How your details are used
This is the privacy notice for booking online with Beauty at Headfirst. It says what is kept about you, why, who sees it, how long for, and what you can ask us to do.
Who is responsible
Beauty at Headfirst, 132 High Street, Wivenhoe, Colchester CO7 9AF, decides how your details are used (in data protection law, the "data controller"). To ask anything about your details, call 01206 820566.
What is kept
When you book or join the waiting list: your name, mobile number, email address, the appointment you chose (or the day you were hoping for) and any note you add.
If you choose to tell us more: answers about the treatment you want, any allergies or sensitivities you mention, and photos you send before an appointment.
If you create a login: your email address, a scrambled form of your password (never the password itself), whether you asked for news and offers, and any preferences you set, such as your usual drink, whether you prefer a quiet appointment, anything that would make your visit easier, and your birthday.
What the salon adds: a record of your appointments (including any that were cancelled or missed), notes about your treatments, the date of your last patch test, and photos taken at your appointment if you agreed to them.
If you pay online: that you paid, how much, and the payment company's reference. Your card details are never seen or stored here.
Automatically: like every website, the server records the internet address (IP address) of each visit in its security log, and failed sign-in attempts are counted for a short time to stop password guessing.
Why it is used, and the legal reason
To make and manage your appointment, including confirmations, reminders, changes and any payment. The legal reason is that it is needed for the booking you asked for (a contract with you).
To run the salon sensibly: keeping the diary and your appointment history, the waiting list, a thank-you message with aftercare advice after your visit, keeping the booking page secure, and backups. The legal reason is the salon's legitimate interests in running a well-organised and safe business. You can object to this (see "Your rights").
Health-related details such as allergies, sensitivities and patch test results, and photos of you, are kept only with your agreement (your consent), so that treatments are safe and suit you. You can withdraw that agreement at any time and they will be removed.
Preferences on your login are also kept with your agreement; clear them or delete your login whenever you like.
Payment records are kept because tax law requires business records to be kept.
Your details are never sold, and never passed to anyone for advertising. No decisions about you are made automatically by a computer.
Messages you will get
A confirmation, a reminder before your appointment, a message if a time has to change, and a thank-you with aftercare advice afterwards. These are about your own booking, not advertising. You can stop reminders and thank-you messages on the Your messages page.
When you book you agree to the booking terms, which describe these messages, and the date you agreed is recorded.
News and offers are separate and only sent if you tick the box for them. It is never ticked for you, and you can switch it off at any time under "My bookings" or by asking the salon. The legal reason is your consent.
Who sees it
The team at the salon. Beyond that, only the companies needed to make online booking work, each acting on the salon's instructions:
- myanna.net, which built and looks after this booking system, and can see the data only to keep it running and fix problems.
- Hetzner, which provides the server the booking system runs on, in Germany.
- Cloudflare, which protects the website from attacks and passes your visit through its network.
- The salon's email provider (Google), which delivers emails about your booking.
- Stripe, only if you pay online. Stripe takes the payment on its own secure page and is responsible for your card details under its own privacy policy.
- Mollie, only if you pay by card on the salon's card machine. Mollie takes the payment and is responsible for your card details under its own privacy policy.
- GitHub, where a backup copy of the diary is stored. That copy is encrypted before it leaves the server, so GitHub cannot read it.
Details would otherwise be shared only if the law required it.
Where it is kept
The booking system and its data are on a server in Germany. Some of the companies above are based in the United States or work worldwide. Where your details go outside the UK, it is to a country the UK government has confirmed protects personal data properly, or under contract terms approved for that purpose.
How long it is kept
- Your appointment history and the salon's notes about your treatments: for as long as you are a client. If you stop coming, they are removed when you ask, or when the salon no longer needs them.
- Waiting-list requests: 90 days after they have been dealt with.
- The record of which emails and reminders were sent: up to 6 months.
- The salon's log of changes made in the diary: 2 years.
- Records of payments: about 6 years, as tax law requires.
- Backups: 30 days.
- Your login: until you delete it from "My bookings".
Children
Appointments for children should be booked by a parent or guardian, using the adult's contact details.
On this device
Unless you sign in, the booking page sets no cookies. If you tick "Remember my details on this device", your name, number and email are saved in this browser only, so the form is filled in next time. Untick it, or clear your browser's site data, to remove them.
While you are signed in, one cookie keeps you signed in on this device for up to 90 days. It is needed for the login to work and is not used for anything else. There are no advertising or tracking cookies.
Stopping messages
You can stop news and offers, or appointment reminders, at any time on the Your messages page (no login needed), with the link at the bottom of every email, or by telling the salon. Confirmations of bookings, changes and cancellations still go, because they are part of your booking.
Your rights
You can ask the salon, free of charge, to:
- give you a copy of the details held about you;
- correct anything that is wrong;
- delete your details;
- stop or limit how they are used, or object to a use based on the salon's legitimate interests;
- give you your details in a form you can take elsewhere;
- remove anything you agreed to, such as photos or allergy notes, by withdrawing your agreement.
Ask using the contact details at the top of this page. You will get a reply within one month. Some records, such as payments, may have to be kept where the law requires it.
You can do some of this yourself: change or cancel a booking from the link in your confirmation email up to 24 hours before, and delete your login from "My bookings".
If you are unhappy
Please tell the salon first so it can be put right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
Last updated 13 October 2026. If this notice changes, the new version will be shown here.