Privacy Policy

1. Introduction

Allure by Zaffy ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, book appointments, or use our services. This policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws.

2. Data Controller

Allure by Zaffy is the data controller for your personal information. You can contact us at:

3. Information We Collect

4. How We Use Your Information

• To provide and manage your beauty treatments and appointments
• To send booking confirmations and appointment details via email
• To communicate with you about your appointments and our services
• To ensure health and safety compliance during treatments
• To improve our website and services
• To comply with legal obligations
• To send marketing communications (with your consent)

5. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract: To fulfill our service agreement with you
• Legitimate Interest: To improve our services and website functionality
• Consent: For marketing communications and non-essential cookies
• Legal Obligation: To comply with health and safety regulations

6. Data Sharing and Third Parties

We may share your information only in the following circumstances:

• With email service providers to send appointment confirmations and communications
• With analytics providers to improve our website (anonymized data only)
• When required by law or to protect our legal rights
• With your explicit consent for specific purposes

7. Your Rights

Under UK GDPR and data protection laws, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for marketing communications

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes encryption, secure servers, access controls, and regular security assessments.

9. Data Retention

Our data retention practices:

• Booking information is only used temporarily to send confirmation emails and is not stored permanently
• Email communications are retained by your email provider according to their policies
• Website analytics data is anonymized and retained for service improvement
• Marketing consent data is retained until you withdraw consent
• Historical booking data (from before our privacy update) may be retained for availability checking only

10. International Transfers

Your data is primarily processed within the UK and EU. If we transfer data outside these regions, we ensure appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses.

11. Cookies

Our website uses cookies to enhance your experience. Essential cookies are necessary for website functionality, while optional cookies help us analyze usage and improve our services. You can manage cookie preferences through your browser settings.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by posting the new policy on our website and updating the "Last updated" date. Continued use of our services constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.