What we keep, and for how long

The requestWhat the form actually sends

When you send an appointment request, the fields you filled in are what we receive: your name, your email address, a telephone number if you chose to give one, what you are asking for, when suits you, an earliest date if you set one, and anything you added in the last box. Nothing else is asked for and nothing else should be put in there.

Two technical items are recorded alongside it: the IP address the request arrived from and the browser identification string your browser sent. They are kept because they are what tells a real request apart from an automated one, and for no other purpose.

Where it goesTwo places, both named

The request is written into a key-value store operated by Cloudflare, under the reference you are shown on screen. That happens first, before anything is emailed, so that a request cannot quietly vanish if mail has a bad minute.

It is then sent as an email to the company’s own mailbox using Cloudflare Email Routing. Mail addressed to bookings@lilyhairsalon.shop is forwarded to the mailbox the company reads. Your email address is set as the reply-to on that message, which is how a reply reaches you.

Cloudflare, Inc. acts as our processor for the website, the store and the mail forwarding. We do not sell or share this information with anyone else, and there is no advertising network, analytics script or tracking pixel on any page of this site.

Why we are allowed toLawful basis

Handling a request you have sent us is processing necessary to take steps at your request before entering into a contract, under Article 6(1)(b) of the UK GDPR. Keeping a short record of enquiries so that the company can answer them properly and account for its own dealings is our legitimate interest under Article 6(1)(f).

If an appointment involves colour, a skin test is carried out on an earlier day and its outcome is recorded. That record concerns your health, so it is handled under Article 9(2)(a) — your explicit consent, which is asked for at the time and which you can withdraw.

How longPlain periods, not “as necessary”

• 12 monthsAn appointment request that did not turn into an appointment, counted from the day you sent it.
• 24 monthsThe contact details of someone who did come in, so that a returning client does not have to start again.
• 36 monthsA skin-test record, because it is the thing a later colour appointment has to be checked against.
• 6 yearsAnything that forms part of the company’s accounting records, which is the period UK company law requires.

Your rightsAnd how to use them here

You can ask for a copy of what we hold about you, ask for it to be corrected, ask for it to be deleted, ask us to restrict what we do with it, or object to our handling it on legitimate-interest grounds. Where processing rests on your consent — the skin-test record — you can withdraw that consent at any time, and withdrawing it does not affect anything already done.

Write to bookings@lilyhairsalon.shop, or to Lily Hair Salon Ltd, Lee House, 116-118 Oldham Road, Manchester, England, M4 6AG. Quote the reference you were given if you have it; it makes finding the record immediate. We answer within one month. If you are not satisfied with how we have dealt with it you can complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk.

CookiesThere are none

This site sets no cookies and no local storage. The one script it loads is served from this domain, runs the minutes adder and sends the request form, and stores nothing on your device. Fonts are requested from Google Fonts, which means your browser makes a request to a Google server to fetch them; no identifier is set by us in doing so.