privacy policy.

The Face and Body Company “I”, “me,” “my” is committed to protecting your privacy. There are various ways that you might interact with the Face And Body Company and the information you provide when doing so allows me to improve my service.

I, Rhiannon Amy Park, am the primary data controller for the purpose of the data held.

My website, www.faceandbodyco.com that also links to this Privacy Policy (‘website’) is owned and operated by The Face and Body Company, 20 Petlands Road, Haywards Heath, RH16 4HH.

This Privacy Policy explains the following:

What information I collect and why I collect it

How I use your information

How I share collected information

How I protect your information

How long I keep your information

Your rights and control of your information

Changes to the policy

Contacting Me

This Privacy Policy applies to The Face and Body Company, and covers my processing activities as a data controller.

I may alter the terms in this Privacy Policy at any time by posting the amended terms.

All amended terms will automatically take effect 30 days after they are posted.

I will announce any relevant changes and their rationale to this Privacy Policy via email.

The Face and Body Company is not intended for or directed at children under the age of 18 years without the presence of a consenting parent or adult with parental responsibility for the child. As such, the site is designed for adult user interaction. I do not intentionally collect personally identifiable information from children under the age of 18.

What information I collect And Why I Collect It

I collect personal information which you may provide through the below means:

Visiting the The Face And Body Company Beauty Room at 20 Petlands Road, Haywards Heath, RH16 4HH

Verbally over the phone or in person

Digitally, through the use of online forms, cookies, the online customer booking system and through emails and text messages.

Personal information I collect includes:

Name and address

Date of Birth

Contact details including email and phone number

Medical records linked to a service and purchase.

This information will be collected, stored, accessed and processed in a secure manner.

I retain personal data, when and if it is necessary and relevant for my operations.

The data is retained for a period of time defined by my legitimate interest or relevant laws.

Once it is no longer necessary for me to hold your data I will dispose of it in a secure manner.

How I Use Your Information

I will only use your personal information if I have a legal basis for doing so. The purpose for which I use and process your information and the legal basis on which I carry out each type of processing is explained below.

I use collected data to; provide and improve my services, provide a personalised experience, contact you, provide you with customer service and to provide personalised marketing.

Data is processed for services and payments, customer support and fulfilment to enable me to perform my contract with you.

Data is used to provide you with information and materials that you request from me, to personalise my services, plus my website, to you, the user.

I process data to update you on services and products and benefits I offer and to inform you of changes to my policies, other terms and conditions and other administrative information plus to administer my website for you and your computer, mobile device or other item of hardware through which you access the website and to keep the website safe and secure.

Data is used to measure or understand the effectiveness of any marketing I provide to you and others, and to deliver relevant marketing to you.

Data is used to enforce the terms and conditions and any contracts entered into with you.

If you do not wish to provide me with your personal data and processing such data is necessary for the performance of a contract with you and to fulfil my contractual obligations to you, I may not be able to perform my obligations under the contract between us.

Where you provide consent, you can withdraw your consent at any time, but without affecting the lawfulness of processing based on consent before its withdrawal. You can update your details or change your privacy preferences by contacting me.

Data is used on the legal basis of my legitimate interest and to provide you a personalised experience and to provide you with personalised advertising and marketing which includes seasonal campaigns via email and SMS messaging. You have the right to opt out of all marketing at any time.

Note that I may process your personal data for more than one lawful ground if the data is used for several purposes. Please contact me if you need details about the specific legal ground I am relying on to process your personal data where more than one ground has been used.

I strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

I will only use your personal information for the purposes for which I collected it, unless I reasonably consider that I need to use it for another reason and that reason is compatible with the original purpose. If I need to use your personal information for an unrelated purpose, I will notify you in a timely manner and explain the legal basis which allows me to do so.

How I Share Your Information

Your information will be shared with my third-party service providers who assist with running my website and my services including; email service providers, booking systems and SMS providers.

I remain the data controller with respect to any customer information that they use for the provision of services. To the extent that they are acting as data processor, they therefore act in accordance with the instructions I give them regarding the collection, processing, storage, deletion and transfer of customer information, as well as other matters such as the provision of access to and rectification of customer data.

They will only use such personal information for the purposes of providing the services and products for which I have engaged them.

They will retain personal information which they process on behalf of me for as long as needed to provide services and products in accordance with any agreement in place between us.

I use a booking system provided by Hotspring Ventures Limited who operate as a data processor and collect and process personal information on behalf of myself the data controller in the provision of my booking services and products. Their privacy policy can be found here https://www.treatwell.co.uk/info/privacy-policy/, alternatively, I can provide a copy if you wish to view it.

I use email service provider ‘Mailchimp’ who operate as a data processor and collect and process personal information on behalf of myself the data controller in the provision of my email services and products. Their privacy policy can be found here https://mailchimp.com/legal/, alternatively, I can provide a copy if you wish to view it.

In acting as a data processor, the above providers will refer any request from an individual for access to personal information which they hold about them to the data controller. They will not respond directly to the request.

I will not sell, rent, lease or otherwise share your information other than as outlined in this Privacy Policy or without obtaining your consent beforehand.

I may link to, or show content from third party websites as a service to you but will not share your information without your prior consent. These third-party websites are operated by companies that are outside of my control, and your activities at those third-party websites will be governed by the policies and practices of those third parties. I encourage you to review the privacy policies of these third parties before disclosing any information to them, as I am not responsible for the privacy policies of those websites.

In addition, I may disclose information about you when I believe, in good faith, that such use or disclosure is reasonably necessary to:

Comply with law

Enforce or apply the terms of any of my user agreements

Protect my rights, property or safety, or the rights, property or safety of my users, or others.

