Privacy Policy
Who is responsible for your information
VIOLETA BEAUTY LTD, trading as WOW NAILS BY VIO, is the controller of the personal information used for the salon’s services. The company is registered in England and Wales, number 16266814. The salon is at 261 Park Road, Barnsley, S70 1QN. The registered office is 71-75 Shelton Street, London, England, WC2H 9JQ.
For privacy questions or requests, contact the salon at contact@wownails.uk or +44 7342 368214. Violeta is the company’s operational privacy contact. The email address receives and forwards messages; replies may come from another address managed by the salon.
Bookings and consultation records
We use Fresha for bookings, client records, consultation forms and automatic appointment notifications. Information involved includes your name and contact details, the service and appointment details, the information you supply in the consultation form and the related treatment record.
The salon keeps its consultation and client records in Fresha. It does not keep separate paper files, scans or separate copies of those records. Messages exchanged through email or messaging apps remain a distinct communication channel; this does not mean that service providers have no copies or backups.
For the information objectively necessary when an adult asks us to arrange a booking and provide their chosen service, the legal basis is taking steps at that person’s request before a contract and performing that contract. This does not cover every later use of the information.
This limited booking and service purpose uses Article 6(1)(b) UK GDPR. It does not itself supply the additional condition required for health information.
Where you choose an advance payment or a payment or cancellation charge is handled through Fresha, that platform handles the payment process. Booking, payment-status and cancellation information may be used to administer the booking or a related enquiry. Do not send payment-card details through the website enquiry form or messages.
Health information and treatment decisions
Health information relevant to the particular treatment helps the salon assess suitability and safety. Article 6(1)(b) UK GDPR can cover only information objectively necessary for the requested service; it does not automatically justify every question in a form. Health information also requires a separate condition under Article 9.
Agreeing to treatment and choosing promotional photographs are separate from the processing of health information. Completing or signing the form does not, by itself, demonstrate explicit consent to that processing.
The Fresha form includes a separate statement in English and Romanian requesting your explicit consent to use the health information you provide to assess treatment suitability, identify relevant safety precautions and maintain the necessary consultation record. This request concerns explicit consent under Article 9(2)(a) UK GDPR, separately from agreement to treatment and promotional photographs.
To complete the Fresha consultation form, you need to tick this separate declaration. The checkbox is not preselected.
You may withdraw your consent for health information by contacting the salon, including at contact@wownails.uk. Withdrawal does not affect processing already lawfully carried out. If information needed to assess safety is unavailable, the salon may be unable to provide that particular treatment safely; the circumstances are assessed individually. Any retention for a distinct purpose requires an applicable legal justification and appropriate information, without automatic indefinite retention.
Ask the salon if a question or its explanation is unclear. Do not send health records through the general website booking-enquiry note, public comments or social-media posts.
Email, WhatsApp and social messages
We communicate with clients by email, telephone, WhatsApp Business and Facebook/Instagram messages. WhatsApp Business is used through the phone app, without a business API or external automation. Your contact or public account details, message text and any attachments you send are involved.
The website booking-enquiry form prepares a WhatsApp link containing your name, chosen service, preferred time and optional note. Opening that link may disclose its text to WhatsApp before you press Send. The website does not save these fields through a website submission API. Do not include health information, payment-card details or other sensitive information in that note.
A request for an appointment is not permission to send promotional messages. Appointment communications and a future direct-marketing programme are separate purposes.
The website and external links
Cloudflare hosts the website. Delivering pages and helping protect the website involves technical connection information, such as an IP address and details of a page request. The public pages use locally hosted fonts and a language shown in the page address, without saving a language preference in browser storage.
The service quiz and selected gallery photographs use the memory of the open page. The journey planner opens Google Maps using the location you type, or your coordinates only if you request location access and allow it in your browser. Opening links to Fresha, Maps, social profiles or other destinations involves the other service’s own processing.
The website links to external booking and review platforms; it does not load a Google Business Profile review feed. New direct marketing and dynamic review publication remain inactive. The VIP programme launch is scheduled for 1 December 2026, at 00:00 Europe/London, subject to authorised operational activation; points checking is explained below. See the Cookie Policy for information about website technologies.
Photos of Our Salon Work
The Fresha consultation form includes a separate optional choice about promotional photographs. This choice is distinct from the agreement to treatment and from any necessary treatment information. You may decline promotional use; it is not an automatic part of booking or receiving a treatment.
Where you choose to permit promotional use, the permitted uses and channels need to be clear to you. Publication on Facebook or Instagram may make an image visible to other people, who can copy or share it. Contact the salon about your choice or withdrawal. Withdrawal does not affect processing that was lawful before withdrawal, and copies shared by others may not be under the salon’s control.
Some gallery images have been restyled with AI to adjust lighting, colours and presentation. This does not remove your rights in an identifiable image. To ask about an image or withdraw permission, contact the salon and identify the image or page without posting health information publicly.
Access, service providers and international processing
Within the salon, only Violeta has operational access to Fresha, WhatsApp Business, the Facebook/Instagram inboxes and client emails. This is separate from access by providers operating their services and from your own access to a Fresha account.
