Privacy Policy
Effective Date: [16/03/2016]
Last Updated: [6/06/2026]
1. Introduction
No. Twenty Four (“No. Twenty Four”, “we”, “us”, or “our”) is committed to protecting and respecting your privacy. We understand the importance of safeguarding personal information and are dedicated to processing all personal data fairly, lawfully, transparently and securely in accordance with applicable data protection laws.
This Privacy Policy explains how we collect, use, disclose, store and protect your personal information when you:
• Visit our website;
• Contact us by telephone, email, social media or online forms;
• Book appointments or consultations;
• Purchase products or services from us;
• Attend treatments at our premises;
• Subscribe to our marketing communications; or
• Otherwise interact with our business.
We encourage you to read this Privacy Policy carefully as it contains important information about your rights and how your personal data is handled.
2. Data Controller
For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, the data controller responsible for your personal information is:
No. Twenty Four
Address: [342 London Road, Stanway, Colchester, CO3 8LT]
Email: [hello@no24stanway.com]
Telephone: [01206 522424]
The data controller determines how and why your personal information is processed.
3. Applicable Legislation
We process personal information in accordance with:
• UK General Data Protection Regulation (UK GDPR);
• Data Protection Act 2018;
• Privacy and Electronic Communications Regulations (PECR);
• Consumer Rights Act 2015;
• Health and Safety legislation where relevant to treatment records;
• Any other applicable UK legislation relating to data protection and privacy.
4. Definitions
Personal Data
Personal data means any information relating to an identified or identifiable individual.
Special Category Data
Special category data includes information relating to:
• Physical health;
• Medical history;
• Medications;
• Allergies;
• Skin conditions;
• Treatment suitability assessments;
• Any other health-related information required to safely provide treatments.
Special category data receives additional protection under UK GDPR.
5. Information We Collect
We may collect, store and process the following categories of personal information.
Identity Information
• Full name;
• Title;
• Date of birth;
• Gender (where relevant to treatment).
Contact Information
• Postal address;
• Email address;
• Telephone number;
• Emergency contact details.
Health Information
Where necessary for treatment purposes, we may collect:
• Medical history;
• Existing medical conditions;
• Allergies;
• Current medications;
• Previous treatments;
• Skin concerns;
• Pregnancy status where relevant;
• Lifestyle factors affecting treatment suitability.
Appointment Information
• Consultation records;
• Treatment notes;
• Before and after photographs (with consent where required);
• Patch test records;
• Appointment history;
• Treatment outcomes.
Financial Information
• Payment records;
• Transaction details;
• Billing information.
We do not store full payment card details on our systems.
Marketing Information
• Communication preferences;
• Newsletter subscriptions;
• Promotional preferences.
Technical Information
When you visit our website, we may collect:
• IP address;
• Browser type;
• Device information;
• Operating system;
• Referring website;
• Website activity;
• Cookie identifiers.
6. How We Collect Information
We collect personal information through:
Direct Interactions
When you:
• Complete consultation forms;
• Book appointments;
• Purchase products;
• Contact us;
• Subscribe to marketing communications;
• Complete online enquiries.
Automated Technologies
Through:
• Cookies;
• Analytics software;
• Website tracking technologies;
• Security monitoring systems.
Third Parties
We may receive information from:
• Booking platforms;
• Payment processors;
• Social media platforms;
• Referral partners;
• Healthcare professionals where authorised by you.
7. Purposes of Processing
We use personal information for the following purposes.
Service Delivery
To:
• Arrange consultations;
• Manage bookings;
• Deliver treatments;
• Assess treatment suitability;
• Maintain treatment records;
• Communicate regarding appointments.
Health and Safety
To:
• Protect client wellbeing;
• Identify contraindications;
• Comply with professional obligations;
• Maintain accurate treatment histories.
Business Administration
To:
• Process payments;
• Maintain records;
• Resolve complaints;
• Respond to enquiries;
• Improve customer service.
Website Improvement
To:
• Monitor website performance;
• Analyse user behaviour;
• Improve website functionality;
• Enhance user experience.
