Privacy notice

Who we are and how to contact us

Emma Hayes, trading as Dolled Up Nails & Beauty and Dolled Up Academy, is the data controller for personal information managed through Dolled Up systems and used for these services.

For privacy questions or requests, email dolled-up@outlook.com or write to Dolled Up, 1 Great Eastern Yard, Victoria Mill Road, Framlingham, Suffolk IP13 9EG.

Dolled Up operates at Halesworth and Framlingham, including from House of Beauty in Framlingham. This notice covers Dolled Up services and records. House of Beauty is a shared venue; other businesses operating there are responsible for their own information and privacy notices. If a practitioner separately collects and controls records for their own business outside Dolled Up systems, they must provide their own privacy information.

Information we collect

• Salon clients: name, contact details, booking and appointment history, consultation answers relevant to treatment suitability, treatment and aftercare records, payment and transaction details, messages, complaints and any treatment photographs you agree to provide.
• Academy students: contact and enrolment details, date of birth where needed, course and attendance information, payments, assessments, certificates, emergency contact details and any optional support or adjustment information you choose to give us.
• Training models: contact and date-of-birth details, emergency contact and parent or guardian details where relevant, consultation and treatment records, and your separate photography choices.
• Enquiries and marketing: information you give us in messages, appointment requests, reviews, marketing preferences and opt-out records.
• Website visitors: basic technical information needed to deliver and protect the website. The site currently has no analytics or advertising pixels. Our website host may use essential technical technologies to operate and secure the site.

Please provide only information relevant to the service, course or support you are requesting. We do not ask students to provide a diagnosis where a practical adjustment is enough.

Why we use information and our lawful grounds

We use information for the purposes below. The lawful ground depends on the information and the specific use.

• Bookings, enquiries, salon treatments, training arrangements, aftercare and course administration: to take steps at your request and perform the service or course agreement with you.
• Accounts, payment records and tax records: to meet legal obligations and administer our business. Payment processing is handled through Fresha and its payment providers; we keep the transaction and reconciliation details needed for our records.
• Running and protecting the business, managing access, responding to questions or complaints, improving our service and establishing or defending legal claims: our legitimate interests, where the use is necessary and does not override your rights.
• Health, allergy, medication, disability or other special-category details: only where relevant to treatment safety or a requested adjustment. Where required, we ask for separate explicit consent under Article 9(2)(a) UK GDPR before using health information. Treatment consent and acknowledgement of this notice are separate from consent to use health information. If you do not provide necessary information or withdraw consent, we may be unable to provide a treatment safely. We may retain or use limited information where necessary to establish, exercise or defend legal claims and the law permits it.
• Course assessment, attendance and certificates: to deliver the course agreement, keep appropriate business records and meet applicable accreditation, insurer or legal requirements.
• Marketing messages: with your consent, or under the customer soft opt-in where the law allows it. We give you a way to opt out when we collect your details and in each marketing message where required. You can opt out at any time.
• Marketing photographs, identifiable testimonials and social media tags: only with separate permission for the specific use. Photography is optional and not a condition of receiving a suitable treatment or training place.

Who may receive information

We share information only when needed for the purposes above, including with:

• Fresha, which provides booking, consultation, appointment-management and payment services. Under its Partner Data Protection Addendum, the salon is the controller for client information uploaded to its Fresha account and Fresha is the processor for that information. Fresha may also act as a separate controller for its own account, marketplace and platform purposes.
• Authorised Dolled Up team members and Academy trainers who need relevant information to provide a service, manage a course or support a model. Students receive only the practical precautions needed for safe supervised training, not unnecessary medical answers.
• Payment providers, Xero and accounting support, email and website hosting providers, and other service providers used to run the business.
• Our insurers, professional advisers, regulators or public authorities when reasonably necessary or legally required.
• Academy students only where you have separately agreed to the specific permitted use of your training-model photograph. We do not sell client or student lists.

International processing

Some service providers may store or access information outside the UK. Fresha's published Data Protection Addendum says its services may involve processing outside the UK and EEA and describes transfer safeguards, including standard contractual clauses for certain transfers. We will use appropriate safeguards where required and can provide information about the safeguards that apply to a particular transfer on request. Other providers' own privacy notices explain their processing in more detail.

Fresha privacy notice: terms.fresha.com/privacy-policy
Fresha Partner Data Protection Addendum: terms.fresha.com/data-protection

How long we keep information

We keep information only for as long as it is needed for the purpose it was collected, including aftercare, course administration, accreditation, insurance, legal duties and resolving complaints or claims. We review information and delete or securely dispose of it when it is no longer needed. The period varies by record type:

• Business income and expense records are kept for at least five years after the 31 January submission deadline for the relevant tax year, and longer where HMRC or another legal process requires it.
• Unsuccessful Academy enquiries are normally deleted six months after the last meaningful contact. Unneeded health or adjustment details are deleted sooner.
• Client consultation, treatment and incident records are kept for the time reasonably needed for treatment follow-up, insurer requirements, complaints and potential legal claims. We review these records regularly and delete them when those needs end.
• Student attendance, assessment and certificate records are kept while needed to administer the course, verify completion and meet relevant accreditation, insurance and legal requirements. Support or adjustment details are reviewed after the course and deleted when they are no longer needed.
• Photographs are kept only while the agreed purpose and permission remain current. We review them regularly and remove them from accounts we control when permission is withdrawn or the purpose ends. We cannot remove copies already shared or stored by other people or platforms.
• Marketing preferences are kept while you remain subscribed. We may retain a minimal record of an opt-out so we can continue to respect it.

Where a fixed period is not appropriate, we decide how long to keep a record by considering the purpose, legal and insurer requirements, the time in which a claim may arise, and whether the information is still needed. Fresha may also retain data under its own terms and privacy notice.

Your choices and rights

Depending on the circumstances and the lawful ground we use, you may ask us to provide access to your personal information, correct it, delete it, restrict its use or provide it in a portable format. You may object to processing based on legitimate interests. You can withdraw consent at any time where we rely on consent; this does not affect processing already carried out lawfully. You can unsubscribe from marketing using the link or instructions in the message, or contact us.

To make a privacy request or a complaint about how we have used your information, email dolled-up@outlook.com or write to the address above. We will acknowledge a data-protection complaint within 30 days, investigate it and tell you the outcome without unnecessary delay. We may ask for information to verify your identity before responding to a rights request.

You may also complain to the Information Commission, the UK data protection regulator, through ico.org.uk/make-a-complaint.

Security and changes to this notice

We use proportionate technical and organisational safeguards, limit access to team members who need information for their role, and expect people with access to keep it confidential. No online service can guarantee that information sent over the internet will always be secure. Please contact us promptly if you think information you have shared with us has been exposed or used incorrectly.

We will update this notice when our information practices change. The latest version will be available on our website and linked from relevant booking and training forms.

Website cookies and similar technologies

We do not currently use analytics or advertising pixels on our brochure website. The website host may use strictly necessary technical cookies or similar technologies to deliver and protect the pages. If we introduce non-essential analytics, advertising or tracking technologies, we will update this notice and provide a clear way to choose before those technologies are used where consent is required.