Privacy policy

Who we are

NTA Beauty Ltd, trading as NTA Beauty Studio, is the controller of the personal information we collect to run our business and provide treatments and memberships. This policy explains how we use that information under the UK GDPR and the Data Protection Act 2018, as amended. For privacy questions or requests, email ntabeautyltd@gmail.com.

Information we collect

• Contact details, such as your name, email address, telephone number and any address or date of birth needed for your booking or consultation.
• Booking and membership details, including your chosen location, treatments, appointments, attendance, cancellations and messages you send us.
• Health and consultation information you provide, including relevant medical history, medication, allergies, pregnancy, surgery, contraindications, consent forms and treatment or aftercare notes. Health information is special category personal data.
• Payment and transaction records, such as amounts paid, billing details, payment status, refunds and membership subscription references. Stripe processes card payments; we do not receive or store your full card number or security code.
• Limited technical information, such as IP addresses, browser details and security logs generated when you visit the website.

We receive information directly from you and, where relevant, through Solo when you book and Stripe when you pay. Please only provide information needed for your enquiry or care.

Why we use it and our lawful bases

• To arrange bookings, administer memberships, take payments and provide services: performance of our contract with you, or steps you ask us to take before entering a contract.
• To answer enquiries, maintain appropriate business records, protect our website and deal with complaints: our legitimate interests in operating a safe, reliable business, balanced against your rights.
• To keep accounting records and comply with applicable legal obligations: legal obligation.
• To assess treatment suitability and plan safe treatment using your health information: your explicit consent. We ask for this separately during consultation; accepting this privacy policy alone does not give consent. Where necessary to establish, exercise or defend legal claims, a separate legal-claims condition may apply.
• To send optional promotional messages or publish identifiable treatment photographs: your separate consent. You can unsubscribe or withdraw that consent at any time.

You can withdraw consent by contacting us. This does not affect processing already carried out lawfully. If you do not provide necessary booking or health information, or withdraw consent needed to assess suitability, we may be unable to book or safely provide a treatment. We do not use solely automated decision-making that has legal or similarly significant effects on you.

Solo, Stripe and other recipients

Bookings are managed through Solo, which handles information needed to arrange and administer appointments. Payments and recurring membership charges are processed through Stripe, which handles payment information and fraud prevention. Each provider also explains its own processing in the privacy information available through its service; see Stripe’s privacy policy.

Information may also be handled by service providers supporting our website, communications and secure record keeping, and shared where necessary with professional advisers, insurers, or authorities where the law requires or permits it. Access is limited to what is needed for the relevant purpose. We do not sell your personal information.

Where a provider processes information outside the UK, applicable transfer safeguards must be in place, such as UK adequacy regulations or approved contractual safeguards. Contact us for details of the safeguards relevant to your information.

How long we keep information

We keep information only for as long as needed for the purpose for which it was collected. The period depends on the record:

• Enquiries: until the enquiry and any necessary follow-up are resolved, unless they become part of a client record.
• Booking, consultation, consent and treatment records: while you are a client and afterwards for the period needed to meet applicable insurance requirements, resolve complaints or address potential legal claims. The period is assessed using the treatment, your age, the sensitivity of the information and any relevant limitation period; a specific ongoing claim may require longer retention.
• Accounting and payment records: normally six years from the end of the relevant company financial year, or longer if required for an investigation or other legal obligation.
• Marketing preferences: until you withdraw consent or the information is no longer needed. We may retain a minimal suppression record to ensure we respect an opt-out.
• Technical and security records: only as long as reasonably necessary to investigate problems, protect the service or meet a legal obligation.

Records are reviewed and deleted securely or anonymised when no longer needed. You can ask us for the retention period or criteria applying to your particular record.

Keeping information secure

We use appropriate organisational and technical measures to protect personal information against unauthorised access, loss or misuse, with access restricted to those who need it. No online service is completely risk-free. Please contact us if you believe information you have provided has been compromised.

Your rights

Depending on the circumstances, you can ask to access your information, correct inaccuracies, erase information, restrict processing or receive eligible information in a portable format. You can object to processing based on legitimate interests and to direct marketing at any time. You can also withdraw consent where we rely on it.

These rights are subject to legal conditions; for example, we may need to retain some records to meet a legal obligation or deal with a claim. Email ntabeautyltd@gmail.com to make a request. We may need to verify your identity. We normally respond within one month; where a lawful extension applies, we will explain why. Requests are normally free of charge.

You can complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, through ico.org.uk/make-a-complaint or on 0303 123 1113. You can contact us first so we can try to resolve your concern, but you do not have to.

Cookies and external services

Essential cookies or similar technologies may be used to operate and secure the website or booking and payment services. Non-essential analytics or advertising technologies require consent where applicable. When you follow a link to Solo, Stripe or another external service, its own privacy and cookie information applies.

Changes to this policy

We may update this policy to reflect changes in our services or legal requirements. The date above shows the latest revision. Where required, we will bring material changes to your attention.