Welcome to Zoe’s Beauty.

This Privacy Notice explains how Zoe Whatley, trading as Zoe’s Beauty, collects, uses, stores and protects your personal information when you enquire about, book or receive beauty treatments, or use our website.

We are committed to respecting your privacy and handling your personal information responsibly in accordance with UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about how your information is handled, please contact us at enquiries@zoesbeautyco.co.uk.

2. Who We Are

Zoe’s Beauty is operated by Zoe Whatley, a self-employed beauty therapist.

Business name: Zoe Whatley trading as Zoe’s Beauty
Business address: 3 South View, Hersden, Canterbury, Kent CT3 4HF
Treatment location: Mirage Hair and Beauty, 15 Bank Street, Herne Bay, Kent CT6 5EA
Email: enquiries@zoesbeautyco.co.uk
Website: www.zoesbeautyco.co.uk

Zoe Whatley is the data controller for personal information collected and managed directly by Zoe’s Beauty.

​

3. Information We Collect

Depending on your enquiry or treatment, we may collect:

• Your name, contact details and appointment information.

• Relevant medical conditions, allergies, medications, previous treatment reactions and other health information needed to assess treatment suitability.

• Consultation forms, treatment history, treatment notes and progress photographs.

• Payment and transaction records.

• Messages and enquiries sent by email, telephone, SMS, WhatsApp or social media.

• Website usage and cookie preferences.

• CCTV images of people entering or passing the monitored area outside the treatment room.

Where a client is under 18, we may also collect their name, date of birth and relevant parent or guardian information and consent.

We only seek information relevant to the services we provide.

 

4. How We Use Your Information

We use personal information to:

• Respond to enquiries and manage bookings.

• Assess treatment suitability and identify possible contraindications.

• Provide treatments safely and maintain accurate treatment records.

• Record treatment progress and plan future appointments.

• Process payments and maintain financial records.

• Communicate about appointments and services.

• Manage complaints, incidents and insurance matters where necessary.

• Protect the security of our treatment area and equipment.

• Operate and improve our website.

We do not sell client personal information.

 

5. Our Legal Bases for Processing

Under UK GDPR, we rely on different lawful bases depending on why information is needed.

Contract: To arrange appointments, provide booked treatments and manage payments.

Legal obligation: To comply with applicable tax, accounting and other legal requirements.

Legitimate interests: Where appropriate, to respond to enquiries, maintain business records, protect our equipment and premises, and manage or defend legal claims. We consider the impact on individuals’ privacy before relying on this basis.

Consent: Where required, including for optional marketing activities and certain uses of photographs.

Health Information

Information about medical conditions, medications and allergies is classed as special-category personal data and receives additional protection.

We request relevant health information to assess whether a treatment is suitable and safe.

Where we rely on your explicit consent to process health information, this is requested separately through our consultation forms.

You can withdraw consent by contacting us. Withdrawal does not affect processing already carried out lawfully, and certain information may need to be retained where another lawful basis and applicable special-category condition permit or require it.

If we do not have the information necessary to assess treatment safety, we may be unable to proceed with a treatment.

Where applicable, information may also be processed for the establishment, exercise or defence of legal claims, subject to the relevant legal requirements.

 

6. Appointment Bookings and Fresha

Zoe’s Beauty uses two separate Fresha accounts for different purposes.

Mirage Hair and Beauty’s Fresha booking system is used as the main shared appointment diary. Relevant salon staff may see limited booking information, such as your name, telephone number and skin-test status, to manage appointments.

Zoe’s Beauty’s private Fresha account is used for confidential consultation forms, health information, treatment notes, progress photographs and payment records. This account is accessed by Zoe Whatley and is not available to other salon staff.

Information is handled according to the purpose for which it was collected. Fresha also processes information in connection with its platform services under its applicable privacy arrangements.

 

7. Photographs and Marketing

We may take photographs to document treatment progress and maintain accurate treatment records. These are stored with private treatment records and are not automatically used for advertising.

We will seek separate permission before using identifiable client photographs for marketing, social media or promotional purposes.

You may decline marketing photography without affecting your ability to receive treatment.

If you later withdraw permission for promotional use, we will stop future use and take reasonable steps to remove images from channels we control, although copies previously shared by others may remain outside our control.

