How is your personal data collected?
Identity Data includes email or similar identifier. If you interact with us through social media, this may include your social media user name, title, first name, last name.
Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences. We will treat all the personal data as ordinary personal data.
Remember, if you choose not to share personal data with us, or refuse certain contact permissions, we might not be able to provide the products and services you’ve asked for.
If you register on one of our sign up forms or contact customer services.
How we use your personal data
Where we need to perform the contract we are about to enter into or have entered into with you.
Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud.
For direct marketing communications we rely on consent.
Explaining the legal bases we rely on to process personal data.
Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.
We do not carry out any automated decision making.
If you ever have any questions about this, all you have to do is ask, please see the section Contacting Salon Red below.
Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees who require the data to perform the services we offer. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so
Data retention
We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they stop being customers for tax purposes.
In some circumstances you can ask us to delete your data; see Your legal rights below for further information.
In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
Your legal rights
If the General Data Protection Regulation applies to you because you are in the European Union, you have rights under data protection laws in relation to your personal data:
- The right to be informed – that’s an obligation on us to inform you how we use your personal data (and that’s what we’re doing in this privacy policy);
- The right of access – that’s a right to make what’s known as a ‘data subject access request’ for copy of the personal data we hold about you;
- The right to rectification – that’s a right to make us correct personal data about you that may be incomplete or inaccurate;
- The right to erasure – that’s also known as the ‘right to be forgotten’ where in certain circumstances you can ask us to delete the personal data we have about you (unless there’s an overriding legal reason we need to keep it);
- The right to restrict processing – that’s a right for you in certain circumstances to ask us to suspend processing personal data;
- The right to data portability – that’s a right for you to ask us for a copy of your personal data in a common format (for example, a .csv file);
- The right to object – that’s a right for you to object to us processing your personal data (for example, if you object to us processing your data for direct marketing); and
- Rights in relation to automated decision making and profiling – that’s a right you have for us to be transparent about any profiling we do, or any automated decision making.
These rights are subject to certain rules around when you can exercise them. You can see a lot more information on them, if you are interested, on the UK Information Commissioner’s Office website.
If you wish to exercise any of the rights set out above, please contact us (see How to contact Salon Red below).
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the data privacy manager using the details in How to contact Salon Red below.
You have the right to make a complaint at any time to the Information Commissioner’s Office (“ICO”), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
How to contact Salon Red about privacy
If you have any questions about this privacy policy, or would like to exercise any of your rights, please email us at info@salon.red or write to us with your letter addressed to: Data Privacy Manager, Salon Red Ltd, 29a Queen Street, Lossiemouth, IV31 6PR
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
Changes to this privacy policy
The General Data Protection Regulation is new and the ICO is still issuing new bits of guidance about how businesses should follow it. So, you may see little updates to our privacy policy over the coming months. Be sure to check in and have read every now and then. Thank you. These terms were updated 20/05/18.
Salon Red Ltd’s Privacy Policy
This privacy policy has been compiled to better serve those who are concerned with how their ‘Personally Identifiable Information’ (PII) is being used online. PII, as described in US privacy law and information security, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Please read our privacy policy carefully to get a clear understanding of how we collect, use, protect or otherwise handle your Personally Identifiable Information in accordance with our website.
What personal information do we collect from the people that visit our website?
When ordering or registering on our site, as appropriate, you may be asked to enter your name, email address, phone number or other details to help you with your experience.
When do we collect information?
We collect information from you when you register on our site or enter information on our site.
We use a Third Party offsite system to allow you to book appointments with us and manage the bookings called “Shedul”.
How do we use your information?
We may use the information we collect from you when you register, make a purchase, sign up for our newsletter, respond to a survey or marketing communication, surf the website, or use certain other site features in the following ways:
- To personalize your experience and to allow us to deliver the type of content and product offerings in which you are most interested.
- To allow us to better service you in responding to your customer service requests.
- To send periodic emails regarding your order or other products and services.
How do we protect your information?
Our website is scanned on a regular basis for security holes and known vulnerabilities in order to make your visit to our site as safe as possible. We use an industry standard firewall and security software to ensure the website remains secure. In addition, all sensitive information you supply is encrypted as we have an SSL (Secure Socket Layer) Certificate installed on the site.
Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential. We implement a variety of security measures when a user places an order enters, submits, or accesses their information to maintain the safety of your personal information. All transactions are processed through a third party offsite gateway provider (Paypal) and are not stored or processed on our website / servers.
Booking System
We use a Third Party offsite system to allow you to book appointments with us and manage the bookings. This vendor is called “Shedul”. The data collected for the purposes of making a booking is not stored on our website or servers.
You can read Shedul’s GDPR statement here: https://goo.gl/5pygtA
Do we use ‘cookies’?
Yes. Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow) that enables the site’s or service provider’s systems to recognise your browser and capture and remember certain information. For instance, we use cookies to help us remember and process the items in your shopping cart. They are also used to help us understand your preferences based on previous or current site activity, which enables us to provide you with improved services. We also use cookies to help us compile aggregate data about site traffic and site interaction (Google Analytics) so that we can offer better site experiences and tools in the future.
We use cookies to:
- Help remember and process the items in the shopping cart.
- Understand and save user’s preferences for future visits.
- Compile aggregate data about site traffic and site interactions in order to offer better site experiences and tools in the future. We may also use trusted third-party services that track this information on our behalf.
You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Since every browser is a little different, look at your browser’s Help Menu to learn the correct way to modify your cookies.
If users disable cookies in their browser:
If you turn cookies off, some features will be disabled. Some of the features that make your site experience more efficient and may not function properly.
Third-party disclosure
We do not sell, trade, or otherwise transfer to outside parties your Personally Identifiable Information.
Third-party links
We do not include or offer third-party products or services on our website.
We have implemented the following:
- Google Analytics
We use Google Analytics to help us understand how our customers use the Site. To find out more about how Google uses the Analytics Data please follow this link: https://policies.google.com/privacy?hl=en
Opting out:
Users can set preferences for how Google advertises to you using the Google Ad Settings page. Alternatively, you can opt out by visiting the Network Advertising Initiative Opt Out page or by using the Google Analytics Opt Out Browser add on.
To opt out of the Google analytics Cookies you can install a browser Add-On created by Google specifically for this purpose. You can find out more about this here: https://tools.google.com/dlpage/gaoptout
Fair Information Practices
The Fair Information Practices Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect personal information.
In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur: We will notify you via email within 7 business days
We also agree to the Individual Redress Principle which requires that individuals have the right to legally pursue enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or government agencies to investigate and/or prosecute non-compliance by data processors.
CAN SPAM Act
The CAN-SPAM Act is a a set of rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them.
We collect your email address in order to:
- Send information, respond to inquiries, and/or other requests or questions
- Process orders and to send information and updates pertaining to orders.
To be in accordance with CANSPAM, we agree to the following:
- Not use false or misleading subjects or email addresses.
- Identify the message as an advertisement in some reasonable way.
- Include the physical address of our business or site headquarters.
- Monitor third-party email marketing services for compliance, if one is used.
- Honor opt-out/unsubscribe requests quickly.
- Allow users to unsubscribe by using the link at the bottom of each email.
If at any time you would like to unsubscribe from receiving future emails simply follow the instructions at the bottom of each email. and we will promptly remove you from ALL correspondence.
Contacting Us
If there are any questions regarding this privacy policy, you may contact us using the information below:
Data Privacy Manager, Salon Red Ltd, 29a Queen Street, Lossiemouth, IV31 6PR