Last updated: 14 July 2026
Privacy Policy
Who we are
Ferndown Sugaring (“Ferndown Sugaring”, “we”, “us” or “our”) provides sugaring, hair-removal and related beauty services. For the personal data described in this Privacy Policy, Ferndown Sugaring is generally the data controller because we decide why and how that information is processed.
Our contact details are:
Ferndown Sugaring,
Ferndown, Dorset, BH22 8HG,
United Kingdom
Telephone: +44 (0) 78 5588 7526 (Tina)
Email: info@ferndownsugaring.co.uk
Website: https://ferndownsugaring.co.uk
Data protection framework
We process personal data in accordance with applicable UK data protection and electronic communications law, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), and the amendments made by the Data (Use and Access) Act 2025 (“DUAA”).
We apply the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
Personal data we collect
3.1 Identity and contact information
- Name
- Email address
- Telephone number
- Postal address, where relevant
- Communication preferences
3.2 Appointment and service information
- Service or treatment requested
- Appointment date and time
- Booking, attendance, cancellation and rescheduling history
- Appointment notes and service-related communications
- Payment status and refund information
3.3 Consultation, treatment and health information
To assess whether a treatment is suitable and can be provided safely, we may collect limited information about allergies, skin conditions, sensitivities, relevant medication, pregnancy status where relevant, contraindications, previous treatment reactions and treatment history. Health information is special category personal data and receives additional legal protection.
3.4 Contact form and correspondence information
When you use our website contact form, we may collect your name, email address, telephone number, the content of your enquiry, the date and time of submission, and technical or submission metadata. Where used, anti-spam and security services may also process information such as IP address, browser information, device information, security indicators and form-interaction data to detect abuse, spam or malicious submissions.
3.5 WhatsApp information
If you voluntarily contact us through WhatsApp, we may process your telephone number, profile name, profile image or other profile information that you make visible, message content, voice notes, images, documents or other attachments, and communication metadata such as dates and times. WhatsApp is provided by a Meta company and also processes information under its own terms and privacy policy.
3.6 Transaction and payment information
We may process information about services purchased, amounts charged, payment status, refunds and transaction references. If and when Stripe payment functionality is introduced, Stripe may process payment-card information, billing details, device and fraud-prevention information and other information needed to process or authenticate payments. Where the integration is configured as intended, Ferndown Sugaring will not receive or store complete payment-card numbers or card security codes.
3.7 Website and technical information
- IP address and approximate location derived from it
- Browser, device and operating-system information
- Referral source, pages viewed and website navigation
- Date, time and duration of visits
- Cookie identifiers, consent preferences and website security logs, where applicable
3.8 Marketing preferences
We may keep records of marketing consent, subscription choices, communications sent and requests to opt out.
How we collect personal data
We collect personal data directly from you when you submit a contact form, communicate with us by email, telephone or WhatsApp, request or receive a service, complete a consultation form, or make a payment. We may collect technical information automatically through server logs, cookies and similar technologies. We may also receive limited information from providers supporting our website, communications, anti-spam controls, payments or other business operations.
Why we use personal data and our lawful bases
We use personal data only where we have an appropriate lawful basis. The relevant basis depends on the purpose and circumstances.
- To respond to enquiries and take steps at your request before providing a service: steps before entering into a contract and, where appropriate, our legitimate interests in responding to prospective clients.
- To arrange appointments, provide treatments, communicate about services, administer cancellations or refunds and maintain service records: performance of a contract and our legitimate interests in operating and documenting our services.
- To process payments and prevent payment fraud: performance of a contract, compliance with legal obligations and legitimate interests in receiving payment and preventing fraud.
- To administer and secure the website, contact form, WhatsApp communications and business systems: legitimate interests in operating secure, reliable services and preventing misuse.
- To maintain tax, accounting, regulatory and legally required records: compliance with legal obligations.
- To manage complaints, obtain professional advice and establish, exercise or defend legal claims: legitimate interests and, where special category data is involved, an applicable Article 9 condition.
- To send electronic direct marketing: consent where required by PECR, or another permission available under PECR and UK data protection law.
- To use non-essential cookies or similar technologies: consent where required by PECR.
- To protect life in an emergency: vital interests, where strictly applicable.
Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights and freedoms.
Special category health information
Before processing health information, we identify both an Article 6 UK GDPR lawful basis and an applicable Article 9 UK GDPR condition. Depending on the circumstances, the Article 9 condition may include your explicit consent or processing necessary for the establishment, exercise or defence of legal claims.
Where we rely on explicit consent, it must be specific and recorded, and you may withdraw it at any time. Withdrawal does not affect processing already lawfully carried out. We may still retain or process information where another lawful basis and Article 9 condition requires or permits this.