Legal Compliance
To:
• Meet regulatory obligations;
• Defend legal claims;
• Prevent fraud;
• Comply with law enforcement requests.
Marketing
Where permitted by law or with your consent, we may use your information to:
• Send newsletters;
• Notify you of offers;
• Inform you of new treatments;
• Share business updates.
8. Lawful Bases for Processing
We process personal data under one or more lawful bases set out within Article 6 UK GDPR.
Contract
Processing necessary to provide requested services.
Legal Obligation
Processing necessary to comply with legal requirements.
Legitimate Interests
Processing necessary for legitimate business interests where your rights do not override those interests.
Consent
Processing based upon your freely given consent.
9. Processing Health Information
Health information is classified as Special Category Data.
We process this information under Article 9 UK GDPR because it is necessary for:
• Preventative healthcare;
• Treatment assessment;
• Health management;
• Protection of client safety.
Where consent is required, it may be withdrawn at any time, although withdrawal may affect our ability to provide certain services.
10. Marketing Communications
We will only send direct marketing communications where:
• You have provided consent;
• We have a lawful basis under PECR;
• Existing customer exemptions apply.
You may opt out at any time by:
• Clicking the unsubscribe link;
• Contacting us directly;
• Updating your communication preferences.
Opting out of marketing does not affect essential service communications.
11. Sharing Personal Information
We do not sell personal information to third parties.
We may share information with:
• Payment processors;
• Website hosting providers;
• Booking software providers;
• Email marketing providers;
• Professional advisers;
• Accountants;
• Legal advisers;
• Regulatory authorities;
• Insurance providers where necessary.
All third-party providers are required to process personal information securely and lawfully.
12. International Transfers
Where personal information is transferred outside the United Kingdom, we will ensure appropriate safeguards are implemented, including:
• Adequacy regulations;
• International Data Transfer Agreements;
• Standard contractual clauses approved by UK authorities.
13. Data Security
We implement appropriate technical and organisational security measures including:
• Password-protected systems;
• Secure storage;
• Restricted access controls;
• Staff confidentiality obligations;
• Encryption where appropriate;
• Regular security reviews.
We maintain procedures to address suspected data breaches and will notify regulators and affected individuals where legally required.
14. Data Retention
Personal information will only be retained for as long as necessary to fulfil the purposes for which it was collected.
Factors considered include:
• Legal obligations;
• Regulatory requirements;
• Professional guidance;
• Limitation periods for legal claims;
• Business record requirements.
Treatment records may be retained for several years following your last appointment where necessary for legal, insurance or professional purposes.
15. Your Rights
Under UK GDPR, you have the right to:
Right of Access
Request a copy of your personal information.
Right to Rectification
Request correction of inaccurate information.
Right to Erasure
Request deletion of personal information where applicable.
Right to Restrict Processing
Request limits on how information is used.
Right to Data Portability
Request transfer of data in a structured format.
Right to Object
Object to certain forms of processing.
Rights Relating to Automated Decision-Making
Request human intervention where applicable.
Right to Withdraw Consent
Withdraw consent at any time.
Requests should be submitted using the contact details provided in this Privacy Policy.
16. Cookies
Our website uses cookies and similar technologies to:
• Ensure website functionality;
• Analyse website traffic;
• Improve performance;
• Enhance user experience;
• Deliver relevant advertising where applicable.
17. Third-Party Websites
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and recommend reviewing their individual privacy policies.
18. Children’s Privacy
Our website is not intended for children under the age of 16. We do not knowingly collect personal information from children without appropriate parental or guardian consent where required by law.
19. Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy from time to time.
Updated versions will be published on our website with the revised effective date.
20. Complaints
If you have concerns regarding how your personal information has been handled, please contact us in the first instance.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk
21. Contact Us
If you have any questions regarding this Privacy Policy or your personal information, please contact:
No. Twenty Four
[342 London Road, Stanway, Colchester, CO3 8LT]
[hello@no24stanway.com]
[01206 522424]
By using our website and services, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein.