Your information, held with care.

Who We Are

Shibui Cosmetics is the data controller for information submitted through this website, the booking workflow, consent records, treatment records and direct client communications. For privacy questions, access requests or data concerns, contact emma@shibuicosmetics.com.

Information We Collect

We collect booking and contact details, including your name, date of birth, age where supplied, occupation where supplied, address, phone number, email address, appointment date and time, treatment choice, top-up reference details, discount code use, payment status, booking reference, source of enquiry and any notes you choose to provide.

We also collect consent and treatment information needed to assess and carry out semi-permanent makeup safely. This may include allergies, medication, medical history, pregnancy or breastfeeding status, skin and healing information, previous SPMU procedures, patch-test choices, consent declarations, photography permissions, signatures, practitioner suitability decisions, treatment notes, pigment/tool batch and expiry details, aftercare records and treatment images.

Health information is special-category personal data. We only ask for it because it is relevant to treatment suitability, safety, aftercare, professional records, insurance records and legal compliance.

Why We Use It

We use your information to respond to enquiries, manage availability, prevent double bookings, take deposits, confirm appointments, send receipts, send consent links, verify your consent form access, assess whether treatment can safely go ahead, identify where Emma needs to review an answer before treatment, provide treatment and aftercare, manage follow-up or top-up appointments, maintain records, deal with complaints or insurance matters and meet legal duties.

Lawful Bases

Booking administration, payment administration and appointment management are processed because they are needed to take steps at your request before entering into a booking, or to perform the client booking. Service messages and essential appointment updates are sent for the same reason.

Treatment records, practitioner notes and records needed for safety, complaints, insurance or legal protection are processed under legitimate interests and, where applicable, legal obligation. Those interests are providing safe treatment, keeping accurate records, protecting clients and staff, and being able to evidence the care, advice and consent given.

Where health information is collected through the consent form, we rely on your explicit consent where appropriate and/or the need to keep suitable health-related treatment records. You can withdraw consent for future use where consent is the basis, but this will not affect processing already carried out and it may not require deletion of records that must be kept for legal, insurance or safety reasons.

Promotional use of identifiable photos is based on your separate consent. You can refuse marketing photo consent and still receive treatment.

Who We Share It With

Information may be handled by trusted providers used to run the service, including Cloudflare for website hosting, security and database storage, Stripe for payments, Microsoft 365/Outlook for emails and calendar appointments, Geoapify for address suggestions when enabled, GitHub for website deployment code, and SharePoint when the archive integration is connected. These providers only receive the information needed for their role.

Practitioner notifications do not include detailed medical answers. They direct Emma to review the secure Practitioner Portal. We may also share information if required by law, insurers, professional advisers, regulators or dispute-resolution bodies.

Payments

Card payments are processed by Stripe. Shibui Cosmetics does not store full card numbers or card security codes on this website. Stripe may process payment data as an independent controller for some regulatory and payment-network purposes.

Email, Calendar And Messages

Booking confirmations, receipts, consent links and practitioner alerts are sent from emma@shibuicosmetics.com using Microsoft 365 where connected. Appointment details are added to Emma's Outlook calendar to reserve the slot. Calendar entries are kept concise and should not include detailed medical answers.

How Long We Keep It

Consent and treatment records may be kept for up to 10 years so that Shibui Cosmetics can evidence treatment history, consent, aftercare, insurance position and safety decisions. Booking records that do not become confirmed appointments, technical logs and test records may be deleted earlier when no longer needed. If a record is deleted from the Practitioner Portal, it is removed from the website database, but separate copies may still exist in sent emails, Stripe records, Outlook calendar entries or SharePoint if those services have already received the information.

Where It Is Stored

The live website is hosted through Cloudflare. Records are stored in the connected Cloudflare database and may later be archived to SharePoint. Microsoft 365, Stripe, Cloudflare and other connected services may process information outside the UK. Where this happens, the transfer should be protected by the provider's contractual safeguards and international transfer terms.

Security

The live site uses HTTPS, server-side booking records, protected secrets for payment and discount rules, and a locked Practitioner Portal. For real client data, the Practitioner Portal should also be restricted with Cloudflare Access using Emma's Microsoft account, so that a verified sign-in is required before the portal page can be opened. The in-site practitioner password should remain as an additional control.

Your Rights

You can ask for a copy of your personal information, ask for inaccurate information to be corrected, ask for deletion where the law allows, object to certain uses, ask us to restrict use, ask for data portability where applicable, or withdraw consent where consent is the lawful basis. We may need to confirm your identity before acting on a request.

To make a request, email emma@shibuicosmetics.com with enough detail to identify your booking or treatment record.

Complaints

Please contact Shibui Cosmetics first so we can try to resolve your concern. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk/make-a-complaint.

Updates

This notice may be updated as the website, payment provider, email, calendar and SharePoint processes develop. The version date recorded on the consent form shows which privacy notice was provided for that booking.