PRIVACY POLICY

Last updated: 12 June 2026

This Privacy Notice for OBLIQUE BEAUTY HOUSE LIMITED (‘we’, ‘us’, or ‘our’) describes how and why we might access, collect, store, use, and/or share (‘process’) your personal information when you use our services (‘Services’), including when you:

• Visit our website at www.obliquebeauty.uk or any website of ours that links to this Privacy Notice
• Book or receive beauty and wellness treatments at any of our salon locations
• Contact us or receive messages from us by phone, email, WhatsApp, Instagram, our website chat or contact forms
• Join our loyalty programme
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at info@obliquebeauty.uk.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice. You can find more details about any of these topics in the table of contents below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use — including your contact details, appointment and purchase history, and communications with us.

Do we process any sensitive personal information? Yes. So that our specialists can deliver treatments safely, we record information you give us about allergies, sensitivities, patch test results and contraindications. This is health information (‘special category data’ under UK law) and we process it only with your explicit consent. See section 1.

Do we collect any information from third parties? We do not buy information about you from third parties. We receive information you send us through platforms you choose to use (for example WhatsApp or Instagram) and limited advertising statistics from our advertising partners, subject to your cookie consent.

How do we process your information? We process your information to provide, improve, and administer our Services (including managing your bookings and keeping one accurate client record across all our locations), communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. See section 2.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific service providers acting on our behalf. We never sell your personal data. See section 4.

How do we keep your information safe? We have adequate organisational and technical processes and procedures in place to protect your personal information, including encryption, role-based access and audit logging. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. See section 9.

What are your rights? Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 you have rights of access, rectification, erasure, restriction, objection (including an absolute right to object to direct marketing), and data portability. See section 11.

How do you exercise your rights? The easiest way is to contact us at info@obliquebeauty.uk or speak to any member of our team. We will consider and act upon any request in accordance with applicable data protection laws.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. PHONE CALLS, MESSAGING AND AUTOMATED ASSISTANTS
7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
10. DO WE COLLECT INFORMATION FROM MINORS?
11. WHAT ARE YOUR PRIVACY RIGHTS?
12. CONTROLS FOR DO-NOT-TRACK FEATURES
13. DO WE MAKE UPDATES TO THIS NOTICE?
14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you book an appointment, visit one of our salons, join our loyalty programme, express an interest in obtaining information about us or our Services, fill in a form or chat on our website, message us on WhatsApp or Instagram, call us, or otherwise contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• names
• dates of birth
• phone numbers
• email addresses
• postal addresses
• appointment and visit history across our locations
• treatments received and products purchased
• loyalty programme participation and rewards
• marketing and contact preferences
• messages and enquiries you send us (including via WhatsApp, Instagram Direct, website chat and contact forms)

Sensitive Information. When necessary, with your explicit consent, we process the following categories of sensitive information:

• health-related information you give us so we can deliver treatments safely: allergies, skin or hair sensitivities, patch test results and contraindications

We ask for this information solely to choose safe products and treatments for you. We record your explicit consent when you provide it, and you may withdraw it at any time by contacting us — though without this information we may be unable to provide certain treatments safely. Access to this information inside our systems is restricted to staff who need it to deliver your treatment.

Payment Data. We may collect data necessary to process your payment if you choose to make purchases. All payment data is handled and stored by our payment providers; we do not store full card numbers. You may find their privacy notice link(s) on request at info@obliquebeauty.uk.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies, with your consent where required. You can find out more about this in our Cookie Notice.

The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files.
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services.

