Privacy Policy

1. Introduction

Luke Robert Hair ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website, salon services, educational courses, AI assistant, and booking systems.

We are based in the United Kingdom and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Information You Provide to Us

• Contact Information: Name, email address, phone number, postal address
• Booking Details: Appointment preferences, service selections, location choices (Altrincham, Knutsford, or Caversham)
• Payment Information: Billing details (processed securely through third-party payment providers)
• Education Course Details: Professional qualifications, experience level, course preferences, CPD requirements
• Referral Program Data: Referral codes, friend contact details (when provided), referral history
• AI Assistant Conversations: Chat messages, questions, preferences, and feedback
• Communication Preferences: Marketing opt-ins, appointment reminder preferences, newsletter subscriptions

2.2 Information We Collect Automatically

• Technical Data: IP address, browser type, device information, operating system
• Usage Data: Pages viewed, time spent on site, navigation paths, click patterns
• Cookies and Similar Technologies: Session identifiers, preference settings (see our Cookie Policy below)
• Location Data: General location based on IP address (not precise GPS location)

3. How We Use Your Information

3.1 To Provide Our Services

• Process and manage salon bookings and appointments
• Deliver education courses and CPD programs
• Manage the referral program and process rewards (£10 off vouchers)
• Send appointment confirmations, reminders, and follow-ups
• Process payments and refunds
• Provide customer support and respond to inquiries
• Power our AI assistant to answer questions and provide personalized recommendations

3.2 To Improve Our Services

• Analyze usage patterns and customer preferences
• Train and improve our AI systems and chatbot
• Conduct customer satisfaction surveys
• Develop new features and services
• Optimize website performance and user experience

3.3 For Marketing and Communications

• Send promotional offers and special deals (only with your consent)
• Share educational content, styling tips, and industry insights
• Notify you about new courses, services, and locations
• Send birthday and anniversary greetings

3.4 For Legal and Security Purposes

• Comply with legal obligations and regulations
• Prevent fraud, abuse, and unauthorized access
• Protect our rights, property, and safety
• Resolve disputes and enforce our terms

4. Legal Basis for Processing (UK GDPR)

We process your personal data under the following legal bases:

• Contract: To fulfill our contract with you (bookings, services, courses)
• Consent: For marketing communications and AI assistant interactions (you can withdraw consent anytime)
• Legitimate Interests: To improve our services, prevent fraud, and ensure security
• Legal Obligation: To comply with tax, accounting, and other legal requirements

5. How We Share Your Information

We do not sell your personal data. We may share your information with:

5.1 Service Providers

• Booking System: Salon management and scheduling software
• Payment Processors: Secure payment gateways for transactions
• Email Service: Transactional and marketing email providers (Resend)
• AI Services: OpenAI for AI assistant functionality
• Analytics: Website analytics and performance monitoring
• Cloud Hosting: Secure data storage (Supabase, Vercel)

5.2 Salon Partners

When you book at one of our partner locations (Fixx Salon in Altrincham, Urban Sanctuary in Knutsford, or Alternate Salon in Caversham), we share necessary booking information with the salon.

5.3 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect our rights and safety.

6. Data Security

We implement industry-standard security measures to protect your personal information:

• Encryption of data in transit (SSL/TLS) and at rest
• Secure authentication and access controls
• Regular security audits and vulnerability assessments
• Staff training on data protection and security
• Secure backup and disaster recovery procedures

While we take reasonable precautions, no system is 100% secure. We cannot guarantee absolute security but are committed to protecting your data to the best of our ability.

7. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Active Customers: While you use our services and for 3 years after your last interaction
• Booking Records: 7 years for tax and accounting purposes
• Marketing Data: Until you unsubscribe or request deletion
• AI Chat Logs: 12 months for service improvement, then anonymized or deleted
• Legal Purposes: As required by law or regulation

8. Your Rights (UK GDPR)

Under UK data protection law, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for marketing
• Right to Withdraw Consent: Withdraw consent at any time (doesn't affect prior processing)
• Right to Lodge a Complaint: Contact the Information Commissioner's Office (ICO) if you have concerns

To exercise any of these rights, please contact us at luke@lukeroberthair.com or call 07862 054292. We will respond within 30 days.

9. Cookies and Tracking

9.1 What Are Cookies?

Cookies are small text files stored on your device that help us improve your experience, remember your preferences, and analyze website usage.

9.2 Types of Cookies We Use

• Essential Cookies: Required for the website to function (e.g., session management, security)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how visitors use our site
• Marketing Cookies: Track conversions and ad performance (only with consent)

9.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling cookies may affect website functionality. Most browsers accept cookies by default, but you can modify settings to decline cookies or notify you when cookies are being sent.

10. AI Assistant and Chatbot

Our AI assistant uses OpenAI technology to provide personalized recommendations and answer questions:

• Conversations are stored temporarily to improve service quality
• Chat data is anonymized and used to train and improve our AI systems
• We do not share identifiable chat data with third parties (except OpenAI for processing)
• You can request deletion of your chat history at any time
• The AI assistant does not store payment information or highly sensitive personal data

11. Children's Privacy

Our services are not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately, and we will delete it.

12. International Data Transfers

Your data is primarily stored in the UK/EU. Some service providers (e.g., OpenAI) may process data outside the UK. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions, to protect your data during international transfers.

13. Marketing Communications

You can opt out of marketing emails at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Contacting us at luke@lukeroberthair.com
• Updating your preferences in your account settings

Note: Even if you opt out of marketing, we will still send transactional emails (appointment confirmations, booking updates, course information).

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. We will notify you of significant changes by:

• Posting the updated policy on our website with a new "Last updated" date
• Sending an email notification (for material changes)
• Displaying a prominent notice on our website

Your continued use of our services after changes become effective constitutes acceptance of the updated policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Data Protection Authority: If you are not satisfied with our response, you can lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF