Data Protection & GDPR

As part of running a small business Sophies collects necessary data from clients to manage and process bookings, and maintain accounts and records. The company only holds information for advertising, marketing and public relations in connection with its core business; this may include past, existing or present customers or suppliers.

As Sophies only processes personal data for core business purposes, it is exempt from registration with the Information Commissioner’s Office (ICO).

GDPR Privacy Notice

Our contact details:

Name: Juliette

E-mail: info@sophies.co.uk

What type of information we have:

We currently collect and process the following information: name and contact details, treatment preferences, details of bookings and invoices/payments.

How we get the information and why we have it:

The personal information we process is provided to us directly by you for one of the following reasons: to facilitate running a dressing service session, bookings, invoicing and payments.

On some occasions, we also receive personal information indirectly, for example when a third party makes a booking on your behalf.

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

a. Your consent. (You are able to remove your consent at any time. You can do this by contacting us using the details above.)

b. We have a contractual duty.

c. We have a legitimate interest.

What we do with the information we have:

We use the information that you have given us in order to organise and run a dressing session and to produce invoices and take payment.

We will only share this information (in part or in full) if there is a legal duty to do so, or if we have your clear written or electronic consent.

How we store your information:

Personal Information

Your information is securely stored on a secure private server (we do not store information on third party servers).

Unless you give written or electronic consent we keep your personal data for a maximum period of 18 months. We will then dispose your information (or the parts for which you have not given consent) by erasing it from our servers (including the back up server).

Photographs

We will only take photographs on a camera provided by you (or your representative). If you choose to do so, we will display your images with your consent on our website. You may request removal of images at anytime; if so we will remove the images with a reasonable time scale following your request.

Your data protection rights:

Under data protection law, you have rights including:

• Your right of access - You have the right to ask us for copies of your personal information.
• Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.
• Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.
• Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us using the details above if you wish to make a request.

How to complain:

You can also complain to the ICO if you are unhappy with how we have used your data. You can contact the ICO by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or telephoning 0303 123 1113.

Last updated: 6th September 2022