One client record across our locations. To serve you better, we maintain a single client record that brings together your contact details, appointment, visit and purchase history from our booking and salon-management systems across all our locations. This helps us avoid asking you for the same information twice, manage appointments correctly and resolve issues faster.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To provide and manage our Services: manage bookings, deliver treatments, take payments, and keep your client record accurate and up to date across our locations.
• To keep you safe during treatments: record allergies, sensitivities, patch test results and contraindications, with your explicit consent.
• To respond to your enquiries on any channel: phone, email, WhatsApp, Instagram, website chat or forms.
• To send you service communications: booking confirmations, reminders and important changes to your appointments.
• To send you marketing and promotional communications: offers, news and reminders — only where you have opted in, or, for similar services you have bought from us, under the ‘soft opt-in’ with a clear way to opt out in every message.
• To run our loyalty programme: track points and rewards and, with appropriate safeguards, tailor offers to your purchase history. You can object to this profiling at any time.
• To improve our Services: review recorded calls for quality and training, analyse enquiries, visits and sales, and measure how our website and advertising perform.
• To protect our Services: keep our systems safe and secure, including fraud monitoring and prevention.
• To comply with our legal obligations: tax, accounting, insurance, health and safety, and responding to lawful requests.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e. legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfil our contractual obligations, to protect your rights, or to fulfil our legitimate business interests.

The UK GDPR and Data Protection Act 2018 require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

• We may process your information if you have given us permission (i.e. consent) to use your personal information for a specific purpose — for example marketing messages and non-essential cookies. You can withdraw your consent at any time.
• Explicit consent (special category data). We process health-related information (allergies, sensitivities, contraindications) only with your explicit consent under Article 9(2)(a) UK GDPR.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including managing your bookings, delivering treatments and running the loyalty programme you have joined.
• Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information to: respond to people who contact us; record and review calls for quality, training and dispute resolution; analyse how our Services are used; maintain one accurate client record across our locations; and keep our systems secure. You can object at any time (see section 11).
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as tax and accounting rules, health and safety requirements, or to respond to lawful requests from authorities.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as in a medical emergency at one of our salons.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following third parties. We never sell your personal data.

We may need to share your personal information in the following situations:

• Service providers (processors). We share data with vendors, consultants and service providers who perform services for us on our instructions under data processing agreements. These include: our salon-management and customer relationship management (CRM) platforms; our database hosting provider; our telephony and call-centre platform; messaging platforms (WhatsApp Business and Instagram messaging, provided by Meta); email providers; payment processors; analytics and advertising partners (subject to your cookie consent); and providers of AI-powered assistants and transcription used in our Services.
• Professional advisers. Accountants, insurers, lawyers and similar advisers, where necessary.
• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Legal obligations. Authorities and regulators where required by law.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information, with your consent where required.

We may use cookies and similar tracking technologies (like web beacons, pixels — including the Meta Pixel — and analytics tools) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements, to tailor advertisements to your interests, or to send abandoned shopping cart reminders (depending on your communication preferences). Third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear either on our Services or on other websites.

Non-essential cookies and tracking technologies (including analytics and advertising pixels) are set only with your consent, which you can give, refuse or withdraw at any time via the cookie banner / cookie settings on our website. Refusing them does not affect your ability to browse the site or book with us.

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice.

6. PHONE CALLS, MESSAGING AND AUTOMATED ASSISTANTS

In Short: Calls with our call centre may be recorded; some enquiries may be handled by automated (AI) assistants; we will always make this clear to you.

Call recording. Incoming and outgoing calls with our call centre and reception may be recorded and transcribed for quality assurance, staff training, accurate booking records and dispute resolution. You will hear a notice at the start of recorded calls. Recordings are kept for a limited period (see section 8) and access to them is restricted to staff who need it.

Automated and AI assistants. Some enquiries may first be handled by an automated assistant — for example a chat assistant on our website or social channels, or an AI-powered voice assistant on the phone. We will always make clear when you are interacting with an automated system, and you can always ask to be transferred to a member of our team. We do not use these systems to make decisions with legal or similarly significant effects about you without human involvement. We do not use voice analysis to identify you.

Messaging channels. When you message us on WhatsApp, Instagram Direct, or our website chat, we process the content of your messages to respond to you and keep your client record up to date. These platforms are operated by their providers (for example Meta), who process some data — such as message metadata — under their own privacy policies.

7. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We store your personal information in the United Kingdom.

Your client records and our primary systems are hosted in the United Kingdom, and your personal information is stored in the UK. We do not store your personal information in the United States. Some third-party platforms we use to communicate with you (for example WhatsApp and Instagram, provided by Meta) may process limited message data outside the UK under their own privacy policies.

Where any personal data leaves the UK (for example via the messaging platforms above), we ensure an adequate level of protection through appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with additional technical and organisational measures.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law. In particular:

• Client records, including treatment, patch test and allergy records: for as long as you remain a client and afterwards for the period needed to deal with potential claims and meet our insurance requirements.
• Financial and transaction records: at least 6 years, as required by HMRC.
• Call recordings: a limited period for quality assurance and dispute resolution, after which they are deleted automatically.
• Marketing data: until you opt out or your consent lapses. If you opt out, we keep a minimal suppression record so we do not contact you again.
• Website analytics data: for the periods set out in our Cookie Notice.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. A detailed retention schedule is available on request.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process, including encryption of data in transit and at rest, role-based access controls (so that, for example, health-related information is visible only to staff who need it to deliver your treatment), audit logging, staff confidentiality obligations and regular security reviews.

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment. If a breach is likely to put your rights at risk, we will notify the Information Commissioner’s Office and, where required, you, in line with UK GDPR.

10. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 16 years of age without parental consent.

Our Services and marketing are directed at clients aged 16 and over. We do not knowingly collect, solicit data from, or market to children under 16 years of age. Where treatments are provided to clients under 16, we require the consent of a parent or guardian in line with our salon policies, and we record only the information needed to provide the treatment safely. If you become aware of any data we may have collected from children without appropriate consent, please contact us at info@obliquebeauty.uk.

11. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Under the UK GDPR and the Data Protection Act 2018, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time.

You have the right to:

• request access and obtain a copy of your personal information;
• request rectification of inaccurate data;
• request erasure of your personal information (‘right to be forgotten’) where applicable;
• restrict the processing of your personal information;
• object to processing based on our legitimate interests — including an absolute right to object to direct marketing and related profiling: we will stop marketing to you immediately on request;
• data portability, where applicable;
• not be subject to solely automated decisions that produce legal or similarly significant effects, without appropriate safeguards.

Withdrawing your consent: If we are relying on your consent (including explicit consent for health-related information) to process your personal information, you have the right to withdraw your consent at any time. You can withdraw your consent by contacting us using the details in section 14. However, please note that this will not affect the lawfulness of the processing before its withdrawal, and we may be unable to provide certain treatments safely without your allergy information.

Opting out of marketing: You can unsubscribe from our marketing communications at any time by clicking on the unsubscribe link in the emails that we send, replying ‘STOP’ to messages, or by contacting us using the details in section 14. You will then be removed from the marketing lists; we will continue to send you service-related messages necessary for the administration of your bookings.

To exercise any of these rights, contact us at info@obliquebeauty.uk. We respond within one month. We may need to verify your identity first. We will consider and act upon any request in accordance with applicable data protection laws.

If you believe we are unlawfully processing your personal information, you have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk, 0303 123 1113. We would, however, appreciate the chance to address your concerns before you approach the ICO, so please contact us in the first instance.

12. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (‘DNT’) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice. You can always control non-essential tracking on our website through the cookie settings (see section 5).

13. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated ‘Last updated’ date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may contact us at:

OBLIQUE BEAUTY HOUSE LIMITED

15 Bute Street
London, England, SW7 3EY

Email: info@obliquebeauty.uk

Phone: +44 7465 645176

We are registered with the Information Commissioner’s Office (ICO) under number 12244320.

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law — for example, we may need to keep certain treatment and financial records for the periods described in section 8 even after a deletion request; where this applies, we will explain what we have kept and why. To request to review, update, or delete your personal information, please contact us at info@obliquebeauty.uk or speak to any member of our team.