Privacy Policy

Tip2Toe is the trading name used for the salon and booking service. The person or organisation operating Tip2Toe is responsible for deciding how and why personal information is used and is the data controller under UK data protection law.

Depending on how someone uses Tip2Toe, we may collect:

• name, telephone number and optional email address;
• appointment details, including the treatment, date, time, chosen team member and booking reference;
• appointment status, attendance, late cancellation, cancellation reason and relevant service history;
• preferences, customer flags and notes added by authorised salon staff;
• information a customer provides about allergies, sensitivities, pregnancy, medication, patch tests or other matters relevant to providing a treatment safely;
• messages and records relating to booking confirmations and customer support;
• privacy-request details, contact information, identity-check status, decisions and response records when someone exercises a data protection right;
• limited technical records such as the page requested, response status, request timing and internet address used for security and rate limiting; and
• staff account details, authentication records and audit records where an authorised team member uses the administration area.

We ask customers not to provide information that is not relevant to their booking or treatment.

We use personal information only where we have a lawful reason. The reasons expected to apply to this service are:

Booking details are not sold. We do not currently use automated decision-making or profiling to make decisions about customers.

Information about health can receive additional protection as special category data. Tip2Toe should only record health or treatment-suitability information when it is relevant and proportionate for providing a service safely.

Where explicit consent is the appropriate condition, the customer will be asked to make a clear and specific statement agreeing to that use. Withdrawing consent will not affect processing that was lawful before withdrawal, but it may mean that Tip2Toe cannot safely provide a particular treatment.

The exact consent wording and the treatments for which it is required must be confirmed before this policy is approved.

Access is limited to Tip2Toe team members who need the information to manage bookings or provide services. We may also use carefully selected organisations that support the business, such as:

• website, database, backup and IT support providers;
• email or messaging providers used for booking communications;
• payment providers, if online payments are introduced;
• professional advisers, insurers, accountants or legal representatives; and
• regulators, courts, law enforcement or other bodies where disclosure is required or permitted by law.

Service providers acting on our behalf must be appropriately assessed and bound by data protection terms. The final policy must identify or accurately describe the providers actually used and confirm whether any information is transferred outside the UK.

We keep information only for as long as it is needed for the reason it was collected, including providing services, handling complaints, meeting tax or insurance requirements and dealing with legal claims. Information is then deleted, securely destroyed or anonymised.

The booking system includes an administrator-controlled retention process. It previews eligible records before cleanup, can anonymise archived customer identities while retaining limited booking facts, clears old appointment notes and cancellation reasons, and deletes old stored email copies and audit records. Automatic cleanup remains off unless an administrator approves periods and explicitly enables it.

The periods below remain unapproved; this working policy must not imply that a retention schedule has been agreed merely because the system can enforce one.

Tip2Toe uses organisational and technical safeguards intended to prevent unauthorised access, loss, alteration or disclosure. These include role-based staff access, password hashing, protected staff accounts, request limits, audit records and backups.

No service can guarantee absolute security. Tip2Toe will maintain a process for responding to incidents and will notify the Information Commissioner's Office and affected people where the law requires it.

The staff administration area uses strictly necessary session and security cookies to keep authorised users signed in and protect requests. The current customer-facing website does not use advertising cookies.

If analytics, advertising or other optional technologies are introduced, the Cookies page and consent controls must be updated before they are enabled.

Contact details given for an appointment are used for booking and service communications. Tip2Toe will not use them for optional promotional emails or texts unless there is a lawful basis and the customer is given the required choice and a simple way to opt out.

Depending on the circumstances and lawful basis, customers may have the right to:

• ask for a copy of their personal information;
• have inaccurate or incomplete information corrected;
• ask for information to be erased or its use restricted;
• object to certain uses, including direct marketing;
• receive certain information in a portable format; and
• withdraw consent at any time where consent is relied upon.

These rights are not absolute and an applicable legal exception may mean that a request cannot be fulfilled in full. Tip2Toe may need to verify the requester's identity before responding.

To make a request, use the Manage My Data form. Requests can also be made verbally or through the salon's contact details.

Questions or requests about personal information should be sent to the privacy contact shown at the start of this policy. Tip2Toe will try to resolve concerns promptly.

If someone remains unhappy, they can complain to the Information Commissioner's Office, the UK regulator for data protection.

This policy will be reviewed when Tip2Toe changes how it handles information. Material changes will be explained clearly and the effective date at the top will be updated.