VIOLETA BEAUTY LTD determines the purposes of using information for the salon’s services. Fresha provides booking, client-record, consultation, notification and payment processes. Fresha’s public documents distinguish processing on the salon’s instructions from the platform’s own purposes, such as managing your account. See the Fresha privacy notice for its own uses and the public subprocessor list. The list does not mean that every provider receives every item of your information.
Cloudflare provides website hosting and protection and incoming email routing. Messages sent to contact@wownails.uk are forwarded to a Google Gmail mailbox used by the salon. Google processes the information involved in providing Gmail under its own privacy policy. WhatsApp Business App terms provide for processing certain customer-contact data on the salon’s behalf; the role is not identical for every use of WhatsApp, Facebook or Instagram. The information involved depends on the channel and the content of the communication.
The services we use operate internationally, and information may be processed outside the UK. Providers describe transfer safeguards in their information, including the Cloudflare documents, Fresha notice and Google transfer information. For WhatsApp, Facebook or Instagram messages, the relevant service’s terms and privacy information also apply. You can contact the salon about the recipients and safeguards applicable to your information, including how to obtain a copy or information about the relevant safeguards.
How retention is determined
For bookings, we use an internal review point of three years from the last visit, only while retention is necessary. For ordinary communications, the internal review point is 12 months after the enquiry is resolved. These are not minimum periods required by law; information that is no longer needed may be removed earlier.
For consultations and records containing health information, the retention period is justified separately according to the purpose, necessity and applicable requirements. We do not automatically apply six years. Complaints and incidents are assessed individually according to the circumstances, obligations and any relevant claims; a single case does not automatically justify retaining an entire profile.
Promotional photographs and evidence of a choice or withdrawal have different purposes from a health record. A withdrawal must be taken into account for future uses. A specific need concerning a complaint does not justify keeping all unrelated messages, images or records indefinitely.
Our policy provides for keeping minimal evidence of consent, including the version and date of the statement accepted and evidence of the choice or withdrawal, for as long as necessary to demonstrate compliance. Retention of this evidence is justified separately and does not authorise indefinite retention of all consultation information.
Company accounting records generally need to be kept for six years from the end of the relevant financial year, subject to the applicable legal exceptions. This is not a universal legal period for consultation forms or health information.
Our policy provides for manual quarterly reviews, without automatic deletion. Requests and withdrawals are addressed when they arise, without waiting for the quarterly review. Any retention beyond an internal review point requires an applicable justification and reassessment.
Provider-managed copies, logs and backups are separate from records controlled by the salon. We do not promise instant removal from every system or backup. Contact the salon about the period or criteria applicable to your information or to request deletion; any valid retention reason must be assessed in relation to that request.
Your rights and requests
Depending on the circumstances and the applicable law, you may ask for access, correction, deletion, restriction or portability of your information, object to processing, or withdraw consent where it is relied on. Not every right applies to every purpose.
Contact the salon at contact@wownails.uk. You do not have to use a special form or legal wording; a request can also be made verbally or through another contact channel. Identity or authority may need to be checked proportionately before information is disclosed. For any request concerning a historical record about a minor, the person’s rights and a representative’s authority must be assessed individually. The age policy does not give a parent unrestricted access to that information.
For access requests, the usual legal response period is one month, subject to the applicable rules and any justified extension. You can complain to the Information Commissioner’s Office at ico.org.uk.
Services not currently active
A booking, a consultation answer or a photo choice is not automatic permission for those future activities. Current Facebook/Instagram posts are distinct from the planned direct-marketing programme.
Age eligibility and any historical records
WOW NAILS BY VIO accepts bookings and provides treatments only for clients aged 18 or over. We do not accept bookings or provide treatments for anyone under 18, including with parental consent.
If historical records concern people who were under 18, the new age limit does not trigger their automatic deletion. Retention, access and any requests are assessed separately according to the purpose, the person’s rights and the legal requirements or justified needs applicable to the record. The proposed adult-record period is not automatically applied to those records.
VIP points checks
The public VIP points page asks for the name registered with the salon and the UK phone number verified and linked to the VIP profile. The server compares the supplied details with the verified association and displays only the available balance and expiry date where the match is unambiguous. The page cannot change points, cards or profiles and does not display treatment or appointment history.
The universal QR contains only the page address and is identical for all clients. Checking points does not require an account, password, Google or SMS. Anyone who knows the linked name and phone number may see the balance and expiry; this check is not strong authentication.
The name and phone number are sent in the request body, not in the page address. The phone number is normalised and compared using a cryptographic proof linked to the profile. Protections against repeated attempts use technical request information, including the IP address, and derived identifiers for limiting attempts; these are not used for advertising. The page does not save the entries as browser preferences.
Administrative VIP records are separate and accessible only to the authorised person. Points expiring after 12 months do not automatically delete a profile or its records. Retention needs and requests for correction or deletion are assessed separately under the retention policy and applicable rights.
Checking points or participating in VIP is not permission for marketing. Contact the salon about an incorrect association or a request concerning your information. The commercial programme launch is scheduled for 1 December 2026, at 00:00 Europe/London, subject to authorised operational activation. During pre-launch the public page is informational, the form does not collect names or phone numbers, and points checking is blocked on the server. Authorised internal testing is separate from commercial use.