infinity Hair & Beauty Lab and Infinity Hair & Beauty Lab Academy
• Email: salon@infinityhairlab.co.uk
• Telephone: 07305 390112
• Website: infinityhairlab.co.uk

2. Information we collect

Depending on how you use our services, we may collect:

• your name, telephone number, email address and other contact details;
• details of salon appointments, services, specialists, dates, times, cancellations and rescheduling;
• Academy enquiries, course bookings, attendance, training records, previous qualifications, experience and certificate information;
• information about students and live models that is necessary to arrange and deliver practical training;
• information you provide in messages, enquiries, complaints or conversations with our team;
• treatment consultation information;
• information about allergies, sensitivities, contraindications, medical conditions or previous reactions where relevant to a salon treatment or practical training;
• patch-test dates, results and related treatment notes;
• photographs, videos, before-and-after images, consent records and information about how those images may be used;
• parent or guardian contact and consent information where a client, student or model is under 18;
• payment and transaction records, although payment is currently taken at the salon or arranged directly and we do not collect card details through this website;
• limited technical information such as IP address, browser information, security logs, functional cookies and other website data needed to operate and protect the website.

Please only provide health, treatment, qualification or training information that is relevant to the salon service or Academy course you are requesting. Contact, booking and course-registration information is needed to arrange and perform our contract with you. If required information is not provided, we may be unable to accept a booking, deliver a service, provide practical training or issue a certificate.

3. How we collect information

We may collect information:

• when you make or manage a salon appointment through our website;
• when you enquire about, book or attend an Academy course, workshop or masterclass;
• when you take part in practical training as a student or live model;
• when you contact us by telephone, email, social media or in person;
• when you complete a consultation, patch-test, health and safety or consent record;
• when you provide previous qualification, experience or insurance information for a course;
• when a parent or guardian provides information or consent for a person under 18;
• when a member of our team creates or updates a booking or record on your behalf;
• when photographs or videos are taken with the appropriate permission;
• automatically through security logs, functional cookies and website technologies needed to operate and protect the website.

4. How we use your information

We use personal information to:

• create, confirm, manage, reschedule and cancel salon appointments and Academy bookings;
• provide the requested hair and beauty services;
• identify an appropriate service, specialist, course or educator;
• assess whether a treatment or practical activity is suitable and safe;
• record consultation, patch-test, attendance, practical training and certificate information;
• verify that a student meets the entry requirements for a course;
• arrange live models and supervise practical training;
• communicate important information about an appointment, course or training session;
• issue and verify Academy certificates where applicable;
• use photographs or videos for agreed educational, portfolio or promotional purposes where the appropriate permission has been obtained;
• respond to enquiries, complaints and data protection requests;
• keep financial, insurance and business records;
• protect our website, clients, students, models, staff and business;
• establish, exercise or defend legal claims.

5. Our lawful bases

Under UK data protection law, we must have a lawful basis for using personal information.

Contract

We use information when it is necessary to arrange and provide a salon appointment, Academy course or practical training, or to take steps requested by you before entering into a contract.

Legal obligation

We may keep and use information where necessary to comply with accounting, tax and other legal obligations.

Legitimate interests

We may use information where necessary for the legitimate operation and protection of our business, including customer service, appointment and course administration, maintaining appropriate training and certificate records, security, complaint handling and legal claims. We consider the impact on your rights before relying on this basis.

Consent

Where required, we ask for consent for a specific purpose. This may include marketing communications, identifiable photography or video, and certain uses of health-related information. Consent is optional unless the relevant information is necessary to carry out a treatment or practical activity safely. You can withdraw consent at any time, although this will not affect processing that took place before consent was withdrawn.

6. Health and treatment information

Information about allergies, medical conditions, contraindications, sensitivities, reactions and patch-test results may be health information and therefore special category personal data.

We only collect this information where it is relevant and necessary to assess the suitability and safety of a salon treatment or practical Academy activity, provide services safely, fulfil our duty of care or establish, exercise or defend legal claims.

For routine collection and use of relevant health information, we normally rely on your explicit consent under Article 9(2)(a) of the UK GDPR, alongside an appropriate Article 6 lawful basis. Where processing is genuinely necessary to establish, exercise or defend a legal claim, we may rely on Article 9(2)(f). We do not use the legal-claims condition as a general basis for collecting health information.

If relevant information is not provided, we may be unable to carry out a treatment or practical training activity safely.

7. Who we share information with

We only share personal information where it is necessary and lawful. This may include:

• authorised salon staff, specialists, Academy educators and administrators who need the information to manage or provide your appointment, course or practical training;
• students or models where limited information must be shared to arrange supervised practical training;
• website hosting, email, booking-system, technical support, backup and security providers;
• payment and card-terminal providers for payments made at the salon or for Academy training;
• website review-widget and content-delivery providers that may receive limited technical information when their content is loaded;
• photographers, website providers, social-media platforms or print suppliers where you have agreed to a particular use of identifiable photographs or videos;
• professional advisers such as accountants, insurers, legal advisers and IT specialists;
• regulators, courts, law enforcement or public authorities where disclosure is legally required;
• another organisation where necessary in connection with a business sale, restructuring or legal claim.

