Privacy Policy

Our website uses cookies to analyse how the site is used and to ensure your experience is consistent between visits. See our Cookie Policy for details.

1. Important Information & Who We Are

Purpose of This Privacy Notice

This privacy notice explains how Serene Skin & Beauty collects and processes your personal data through your use of this website, including any data you may provide when you submit an enquiry via our contact form.

This website is not intended for children and we do not knowingly collect data relating to children.

Please read this notice alongside any other privacy or fair processing notice we may provide on specific occasions. It supplements those notices and does not override them.

Controller

Serene Skin & Beauty is the data controller responsible for your personal data (referred to as “we”, “us” or “our” in this notice). We have appointed a data privacy manager who is responsible for overseeing questions relating to this notice.

Contact Details

Serene Skin & Beauty, 178 Cross Street, Sale, Manchester, M33 7AQ
Email: info@sereneskinandbeauty.co.uk
Phone: 0161 210 5076

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk). We would, however, appreciate the opportunity to address your concerns before you approach the ICO — please contact us in the first instance.

Changes to This Notice

This notice was last updated in April 2025. Historic versions are available on request. Please keep us informed if your personal data changes during your relationship with us so that our records remain accurate.

Third-Party Links

This website may include links to third-party websites, plug-ins and applications. Clicking those links or enabling those connections may allow third parties to collect or share data about you. We do not control third-party websites and are not responsible for their privacy notices. We encourage you to read the privacy notice of every website you visit.

2. The Data We Collect About You

Personal data means any information about an individual from which that person can be identified. It does not include anonymised data.

We may collect, use, store and transfer different kinds of personal data about you, grouped as follows:

• Identity Data — first name, last name, title and company name.
• Contact Data — billing address, email address, telephone numbers.
• Financial Data — payment card details (processed securely; we do not store full card numbers).
• Transaction Data — details about payments to and from you and details of treatments purchased.
• Technical Data — IP address, browser type and version, time zone, browser plug-in types, operating system and other technology on the devices you use to access this website.
• Usage Data — information about how you use our website, products and services.
• Marketing & Communications Data — your preferences in receiving marketing from us and your communication preferences.

We also collect, use and share Aggregated Data (statistical or demographic data) for analytical purposes. Aggregated Data is not considered personal data as it does not identify you. If we combine Aggregated Data with your personal data in a way that identifies you, we treat the combined data as personal data.

We do not collect Special Category Personal Data (such as health, racial or ethnic origin, religious beliefs, sexual orientation, political opinions, or biometric data) through this website, nor do we collect data about criminal convictions or offences.

3. How We Collect Your Personal Data

Direct Interactions

You may provide us with Identity, Contact and Financial Data by filling in forms or corresponding with us by phone, email or otherwise — for example, when you book a treatment, request marketing, enter a competition or promotion, or give us feedback.

Automated Technologies

As you interact with our website, we may automatically collect Technical Data about your equipment and browsing patterns using cookies, server logs and similar technologies. Please see our Cookie Policy for further details.

Third Parties & Public Sources

We may receive Technical Data from analytics providers (such as Google Analytics), advertising networks (such as Facebook and Google), and search information providers. We may also receive Identity and Contact Data from publicly available sources.

Where third-party providers are based outside the UK or European Economic Area, we ensure appropriate safeguards are in place in accordance with UK GDPR and the Data Protection Act 2018.

4. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly we will use it where:

• We need to perform the contract we are about to enter into or have entered into with you.
• It is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• We need to comply with a legal or regulatory obligation.

We do not generally rely on consent as a legal basis for processing your personal data, other than in relation to sending you direct marketing by email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

Purposes for Which We Use Your Personal Data

Marketing

We may use your Identity, Contact, Technical, Usage and Profile Data to decide which products, services and offers may be relevant to you. You will receive marketing from us if you have requested information, purchased from us, or provided your details in connection with a competition or promotion — and have not opted out.

We will obtain your express opt-in consent before sharing your personal data with any third party for marketing purposes.

You can opt out of marketing at any time by following the unsubscribe link in any marketing message, or by contacting us directly. Opting out of marketing does not affect data processed in connection with a purchase or other transaction.

5. Disclosure of Your Personal Data

We may share your personal data with:

• Service providers acting as data processors based in the United Kingdom, who provide IT and system administration services.
• Professional advisers (including accountants) based in the United Kingdom.
• HM Revenue & Customs, regulators and other UK authorities where required by law.
• Third parties to whom we may sell, transfer or merge parts of our business. Any new owner will use your personal data in accordance with this notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not permit third-party service providers to use your personal data for their own purposes.

6. International Transfers

We do not routinely transfer your personal data outside the United Kingdom. Where any transfer does occur (for example, through third-party analytics tools), we ensure appropriate safeguards are in place in accordance with UK GDPR, including the use of Standard Contractual Clauses or reliance on an adequacy decision where applicable.

7. Data Security

Your data is stored at 20i’s primary UK data centre in Nottingham. We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorised way, altered or disclosed.

Access to your personal data is limited to those employees, agents, contractors and third parties who have a legitimate business need. They process your personal data only on our instructions and are subject to a duty of confidentiality.

We have procedures in place to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to do so.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting or reporting requirements.

By law, we are required to keep basic information about our clients (including Contact, Identity, Financial and Transaction Data) for six years after they cease being clients, for tax purposes.

In some circumstances we may anonymise your personal data for research or statistical purposes, in which case it may be used indefinitely. You may also request erasure of your data — see your rights below.

9. Your Legal Rights

Under UK data protection law, you have the right to:

• Request access to your personal data (a “data subject access request”) — to receive a copy of the data we hold about you and verify it is being lawfully processed.
• Request correction of any inaccurate or incomplete personal data we hold about you.
• Request erasure of your personal data where there is no good reason for us to continue processing it.
• Object to processing where we rely on legitimate interests or where we are processing your data for direct marketing.
• Request restriction of processing — for example, while we verify the accuracy of data you have disputed.
• Request transfer of your personal data to you or a third party in a structured, machine-readable format (where applicable).
• Withdraw consent at any time where we are relying on consent to process your data — without affecting the lawfulness of processing carried out before withdrawal.

You will not usually have to pay a fee to exercise your rights. We aim to respond to all legitimate requests within one month. We may need to verify your identity before processing a request.

To exercise any of these rights, please contact us at info@sereneskinandbeauty.co.uk or write to us at 178 Cross Street, Sale, Manchester, M33 7AQ.

10. Definitions & Glossary

Lawful Basis

Legitimate Interest — the interest of our business in conducting and managing our business to give you the best service and most secure experience. We always consider and balance any potential impact on you and your rights before processing personal data on this basis.

Performance of Contract — processing your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering such a contract.

Legal Obligation — processing your personal data where necessary for compliance with a legal or regulatory obligation.