We do not currently send routine promotional marketing messages. If this changes, we will provide the relevant choices and permissions required by law.

 

8. Payments and Financial Records

Payments may be made by cash, card through SumUp, or bank transfer.

We record relevant payment information in our private Fresha account and use QuickBooks for business accounting.

Payment providers and accounting platforms may process information as necessary to provide their services. Zoe’s Beauty does not need to store your full card details to maintain its business transaction records.

 

9. CCTV

Zoe’s Beauty operates a security camera positioned outside the treatment room, covering the entrance and a limited area immediately outside.

The camera records video only. Audio recording is disabled.

CCTV is used for the legitimate interest of protecting the treatment area, equipment and security of the premises.

Motion-triggered recordings are stored locally on a memory card. Retention depends on recording activity and available storage, and recordings should not be kept longer than necessary for their security purpose. Relevant footage may be retained for longer where needed to investigate an incident or deal with legal or insurance matters.

Access to the camera recordings is restricted to Zoe Whatley. Footage may be shared with police, insurers or other appropriate parties where justified or legally required.

CCTV is not used to monitor clients during treatments.

 

10. How We Store and Protect Information

Client records are maintained electronically using business systems and devices.

We use security measures including device passcodes or biometric protection, restricted account access and additional account authentication where available.

We take reasonable steps to protect personal information from unauthorised access, loss, misuse or disclosure.

No electronic system can be guaranteed completely secure.

 

11. Who We Share Information With

Where necessary, personal information may be processed by service providers supporting our business, including:

• Fresha, for appointments, consultations and treatment records.

• SumUp and relevant banking providers, for payments.

• QuickBooks, for accounting.

• Wix and relevant website services.

• Communication providers used for client enquiries and messages.

Limited appointment information is visible to relevant Mirage Hair and Beauty staff through the shared booking diary.

We may also disclose relevant information to professional advisers, insurers, regulatory bodies or law enforcement where there is an appropriate legal basis.

We do not routinely share confidential consultation or health records with other salon staff.

 

12. International Data Transfers

Some technology providers may process or store information outside the United Kingdom.

Where UK data protection law requires safeguards for international transfers, we rely on the relevant protections provided by those services or other appropriate lawful transfer arrangements.

 

13. How Long We Keep Information

We keep personal information only for as long as necessary for the purposes for which it was collected, taking account of legal requirements, insurance needs and the nature of the treatment.

Our general retention approach is:

Adult consultation and treatment records: Normally up to seven years after the last treatment, subject to review and any reason requiring a different period.

Children’s treatment records: Normally until the client’s 25th birthday, subject to review and any applicable legal or insurance requirements.

Financial records: Retained in accordance with applicable HMRC and accounting requirements.

Enquiries and general messages: Kept only as long as reasonably necessary to respond, manage the client relationship or address relevant issues.

CCTV: Retained for a proportionate period according to its security purpose, recording activity and storage arrangements, with relevant footage preserved longer where necessary for an incident.

We may retain particular records for longer where reasonably necessary for legal claims, insurance matters or legal obligations.

 

14. Your Data Protection Rights

Under UK data protection law, you may have the right to:

• Request access to personal information held about you.

• Ask us to correct inaccurate information.

• Request deletion of information in certain circumstances.

• Request restrictions on how information is used.

• Object to certain processing.

• Request transfer of information where the right to data portability applies.

• Withdraw consent where processing relies on consent.

These rights are not absolute and may depend on the circumstances and applicable law.

To make a request, email enquiries@zoesbeautyco.co.uk.

We will respond within the timescales required by UK data protection law.

You can also raise a concern with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

​

15. Website Cookies

Our website is operated using Wix and uses cookies and similar technologies.

Some technologies are essential for the website to function. Other technologies, including those associated with embedded services such as Google Maps, may require your consent.

Our website provides a cookie consent banner through which you can accept, reject or manage non-essential cookies.

You can change your preferences using the cookie settings control on the website.

​

16. Changes to This Privacy Notice

We may update this Privacy Notice when our services, business practices, technology providers or legal requirements change.

​

The latest version will be available on our website.

Last updated: 13 October 2026

​

​