Privacy policy

ByAfwevun (“we”, “us”) is the data controller for the personal information described in this policy. That means we decide what information is collected and what happens to it.

We only collect what we need to give you an appointment and to run the studio. When you book online, that is:

• Your name — so we know whose appointment it is and how to greet you.
• Your email address — to send your confirmation, a reminder before your appointment, and a notice if it is cancelled.
• Your telephone number — so we can reach you on the day if something changes.
• Your appointment details — the service, date, time, price, and whether a deposit has been paid.
• Notes we make — practical things that help us look after your hair, such as a style you liked or a product that irritated your scalp.

If you reserve something from the shop we keep the same details, plus what you reserved and whether you have collected it. Reserving is not buying: no card details are taken through this website, and nothing is charged until you pay in the studio.

We do not ask for payment card details through this website. Deposits and balances are settled directly with the studio.

Some notes about your scalp or hair condition could count as health information, which UK GDPR treats as a special category needing extra care. We keep such notes to the minimum needed to treat your hair safely — for example a recorded sensitivity to a product — and we record them only because you have told us about them and asked us to take them into account. You can ask us to remove them at any time and we will still see you; it simply means you will need to tell us again at your next appointment.

UK GDPR requires us to have a lawful basis for using your information. Ours are:

We do not sell your information, and we do not share it for advertising. It is seen by:

• Affi Atumah and anyone else working in the studio who needs it to do their job.
• Our hosting provider, which stores the website and its database on our behalf.
• Our email provider, which delivers your confirmation and reminder emails.

These suppliers act on our instructions and are not permitted to use your information for their own purposes. If any of them store data outside the UK, we make sure there are appropriate safeguards in place.

We keep your booking history while you are a client and for a reasonable period afterwards so that we can pick up where we left off if you come back. Records that form part of our accounts are kept for six years, as tax law requires. After that, information is deleted or anonymised.

If you ask us to delete your information, we will do so promptly, keeping only what we are legally required to hold.

• Everything sent between your browser and this website travels over an encrypted connection.
• The studio dashboard is password protected, and passwords are stored hashed — never as readable text.
• Only the studio owner can sign in to see client records.
• Sign-in sessions expire, and can be revoked from every device at once.

We style children’s hair. Where the client is under 18, we expect the booking to be made by a parent or guardian, and we treat the contact details given as theirs. If you believe we hold information about a child that we should not, please contact us and we will remove it.

Under UK GDPR you can ask us to:

• Show you the information we hold about you.
• Correct anything that is wrong or out of date.
• Delete your information, where we do not have to keep it.
• Restrict or object to how we use it.
• Send you a copy in a portable format, or pass it to someone else.
• Withdraw consent you previously gave, at any time.

Email and we will respond within one month. There is no charge.

This website sets no cookies at all when you browse it, and uses no analytics or tracking of any kind. The only cookie we use is one that keeps the studio owner signed in to the dashboard. Our cookie policy explains this in full.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113.

If we change how we use your information we will update this page and change the date at the top. Where the change is significant, we will tell you directly.