Privacy policy.

Who we are

Arch Cosmetics is a permanent makeup and brow studio operating from Rochester (Kent) and Kings Cross (London). For the purposes of data protection law, we are the "data controller" of your personal information.

If you have any questions about this policy or your data, contact us at info@archcosmetics.co.uk.

[To complete: registered business/sole-trader name and address, and ICO registration number if you are registered with the Information Commissioner's Office.]

The information we collect

Depending on how you interact with us, we may collect:

• Enquiry & consultation details — your name, email, phone number, preferred location, the treatment you're interested in, and any photos you upload.
• Health information — relevant medical history, allergies, medications, skin conditions and similar details you provide so we can assess suitability and carry out your treatment safely. This is "special category" data and is treated with extra care.
• Booking & payment details — appointment information and the booking-fee payment. Card payments are handled securely by our payment provider; we do not see or store your full card details.
• Pricing calculator — if you use our free pricing calculator, your name and email so we can send your results and related information.
• Training & course accounts — if you enrol in a course or mentorship, your name, email, login details, course progress and any submissions or notes you make.
• Technical information — basic information your browser provides, and small amounts of data stored in your browser to keep you logged in and remember your preferences.

How and why we use it

• To provide consultations and treatments and assess that a treatment is safe and suitable for you (our legal basis: performance of a contract, and — for health information — your explicit consent and reasons of safety).
• To manage bookings and take payment (performance of a contract).
• To provide training, courses and mentorship you've enrolled in (performance of a contract).
• To send you appointment, pre-care and after-care information related to your booking.
• To send marketing emails — such as the pricing-calculator follow-ups and occasional updates — where you have given consent. You can unsubscribe at any time.
• To run, protect and improve our business and respond to your enquiries (our legitimate interests).
• To meet legal, insurance and record-keeping obligations.

Who we share it with

We never sell your personal information. We share it only with trusted service providers who help us run the business, and who process it on our behalf under appropriate agreements. These include providers for:

• Website hosting and our booking/forms platform;
• Secure payment processing;
• Sending our emails;
• Storing data, managing logins and syncing appointments to our calendar;
• Our online booking system used for some appointments.

Some of these providers may process data on servers outside the UK. Where that happens, we rely on appropriate safeguards (such as UK/EU-approved contractual clauses) to keep your data protected. We may also disclose information where required by law.

How long we keep it

We keep your information only for as long as necessary. Treatment and consultation records (including health information) are retained for the period required for safety, insurance and legal purposes. Marketing contacts are kept until you unsubscribe. Course and account data is kept while your account is active. After that, information is securely deleted or anonymised. [To confirm: your specific retention periods, e.g. treatment records kept for X years in line with your insurer's requirements.]

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete your data (where we're able to);
• restrict or object to how we use it;
• request a copy of certain data in a portable format;
• withdraw consent at any time, where we rely on consent.

To exercise any of these, email info@archcosmetics.co.uk. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies & your browser

Our site uses a small amount of browser storage to keep you signed in to your portal and to remember your preferences and form progress. We don't use third-party advertising cookies. You can clear this data at any time through your browser settings.

Marketing & unsubscribing

If you've opted in to hear from us, you can unsubscribe at any time using the link in any marketing email, or by emailing us. We'll still send you essential messages relating to a booking or course you've made.

Children

Our treatments and services are intended for adults (18+). We do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. The latest version will always be published on this page, with the "last updated" date above.