Timeless Salon (“we”, “our”, “us”) is the controller responsible for your personal data. We process information about you as part of providing our services and are committed to handling your data in line with GDPR and all applicable data‑protection laws.
By using our services, you agree to the terms of this privacy policy.
This policy explains how we collect, use, store and protect your personal data when you visit our website or use our services. It also outlines your rights and how the law protects you.
For any questions or to exercise your data rights, contact our Data Protection Officer (DPO): Rebecca Smith
Email: timelesshairandbeauty@gmail.com
Mail: Timeless Salon, 5 North Street, Gainsborough, DN212HP
You may contact the relevant data‑protection authority at any time, but we appreciate the chance to resolve concerns first.
We may update this policy at any time. Significant changes may be emailed to you. Please review the policy regularly.
Please keep your personal information up to date and inform us of any changes.
Our website may contain links to external sites. We are not responsible for their privacy practices.
We may collect the following categories of personal data:
Identity Data – name, date of birth, gender
Contact Data – address, email, phone number
Financial & Transaction Data – payment details, purchase history
Technical Data – IP address, browser type, device information
Profile & Usage Data – account details, preferences, interactions
Marketing Data – communication preferences
We do not collect special‑category data unless you give explicit consent.
Directly from you – forms, bookings, emails, account creation
Automatically – cookies, analytics, browsing behaviour
Third parties – payment processors, analytics providers, public sources
We only use your data when legally permitted, including:
To perform a contract (e.g., bookings, purchases)
For legitimate business interests (e.g., improving services)
To comply with legal obligations
Marketing communications are sent only with your consent or under lawful “soft opt‑in” rules.
You can opt out of marketing at any time.
We use cookies only when necessary or with your consent. Disabling cookies may affect website functionality.
We may share your data with:
Companies within the Glossa Group
Service providers (IT, payment, marketing, customer support)
Professional advisers (legal, accounting, insurance)
Regulators
Potential business buyers
All third parties must protect your data and use it only as instructed.
Your data may be transferred outside the UK/EEA when necessary, using approved safeguards such as adequacy decisions or standard contractual clauses.
We use technical and organisational measures to protect your data from unauthorised access, loss or misuse. You must keep your account password confidential.
We keep your data only as long as necessary for legal, contractual or business purposes. Examples:
Customer data: up to 3 years after the relationship ends
Marketing data: up to 3 years after last contact
Identity verification documents: 1 year
Cookies and tracking data: up to 13 months
Inactive accounts: deleted after 2 years (with notice)
You have the right to:
Access your data
Correct inaccurate data
Request deletion
Object to processing
Restrict processing
Request data transfer
Withdraw consent
We may request proof of identity before fulfilling requests.
We aim to respond within one month, or longer for complex requests (you will be notified).