In the event that I become involved in a business divestiture, change of control, sale, merger, or acquisition of all or a part of my business, in which case I may disclose your personal information to the prospective seller or buyer of such business or assets;

If all or substantially all of my assets are acquired by a third party, in which case personal information held by it about its customers will be one of the transferred assets;

If I am under a duty to disclose or share your personal information in order to comply with any legal or regulatory obligation;

If necessary to protect the vital interests of a person; and to enforce or apply my terms and conditions or to establish, exercise or defend the rights of The Face And Body Company, customers or others.

How I Protect Your Information

The security of your personal information is very important to me. I follow industry standards and law to protect the personal information you submit to me.

Physical files are kept in one location, under secure lock and key.

I use appropriate measures to safeguard personally identifiable information, which measures are appropriate to the type of information maintained and follows applicable laws regarding the safeguarding of any such information under my control. In addition, when storing information including digital images, encryption technology may be used to enhance information privacy and help prevent loss, misuse, or alteration of the information under my control. I also employ industry-standard measures and processes for detecting and responding to inappropriate attempts to breach my systems.

No method of transmission over the Internet, or method of electronic storage, can be 100% secure. Therefore, I cannot guarantee the absolute security of your information. The Internet by its nature is a public forum, and I encourage you to use caution when disclosing information online. Often, you are in the best situation to protect yourself online. You are responsible for protecting your username and password from third party access, and for selecting passwords that are secure.

If you have any questions about security, you can contact me as provided in “Contacting Me” below.

How Long I Keep Your Information

When you contact me, I may keep a record of your communication to help solve any issues that you might be facing. Your information may be retained for as long as necessary to fulfil the purposes I collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirement.

To determine the appropriate retention period for personal data, I consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which I process your personal data and whether I can achieve those purposes through other means, and the applicable legal requirements. Details of retention periods for different aspects of your personal data are available in my retention policy which you can request by contacting me.

Your Rights and Control of Your Information

Subject to certain limitations, you have rights under data protection laws in relation to your personal data. These rights include the rights to:

Request access to your personal data – (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data I hold about you and to check that I am lawfully processing it. Note that I may refuse to comply with a request for access if the request is manifestly unfounded or excessive, or repetitive in nature.

Request correction of your personal data – this enables you to have any incomplete or inaccurate data I hold about you corrected, though I may need to verify the accuracy of the new data you provide to me. Note that I may refuse to comply with a request for correction if the request is manifestly unfounded or excessive, or repetitive in nature.

Request erasure of your personal data – this enables you to ask me to delete or remove personal data where there is no good reason for me to continue to process it. You also have the right to ask me to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where I may have processed your information unlawfully or where I am required to erase your personal data to comply with local law. Note that I may refuse a request for erasure, for example, where the processing is necessary to comply with a legal obligation or necessary for the establishment, exercise or defense of legal claims.

Request restriction of processing your personal data – this enables you to ask me to suspend the processing of your personal data in the following scenarios: (a) if you want me to establish the data’s accuracy; (b) where my use of the data is unlawful but you do not want me to erase it; (c) where you need me to hold the data even if I no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to my use of your data but I need to verify whether I have overriding legitimate grounds to use it. Note that I may refuse to comply with a request for restriction if the request is manifestly unfounded or excessive, or repetitive in nature.

Request transfer of your personal data – I will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies where your personal data is processed by me with your consent or for the performance of a contract and when processing is carried out by automated means.

Right to withdraw consent – you can withdraw your consent at any time where I am relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. You can ask me to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting me at any time.

Your Right To Object

You have the right to object where I am processing your personal data. In some cases, I may demonstrate that I have compelling legitimate grounds to process your information which override your rights and freedoms.

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal information which is based on my legitimate interests. Where you object on this ground, I shall no longer process your personal information unless I can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Exercising Your Rights

If you wish to exercise any of the rights set out above, including withdrawing consent, please contact me giving me specific details regarding which right you choose to exercise.

Access Fee

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, I may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, I may refuse to comply with your request in these circumstances.

What I May Need From You

I may need to request specific information from you to help me confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. I may also contact you to ask you for further information in relation to your request to speed up my response.

Time Limit To Respond

I try to respond to all legitimate requests within one month. Occasionally it may take me longer than a month if your request is particularly complex or you have made a number of requests. In this case, I will notify you and keep you updated.

Please direct any questions about your information to the Data Protection Contact identified above.

Complaints

You have the right to make a complaint at any time with a supervisory authority, in particular in the EU (or EEA) state where you work, normally live or where any alleged infringement of data protection laws occurred. The supervisory authority in the UK is the Information Commissioner (www.ico.org.uk).

If I receive formal written complaints, I will follow up with the person making the complaint. I work with the appropriate regulatory authorities to resolve any complaints that cannot be resolved directly. I would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact me in the first instance.

Changes to this Policy

I regularly review my compliance with my privacy policy.

I may change this privacy policy from time to time. If this privacy policy changes, the revised privacy policy will be posted at the “Privacy Policy” link on my website’s home page. In the event that the change is significant or material, I will notify you of such a change by revising the link on the home page to read “Newly Revised Privacy Policy.” Please check the privacy policy frequently. Your continued use of my website constitutes acceptance of such changes in the privacy policy, except where further steps are required by applicable law. This privacy policy was last updated on the date set out at the end of the policy.

Contacting Me

If you have any questions about this Privacy Policy or your information, or to exercise any of your rights as described in this Privacy Policy or under data protection laws, you can contact me:

By Post: Miss Rhiannon Park, The Face And Body Company, 20 Petlands Road, Haywards Heath, West Sussex RH16 4HH

By Email: enquiries@faceandbodyco.com

This Privacy Policy was last Revised on 31/01/2024