Please do not send unnecessary health, medical or other sensitive information through the general website contact form or WhatsApp. Treatment-related health information should preferably be provided through the appropriate consultation or treatment-assessment process requested by Ferndown Sugaring.
Website contact form
Information submitted through the contact form is used to receive, review and respond to enquiries, provide requested information, arrange services where appropriate, maintain correspondence records, and protect the form and website against spam, fraud and malicious activity.
Fields marked as required must be completed so that we can receive or respond to the enquiry. If required information is not provided, we may be unable to respond or take the requested steps. Please provide only information relevant to your enquiry.
WhatsApp communications
The WhatsApp contact option is voluntary. You may instead contact us by email or telephone. We use information received through WhatsApp to respond to enquiries, communicate about appointments and services, and retain appropriate business or service records.
WhatsApp and relevant Meta companies process information independently under their own terms and privacy notices. Messages and calls may be end-to-end encrypted in transit, but information may still be stored on the devices of the participants, included in device or cloud backups, or processed as described by WhatsApp. WhatsApp and Meta may use infrastructure, affiliated companies and service providers located outside the United Kingdom.
Do not use WhatsApp for urgent medical matters. Do not send full payment-card details, identification documents, or unnecessary medical or special category information through WhatsApp.
Stripe payments – planned future service
Ferndown Sugaring does not currently describe Stripe as an active payment facility in this Privacy Policy. If and when Stripe is enabled on the website, we may use Stripe to process online payments, refunds, payment authentication, fraud prevention, dispute handling and related financial compliance.
For those purposes, Ferndown Sugaring may provide or make available to Stripe information such as your name, email address, telephone number, billing information, amount payable, service or order details, transaction identifiers and information reasonably required to process, authenticate or refund the payment or prevent fraud. Stripe may collect payment-card and technical information directly through its payment interface.
Stripe’s precise role may vary according to the processing activity and contractual arrangements. It may act as our processor for some activities and as an independent controller for other activities, including where it determines purposes required for regulatory compliance, fraud prevention or operation of its payment services. Stripe processes information under its own privacy documentation.
This section will become operational when Stripe payment functionality is activated. Before activation, we will review the implementation, contractual terms, privacy information, cookie implications and international-transfer arrangements and update this Policy or the website’s notices where necessary.
Direct marketing
We may send information about our services, promotions or business updates only where permitted by law. Where PECR requires consent for electronic marketing, we will obtain valid consent. You may withdraw consent or object to direct marketing at any time by using an unsubscribe facility where provided or contacting info@ferndownsugaring.co.uk.
Opting out of marketing does not stop necessary non-marketing communications, such as appointment confirmations, service messages, responses to enquiries, payment information or safety-related communications.
Cookies and similar technologies
Our website may use cookies and similar technologies for essential website functions, security, consent management, preferences, analytics and other purposes. Strictly necessary technologies may be used without consent where the law permits. Non-essential technologies will not be set or accessed before valid consent is obtained where consent is required.
The website should provide clear information about the technologies actually used, their purposes, providers and durations through a Cookie Policy or cookie notice. Users should be able to reject or disable non-essential technologies and later withdraw or change consent through an accessible preference mechanism. A fresh choice may be requested when the technologies or purposes materially change.
Third-party services we use or may use
The following services are relevant to this Privacy Policy:
- Website contact form and associated hosting, email-routing, security or anti-spam providers: used to receive and protect enquiries. The identity and role of each provider depend on the website’s live configuration.
- WhatsApp/Meta: used as an optional communications channel. WhatsApp and Meta process information under their own privacy terms and may process information internationally.
- Stripe: a planned future online payment provider. Stripe will only be treated as active once payment functionality is introduced.
A third party may act as our processor, an independent controller, or in different roles for different processing activities. The legal role depends on who determines the purposes and essential means of the particular processing and on the applicable contractual arrangements. Where a supplier acts as our processor, we will use a data-processing contract containing the terms required by applicable law.
Sharing personal data
We do not sell personal data. Where necessary and lawful, we may share personal data with providers supporting website hosting, maintenance, security, anti-spam services, communications, booking, payment processing, data storage, backup and analytics, and with accountants, insurers, solicitors and other professional advisers.
We may disclose personal data to regulators, courts, law-enforcement agencies, tax authorities or public bodies where required or permitted by law, or where necessary to protect rights or safety, investigate misuse, or establish, exercise or defend legal claims.
International transfers
WhatsApp/Meta, Stripe once activated, and other technology providers may process information in countries outside the United Kingdom. Some of those countries may not provide the same level of legal protection as the United Kingdom.
Where UK data protection law restricts a transfer, we will use an appropriate lawful mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another applicable safeguard or derogation. Where required, we will assess the transfer and implement supplementary contractual, technical or organisational measures appropriate to the risk.
