Privacy policy
Last updated: 6 November 2026
This privacy policy explains how Mistique Beauty and Holistic Salon (“we”, “us”, “our”) collects, uses, stores and protects your personal information when you visit our website, contact us or book a treatment with us. It also explains your rights and how to use them.
Summary
- We collect only the information we need to answer your enquiries, provide your treatments and run our website.
- We do not sell your personal information.
- We share it only with trusted providers who help us run our business, or where the law requires it.
- You can ask to see, correct or delete your information, and you can complain to us or to the Information Commissioner’s Office (ICO).
1. Who we are
Mistique Beauty and Holistic Salon is the data controller for the personal information described in this policy.
| Detail | Information |
|---|---|
| Name | [NEED CLIENT DATA: trading or registered name] |
| Company number | [NEED CLIENT DATA: company number and where registered, or sole trader] |
| Address | 95-97 Colindeep Lane, Sprowston, Norwich, NR7 8EQ |
| mistiquebeauty@gmail.com | |
| Telephone | 01603 789955 |
| ICO registration number | [NEED CLIENT DATA: ICO registration number] |
| Data protection contact | [NEED CLIENT DATA: data protection contact, name or role] |
2. Information we collect
Information you give us. When you call, text or email us, message us on Facebook, or book a treatment, we may collect:
- your name
- contact details, such as your phone number and email address
- your booking and treatment history
- your contact preferences
- anything else you choose to tell us in a message
Online bookings. When you book online, you book through Fresha, which passes your booking details to us. Fresha’s own privacy policy explains how it uses your information.
Information collected automatically. Our website is hosted by Cloudflare. When you visit, Cloudflare processes technical information such as your IP address, browser and device type and the pages requested, so it can deliver and protect the site. We do not use analytics, advertising or tracking tools on our website.
Sensitive information. We do not ask for special category information (such as health, religion or ethnicity) through our website. Please do not include it in messages to us.
3. How we use your information and our lawful bases
UK data protection law requires us to have a lawful basis for each use of your information.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries | Legitimate interests (answering people who contact us) or steps before entering a contract |
| Taking bookings and providing your treatments | Contract |
| Taking payments and keeping financial records | Contract and legal obligation |
| Running and securing our website | Legitimate interests |
| Complying with the law, regulators and court orders | Legal obligation |
| Protecting someone’s life or safety in an emergency | Vital interests |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more detail.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Who we share your information with
We share personal information only where needed, and only with organisations that must protect it. These include:
| Recipient | Why |
|---|---|
| Fresha | Taking and managing online bookings |
| Cloudflare | Hosting and protecting our website |
| Google (Gmail) | Business email |
| Meta (Facebook) | If you contact us through our Facebook page |
| Accountants, insurers and professional advisers | Running our business and meeting legal duties |
| HMRC, regulators, police or courts | Where the law requires us to |
| A buyer or successor business | If all or part of our business is sold or merged |
5. International transfers
Some of our providers store or access information outside the UK, for example in the European Economic Area or the United States. Where this happens, we make sure the transfer is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or by appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.
6. How long we keep your information
We keep personal information only for as long as we need it, then securely delete or anonymise it.
| Information | How long we keep it |
|---|---|
| Enquiries that do not lead to a booking | 2 years from last contact |
| Customer and booking records, invoices | 6 years after the end of the financial year they relate to (HMRC requirement) |
Information in back-ups that cannot be edited is kept secure and out of use until it is overwritten.
7. How we keep your information safe
We use appropriate technical and organisational measures to protect your information, including encrypted connections (HTTPS) on our website, access controls and strong passwords, multi-factor authentication where available, and up-to-date security software.
No system is completely secure, but if a breach occurs that puts your rights at risk, we will report it to the ICO within 72 hours and tell you without undue delay where the law requires.
8. Children
Our website is intended for adults. We do not knowingly collect information through it from children under 13. If you believe a child has given us their information, please contact us and we will delete it.
9. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your information
- access a copy of the information we hold about you
- have inaccurate information corrected
- have your information erased in certain circumstances
- restrict how we use your information
- data portability, where it applies
- object to processing based on legitimate interests, and to all direct marketing
- withdraw your consent at any time, where we rely on consent (this does not affect processing already carried out)
To use any of these rights, contact us using the details in section 13. We may need to confirm your identity. We will respond within one month, normally free of charge, and tell you if a complex request needs longer.
10. Complaints
If you are unhappy with how we have handled your personal information, you have the right to complain to us. Please contact us using the details in section 13.
We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome.
If you are still unhappy, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
11. Cookies
Our website does not set any cookies. For full details, see our cookie policy.
12. Changes to this policy
We review this policy regularly and will update it when our practices or the law change. The Last updated date at the top shows when it last changed. If we make significant changes, we will make this clear on our website.
13. Contact us
Mistique Beauty and Holistic Salon
95-97 Colindeep Lane, Sprowston, Norwich, NR7 8EQ
Email: mistiquebeauty@gmail.com
Telephone: 01603 789955