Privacy Policy

Harbour Hair Salon is the controller of your personal information: we decide how it is used and we are responsible for looking after it. You will find us at Upper Floor, Unit 15 Central Arcade, Central Rd, Leeds LS1 6DX. See “How to contact us” below.

We collect only what we need to run your account and your appointments:

• Account details: your name, email address, phone number (optional) and a securely scrambled (hashed) version of your password. We also record when you confirmed your email address, and the language you use our site in so that our emails reach you in that language.
• Google sign-in: if you choose “Continue with Google”, Google gives us your name, your email address and an ID for your Google account. We never see your Google password.
• Bookings: the service, stylist, date, time, price and status of each appointment, any change of time you ask for, and notes our staff add to help with your visit. We also record when you arrive for your appointment: if you are more than 15 minutes late without letting us know, your booking can be cancelled automatically, as our booking terms explain.
• Online deposits: if your booking needs a deposit, its amount, whether it is held, taken, released or refunded, the dates, and the references Square gives the payment and any refund. Your card details go straight to Square: we never see or store your card number.
• Patch tests and consultations: some colour services need a skin patch test first. We keep a record of your patch tests and consultations (when they took place, and which service a consultation was for) so that we can check whether a colour service is safe to book. If you tell us about an allergy or a reaction, we may note it on your booking.
• Bookings made with our staff: if you book by phone, WhatsApp or in the salon, we record your name and, if you give them, your phone number and email address.
• Emails we send you: booking confirmations, reminders, changes of time, cancellations, and replies when we cannot confirm a request or a change of time, and whether each one was delivered.
• Reviews: if you review a visit, your rating, your comment and which appointment it was for.
• Marketing preference: if you subscribed to our marketing emails in the past, your email address and whether you have since unsubscribed. We no longer take new sign-ups on this website.
• Security information: your device’s IP address, used briefly to stop abuse such as repeated sign-in attempts or floods of emails; a record of account events such as sign-ins, email confirmations and password changes (it does not include your IP address); and the short-lived technical logs our hosting provider keeps.
• Visits: we count page visits and clicks on our booking buttons, and measure how fast pages load, with Vercel Web Analytics and Speed Insights. They use no cookies and do not identify you.
• Virtual Hair Colour Try-On: the tool works entirely on your device. Your photo, video or camera picture is never sent to us or stored.

You do not have to give us your information, but without your name and email address we cannot create an account or take an online booking. You can always book by phone instead.

UK data protection law requires a lawful basis for each use of your information. Ours are:

• To run your account and your bookings: creating your account, taking and managing appointments and reschedule requests, and sending the emails that go with them. Basis: contract (we need it to provide the service you ask for).
• To take, release and refund deposits: holding the deposit when you send a request, taking it when we confirm your booking, and releasing or refunding it under our booking terms. Basis: contract. Keeping the payment records for our accounts is a legal obligation.
• To check that a colour service is safe for you: patch-test records, and any allergy or reaction you tell us about. Basis: contract; for health information, your explicit consent, which you can withdraw at any time.
• To publish your review: on this website after we have checked it, with your name as it appears on your account, the service and the stylist. Basis: consent. You choose to submit it, and you can ask us to remove it at any time.
• To send marketing emails: only if you subscribed. Basis: consent, which you can withdraw at any time with the link in any marketing email or on our unsubscribe page.
• To keep the website and your account secure: limiting repeated attempts, confirming email addresses and keeping a record of account events. Basis: legitimate interests (protecting our customers and our systems).
• To count visits and measure page speed: so that we can improve the website. Basis: legitimate interests.
• To keep business records and deal with legal claims. Basis: legal obligation (for example tax records) and legitimate interests.

We do not sell your personal information. We share it only with these service providers. Unless we say otherwise below, they handle it on our behalf and under our instructions:

• Vercel: hosts this website; the parts that handle your details run on its servers in London.
• Neon: our database, stored in London.
• Resend: sends our emails and holds our marketing mailing list.
• Upstash: stores the short-lived records that limit repeated attempts.
• Square: takes our deposit payments. Your card details go from your browser straight to Square, which also receives the name and email address on your account so that the payment can be verified. Square handles card payments and its fraud checks as an independent controller, under its own privacy notice — not on our behalf.
• Google: if you choose to sign in with Google, or to show the map on our Contact page, Google handles that information under its own privacy policy. We also use Google Calendar as the salon’s appointment diary, which Google hosts on our behalf: it holds your name, phone number, booking details and the notes our staff add to your booking. Times our staff block out in that diary can also stop those times being offered for online booking.
• Booking marketplaces such as Fresha and Treatwell: they receive only the times each stylist is busy, so that they do not double-book. Never your name or any other details.

Some images, and the software the Virtual Hair Colour Try-On runs on, load from other content networks (such as Cloudinary, jsDelivr and Google). Like any site you load files from, they see your IP address; we send them none of your details.

We may also share information when the law requires it, for example with HM Revenue & Customs or the police.

This website runs, and our database is stored, in London. Some of our providers are US companies or part of US groups (Vercel, Neon, Resend, Upstash, Google and Square), so some of your information may be handled in the United States. Where it is, it is protected by the safeguards UK law requires, such as the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum.

• Your account: while it is open, until you ask us to delete it.
• Booking records, including patch-test and consultation records: up to 6 years after the appointment, for our accounts and in case of legal claims.
• Payment records (deposit amounts, status, dates and Square’s references): up to 6 years after the payment, for our accounts. If you ask us to delete your account, we keep them, but they are no longer linked to your name.
• The record of account events: up to 6 years, like booking records.
• Reviews: while your account is open, unless you ask us to remove one sooner.
• Copies of emails waiting to be sent: deleted as soon as the email is sent, or after 30 days if it could not be sent. The record that an email was sent (without its content) is deleted after 12 months.
• Copies in the salon’s Google Calendar: up to 12 months after the appointment, then deleted. A deleted copy can stay in Google Calendar’s bin for up to about 30 days before Google removes it. If you ask us to delete your account, the copies show no name, phone number or notes.
• The salon diary shown to our staff on this website: a copy of the titles and times of the entries in the salon’s Google Calendar, in which our staff may write your name or phone number. We keep it so our staff see it in one place and online booking does not clash with it. Only our staff can see it, and each entry is deleted 30 days after the entry ends.
• IP addresses used to limit repeated attempts: deleted automatically within 2 days.
• Links in our emails stop working after a set time: email confirmation after 48 hours, password reset after 1 hour, unsubscribe after 30 days.
• Marketing list: until you unsubscribe. After that we keep your address marked as unsubscribed, so that we never send you marketing again.

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to limit how we use it;
• object to us using it where we rely on legitimate interests;
• ask for information you gave us in a format you can take elsewhere;
• withdraw your consent at any time where we rely on it (this does not affect what we did before).

Some rights have limits: for example, we may need to keep booking records for our accounts. We do not charge for requests, and we will reply within one month.

If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

To use any of your rights or ask about your information, call us on 07831 830898, speak to us in the salon, or reply to any email we have sent you. Our full details are on our contact page. We will reply within one month.

We use only the cookies this website needs to work. We use no advertising or tracking cookies, and our visit counting uses no cookies at all.

• session: keeps you signed in. Up to 30 days (8 hours for staff).
• session_hint: lets the page header show your account links. It holds only whether you are signed in as a customer or as staff, and lasts as long as your sign-in.
• login_device: remembers that this browser has signed in to your account before, so that strangers’ failed attempts cannot lock you out. 180 days.
• google_oauth_state: protects “Continue with Google” against forgery. 10 minutes.
• hh_locale: remembers the language you chose. 1 year.

Staff using the salon’s own devices also get cookies for the clock-in tablet and for administrator sign-in.

The map on our Contact page comes from Google and loads only after you click to show it. Google may then set its own cookies, under Google’s privacy policy.

When a booking needs a deposit, the card form on the booking page comes from Square. Square may set its own cookies or use similar technology there, for example to prevent fraud, under Square’s privacy notice.

We do not profile you. One booking decision can be made automatically: while our late-arrival rule is switched on, if you have not been marked as arrived 15 minutes after your appointment starts and you haven’t let us know you’re running late, the booking system cancels the booking and, as our booking terms explain, keeps your deposit. Our staff record arrivals, can reverse such a cancellation within 24 hours, and you can ask us to review it by calling the salon. The booking system also checks things such as opening hours and whether a patch test is needed; if it cannot book what you want, you can always call us.

We will update this policy when the way we handle personal information changes. The date at the top shows when it last changed.