Information about a provider’s own international transfers and safeguards is generally available in that provider’s privacy documentation.
Data security
We use reasonable and appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, password protection, secure hosting, software updates, backups, malware protection, security monitoring, restricted access and appropriate supplier arrangements.
No electronic transmission or storage system can be guaranteed to be completely secure. You are responsible for protecting access to your own email, WhatsApp account and devices.
How long we keep personal data
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, tax, accounting, insurance, contractual, complaint-handling and legal-claims requirements.
Retention periods depend on the type and sensitivity of the information, the purpose of processing, the duration of our relationship, applicable legal or insurance requirements, and relevant limitation periods. Enquiries that do not lead to a service will normally be retained only for a reasonable follow-up and record-keeping period. Appointment, transaction and treatment records may need to be retained longer for tax, insurance, safety and legal-claims purposes. Marketing information is retained until consent is withdrawn or the information is no longer needed, subject to retaining a minimal suppression record to respect opt-out requests.
We periodically review retained information and securely delete or anonymise it when it is no longer required, unless continued retention is required or permitted by law.
Whether you must provide personal data
You may choose whether to make an enquiry or use WhatsApp. However, certain identity, contact, appointment, consultation or payment information may be necessary to respond to you, assess treatment suitability, provide a requested service, comply with law, or process a payment. If you do not provide required information, we may be unable to respond, accept a booking, provide a treatment safely or complete a transaction.
Your data protection rights
Subject to applicable conditions, limitations and exemptions, you may have the right to:
- Be informed about the collection and use of your personal data.
- Request access to personal data held about you.
- Request correction of inaccurate data and completion of incomplete data.
- Request erasure in certain circumstances.
- Request restriction of processing in certain circumstances.
- Object to processing based on legitimate interests in certain circumstances.
- Object at any time to processing for direct marketing.
- Receive data in a portable format and request transmission to another controller where the right applies.
- Withdraw consent at any time where processing is based on consent.
- Receive safeguards concerning certain solely automated decisions that have legal or similarly significant effects.
- Complain to the UK data protection regulator.
These rights are not absolute and may not apply in every circumstance.
Exercising your rights and making a complaint
To exercise a right or raise a complaint about our handling of personal data, contact info@ferndownsugaring.co.uk or telephone +44 (0) 78 5588 7526. Please explain the issue or request and provide enough information for us to identify the relevant records.
We may request information reasonably necessary to verify your identity. We will acknowledge and handle data-protection complaints and requests in accordance with the timeframes and procedures required by applicable law. We will provide information about the outcome and, where required, explain available routes for further review or complaint.
You will not normally be charged a fee. A reasonable fee may be charged, or a request may be refused, only where the law permits, including in relation to certain manifestly unfounded or excessive requests.
You may also complain to the UK data protection regulator. We encourage you to contact us first so we have an opportunity to resolve your concern.
- Information Commissioner’s Office (ICO)
- Website: https://ico.org.uk/
- Telephone: 0303 123 1113
References in this Policy to the ICO or UK data protection regulator should be read as referring to the competent UK supervisory authority in office at the relevant time.
Children’s personal data
Our website is not directed at children for the purpose of independently collecting their personal data. Where a service is requested for a person under 18, we may require appropriate involvement or authorisation from a parent, guardian or person with parental responsibility, depending on the individual’s age, capacity, circumstances and the nature of the service.
We collect only information reasonably necessary to manage the appointment, assess treatment suitability, provide services safely, maintain appropriate records and meet legal or insurance requirements. We take particular care to provide clear, age-appropriate information where relevant.
Automated decision-making
We do not ordinarily make decisions about clients based solely on automated processing, including profiling, that produce legal effects or similarly significant effects. If this changes, we will provide the information and safeguards required by law.
Third-party websites and services
Our website may link to third-party websites, social media services, payment services or other external services. Those organisations may collect and use personal data under their own privacy notices. We are not responsible for the privacy or security practices of services that we do not control. We recommend reviewing the relevant third-party privacy information before providing personal data.
Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in our services, website, communications channels, payment facilities, suppliers, legal obligations or privacy practices. The current version will be published on our website with an updated revision date. Where appropriate, we may also notify affected individuals of material changes by another suitable method.
Contact us
- Ferndown Sugaring
- Ferndown, Dorset, BH22 8HG, United Kingdom
- Telephone: +44 (0) 78 5588 7526 (Tina)
- Email: info@ferndownsugaring.co.uk
- Website: https://ferndownsugaring.co.uk/
Website implementation note:
This notice must remain consistent with the website’s live contact-form fields, anti-spam service, cookie configuration, WhatsApp implementation and any future Stripe integration. It should be reviewed whenever those systems change.