Privacy Policy

Who we are

Ten20 Beauty is the data controller responsible for your personal data. If you have any questions about this policy or how we use your data, please contact us at chloegray35@gmail.com.

What data we collect

We may collect the following personal data when you interact with us:

• Contact information: your name, email address, and phone number when you enquire about our services or book an appointment.
• Booking details: date, time, and type of treatment booked.
• Communication records: messages you send us via email, phone, or social media.
• Technical data: your IP address and browser type when you visit this website, processed by Cloudflare for security and performance.
• Analytics: we use Cloudflare Web Analytics to understand aggregated, anonymous page views. It is cookie-free, does not collect personal data, and does not track you across websites or build advertising profiles.

How we use your data

We use your personal data for the following purposes:

• To manage your appointments and provide the treatments you have booked.
• To respond to your enquiries and communicate with you about our services.
• To comply with legal and regulatory obligations.

Our legal basis for processing your data is either your consent (which you can withdraw at any time), the performance of a contract (your booking), or our legitimate business interests (responding to enquiries).

Cookies

This website uses Cloudflare for security and performance. Cloudflare may set a strictly necessary cookie (__cf_bm) to distinguish between humans and bots. This cookie does not track you and expires after 30 minutes of inactivity.

We do not use any analytics cookies, advertising cookies, or third-party tracking scripts. All fonts are self-hosted. No data is sent to external font providers.

How we store and protect your data

Appointment requests submitted via this website are stored in a Cloudflare-hosted database accessible only to authorised Ten20 Beauty staff. Enquiry notification emails are delivered via Brevo (a transactional email service). Marketing consent is optional, separate from appointment processing, and, when an email address is provided, stored with a timestamp and a per-record unsubscribe token.

Marketing messages are not automatically sent from this site yet; consent records support future campaigns and unsubscribe handling.

We retain appointment records for as long as necessary to fulfil the purposes described above, or as required by law. You may request deletion of your data at any time by contacting us.

Sharing your data

We do not sell your personal data. We may share your data with:

• Cloudflare: provides website security, delivery, and database hosting for appointment requests. Their privacy policy is available at cloudflare.com/privacypolicy.
• Brevo: delivers appointment notification emails on our behalf. We do not use Brevo for marketing campaigns or consent lists. Their privacy policy is available at brevo.com/legal/privacypolicy.
• Stripe: for eligible online bookings, Stripe hosts the secure card-on-file collection. Card storage is optional, no charge is taken upfront, and cash remains preferred. If a customer separately agrees at the appointment to pay by card, Stripe processes the agreed treatment payment. Ten20 Beauty retains only the booking, customer, SetupIntent, payment-method reference, consent, treatment-payment and fee-status metadata needed to operate the booking. Ten20 Beauty will not receive or store the full card number.

We will never share your data with third parties for marketing purposes.

Your rights

Under UK data protection law (UK GDPR), you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct any inaccurate data.
• Erasure: ask us to delete your personal data.
• Restrict processing: ask us to limit how we use your data.
• Data portability: request your data in a machine-readable format.
• Object: object to our processing of your data.

To exercise any of these rights, email us at chloegray35@gmail.com. We will respond within 30 days.

Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.