Our website is hosted using Hostinger and operates using WordPress and the Amelia booking plugin. Salon appointment and any Academy booking information entered through the booking system is stored within our website database. Providers acting on our behalf are required to handle information only for authorised purposes and with appropriate safeguards.

Google Calendar synchronisation, SMS notifications, website analytics and Meta advertising tools are not currently connected to our booking system or website.

We do not sell or rent personal information.

8. International transfers

Some technology, payment, email, website or social-media providers and their subcontractors may process information outside the United Kingdom.

Where a restricted international transfer takes place, we require an appropriate legal safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard permitted by UK data protection law.

You can contact us to request further information about the safeguards used for international transfers.

9. How long we keep information

We keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected.

• Customer profiles, salon appointment records and relevant communications are normally kept for up to six years after your last appointment or interaction with us.
• Relevant consultation, allergy, contraindication and patch-test records are normally kept for up to six years after the related treatment or practical activity, or your last appointment or course.
• Academy booking, attendance, training, assessment and certificate records are normally kept for up to six years after completion of the course or your last interaction with the Academy.
• Live-model records and relevant consent or health and safety records are normally kept for up to six years after the related training session.
• Financial and accounting records are normally kept for six years after the end of the financial year to which they relate.
• Enquiries that do not result in an appointment or Academy booking are normally deleted within 12 months.
• Marketing contact information is kept until consent is withdrawn, you unsubscribe or it is no longer reasonably required.
• Photography and video consent records are retained while the related material is used and for a reasonable period afterwards. Source files are deleted when they are no longer required for the agreed purpose, subject to legal, insurance and record-keeping requirements.
• Parent or guardian information is retained for the same period as the related client, student or model record.
• Security logs and backup copies are retained in accordance with operational security and backup schedules and are deleted or overwritten when no longer required.

Information may be kept longer where required by law, an insurer, an active complaint, an investigation or an actual or anticipated legal claim.

At the end of the applicable period, information will be securely deleted or anonymised.

10. Cookies and similar technologies

Our website uses cookies or similar technologies that are necessary for security, website operation and the booking process. It may also load third-party content, such as a reviews widget, which can receive limited technical information including an IP address and browser or device information.

We do not currently use Google Analytics, Meta Pixel or similar advertising or behavioural tracking technologies.

Where a third-party feature sets a non-essential cookie or another non-essential analytics or advertising technology is introduced, we will provide information about it and request consent before activation where required by law.

11. Marketing, photography & video

We do not currently use information submitted through the booking form for general email or SMS marketing.

If marketing communications are introduced, we will request any consent required by law and provide a simple way to unsubscribe. Declining marketing will not affect a salon appointment, Academy booking or training.

We may ask to take photographs or videos of salon work, before-and-after results, Academy demonstrations, practical work, students, models or achievements for educational, portfolio or promotional purposes.

We will ask for permission before using an identifiable photograph or video for promotional purposes. Consent is optional, and refusing it will not affect the salon service or Academy training you receive.

Where permission is given, material may be used on our website, social-media accounts, online portfolio, printed materials or other channels described when consent is requested.

You can withdraw consent for future use by contacting us. This will not affect processing that took place before withdrawal and may not require us to recall material that was already lawfully printed, distributed or published by another person.

12. How we protect information

We use appropriate technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, alteration or disclosure.

Access to booking, treatment, training, health and consent information is limited to authorised people who need it for their work. However, no website or electronic storage system can be guaranteed to be completely secure.

13. Your data protection rights

Depending on the circumstances and lawful basis, you may have the right to:

• ask for a copy of your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information;
• ask us to restrict how information is used;
• ask for information you provided to be transferred;
• withdraw consent where processing relies on consent.

These rights are not absolute and may be limited where we have a legal obligation or another lawful reason to retain or use the information.

Your right to object

You have the right to object to our use of your personal information where we rely on legitimate interests. You also have an absolute right to object to direct marketing. Contact us using the details below if you wish to object.

To exercise a right, contact salon@infinityhairlab.co.uk.

We may need to verify your identity before responding.

14. Complaints

If you have concerns about how we use your information, please contact us first so that we can investigate:

salon@infinityhairlab.co.uk or 07305 390112.

You also have the right to complain to the Information Commissioner's Office.

Make a complaint to the ICO ↗

15. Automated decision-making

We do not use personal information to make solely automated decisions that have legal or similarly significant effects on you.

16. Changes to this notice

We may update this privacy notice when our services, technology providers or legal obligations change.

The latest version will always be published on this page with its updated date. Where a change materially affects how we use personal information, we will take reasonable steps to bring it to your attention.