Privacy notice
Last updated: 7 November 2026
The short version
- When you book, I collect only your name, mobile number and, if you choose, your email, plus the details of your appointment.
- I use them only to manage your appointment and contact you about it. I never sell your details or use them for advertising.
- Your booking is deleted automatically 6 months after your appointment date.
- There are no advertising or tracking cookies on this website.
- You can ask to see, correct or delete your information at any time. Just message me.
Who I am
This website and the booking system are run by My Glam Spot Beauty Studio, a private nail studio in Upminster, Essex, run as a small one-person business. For data protection law, I am the "controller" of your personal information: I decide how and why it's used, and I'm responsible for looking after it.
You can contact me about anything in this notice by WhatsApp, text or phone. See how to contact me below.
What I collect and why
When you book an appointment
| Information | Why I need it | Legal basis |
|---|---|---|
| Your name | To know who's coming and to greet you | Contract: needed to provide the appointment you asked for |
| Mobile number | To confirm your booking, send deposit details, and contact you if anything changes | Contract |
| Email address (optional) | Only if you give it, to contact you about your appointment | Contract |
| Treatment, extras, date and time, price, deposit, booking reference | To run the appointment and keep a simple record of it | Contract |
| Whether you said it's your first visit | To apply the new-client discount | Contract |
| Booking status (awaiting deposit, confirmed, cancelled) and any short private notes I add | To manage the diary, for example noting a deposit has been paid | Legitimate interests: running my business efficiently |
When you book, the studio is sent a notification email with your booking details (name, number, email if given, treatment, time and price), so your booking isn't missed. I don't send emails to you from the website; I'll contact you by WhatsApp, text or phone.
Please don't include health or medical information in messages unless it's needed for your treatment. The booking form doesn't ask for it, and I don't store it in the booking system.
Keeping the booking form safe
To stop spam and misuse, the booking system briefly uses your device's internet (IP) address:
- Limits on repeated attempts. I keep a scrambled (one-way, keyed) version of your IP address for up to 24 hours to limit how many bookings can be made from one device. It can't be turned back into your IP address.
- Security check (Cloudflare Turnstile). Before a booking is accepted, a quick automatic check confirms you're a person and not a bot. Cloudflare processes technical information from your browser and your IP address to do this. It isn't used for advertising.
Legal basis: legitimate interests, keeping the booking system secure and available for genuine clients.
When you message me
If you contact me on WhatsApp, by text or by phone, I'll see your number and whatever you send. I use it only to reply and to arrange your appointment. WhatsApp is run by Meta under its own privacy policy.
Cookies
This website does not use advertising, analytics or tracking cookies, so there's nothing to accept or reject. The only cookie is a strictly necessary login cookie used in the studio's private admin area, which clients never see.
If I start using cookies for other purposes, for example to measure adverts, I'll ask for your permission first and update this notice.
Who else handles your information
I never sell or share your information for marketing. A few trusted services help run the website. They process information only on my behalf or as needed to provide their service:
| Service | What it does | What it receives |
|---|---|---|
| Cloudflare, Inc. | Hosts the website and stores the booking database (database stored in Western Europe), provides the Turnstile security check, and sends the studio's booking notification emails | Booking details, IP address, technical browser information |
| Gmail (Google LLC) | The studio's email inbox, which receives booking notification emails | Your booking details |
| Google Fonts (Google LLC) | Supplies the fonts used on this website | Your IP address when the page loads |
| WhatsApp (Meta) | Only if you choose to message me | What you send |
| My phone's calendar (Apple iCloud or Google Calendar) | Shows my appointments on my phone | Your name, number, treatment and time |
Some of these companies are based in, or may process data in, the United States. Where that happens, the transfer is protected by the UK's approved safeguards, such as the UK–US data bridge or the UK International Data Transfer Addendum.
I may also have to share information if the law requires it, for example with the police or HMRC.
How long I keep it
- Bookings (name, number, email, appointment details): deleted automatically 6 months after your appointment date.
- Booking notification emails in the studio's inbox: deleted when no longer needed, and at the latest 6 months after your appointment.
- Scrambled IP addresses used for spam limits: deleted after 24 hours.
- WhatsApp and text messages: kept on my phone only as long as needed, and deleted when no longer useful.
How I protect it
The booking system uses encrypted connections (HTTPS) throughout. Access to bookings is limited to the studio's private admin area. Only named studio staff can log in, using single-use login links sent to their own email, with limits on attempts and other security measures. I collect as little information as possible and delete it automatically, so there's less to protect.
Your rights
Under UK data protection law you have the right to:
- Access: ask for a copy of the information I hold about you
- Correction: ask me to fix anything that's wrong
- Deletion: ask me to delete your information (for example, if you cancel and don't want your details kept)
- Restriction: ask me to limit how I use it
- Objection: object to uses based on legitimate interests
- Portability: ask for your booking information in a format you can take elsewhere
Just ask, in any way that suits you. I'll reply within one month. There's no charge. I may need to check it's really you before sharing or changing anything.
There's no automated decision-making or profiling: a person (me) makes all decisions about your appointment.
Children
Bookings for anyone under 16 should be made by a parent or guardian, using their own contact details.
Changes to this notice
If I change what information I collect or how I use it, I'll update this page and the "Last updated" date at the top before the change happens.
How to contact me
For any privacy question or request, send me a message on WhatsApp or text, or call 07565 389157. Please start your message with "Privacy request" so I can deal with it quickly.
Message on WhatsAppComplaints
If you're unhappy with how I've handled your information, please tell me first so I can put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.